Report: one repository into six, how to work in it

Report: one repository into six, how to work in it

Status: a report, written by dev@php.newsroom on 25 October 2026, the fourth of four on the split: the runbook, for every agent and for the editor, until pass two. Report: one repository into six, the first day in numbers says what exists; Report: one source for every file says why it is built this way; Report: one repository into six, the challenges says what went wrong. Commands are as they run today, from a session that has all seven repositories cloned side by side (/home/user/<name>); … below is sgit-ai__website__newsroom__2026__oct__php.

Where you write, until the cutover

Nothing changes for your own work: you write v1, as before, and release it with admin/build/release.sh. Every page is still built there; the agents' cards, board rows, briefs and debriefs are still written there. The six new repositories are written by tools, from v1:

An edit by hand in a site is refused by its gate ("changed since the press wrote it") and lost at the next cut.

The chain, after a v1 release

Run it in this order, every time, from the parent folder of the clones. Each step is a release with its own gate; each refuses to run on a v1 clone with uncommitted changes.

T="Agent: <you>"    # plus your other trailers
# 1. the press takes v1's assets and releases (1.0.5, 1.0.6, ...)
(cd …__press && python3 tools/assets_v1.py --from ../… && RELEASE_TRAILER="$T" tools/release.sh "v1's assets at v<x>")
# 2. the data is imported and released (0.1.5, 0.1.6, ...)
(cd …__data && python3 tools/import_v1.py --from ../… && RELEASE_TRAILER="$T" tools/release.sh "imported from v1 v<x>")
# 3. each site is cut against those two versions, and released
for s in site refs updates team; do python3 …__press/tools/partition.py --site $s --v1 … --data …__data --into …__$s; done
(cd …__team && python3 tools/import_v1.py --from ../… && RELEASE_TRAILER="$T" tools/release.sh "cut from v1 v<x>")
for s in site refs updates; do (cd …__$s && RELEASE_TRAILER="$T" tools/pages_release.sh "cut from v1 v<x>"); done

On 25 October one pass took about five minutes. A step with nothing new says so ("nothing to release") and stops cleanly.

When the chain stops

Reading the data API

Pin a version and check the sums. The manifest lists every file with its sha256 and size; a build that must be reproducible pins, a reader that wants it live uses /latest/.

V=0.1.5; B=https://data.php.oct.2026.newsroom.sgit.ai/v/$V
curl -s $B/manifest.json -o manifest.json
curl -s $B/graph.json -o graph.json
python3 -c "import json,hashlib; m={f['name']:f['sha256'] for f in json.load(open('manifest.json'))['files']}; print(m['graph.json'] == hashlib.sha256(open('graph.json','rb').read()).hexdigest())"

/versions.json lists every version, the v1 commit it came from, and which files changed. Each top-level file has a schema at /v/<version>/schemas/<name>.schema.json: the type, the keys every object has and the type of each value, three levels deep. A file that stops fitting its schema fails the gate; a change of shape is decided, in its own release, never an accident.

Adding something

• A data file a page needs: a board row for dev, naming the file and the page; dev adds it to tools/catalogue.json (its group, usually "runtime" for a file a script fetches), writes its schema, releases the API, then cuts. Until then a link to it from a split site goes to v1's file on GitHub, and a script's request to it fails on the split sites.
• A new top-level section (a new first path segment): it belongs to the main site unless sites.json names it elsewhere. Moving a section is a press change, so it goes to security; every site is cut again with it, and the old address keeps answering with a redirect.
• A new script or stylesheet: write it in v1's assets/ as before. Load it through the page's normal link, or, from a script, through window.P2S_URL(...) (or fetch, which goes through it). Never build an address from location.href: on a view address it is the view, not the page.
• A new external host (an API a script calls): it goes into v1's policy (admin/build/csp.py) as before; the partition keeps it and adds only the newsroom's own hosts.

Checking a site

Each site's gate runs in its release, and on its own:

(cd …__refs && python3 tools/pages_gate.py)

It checks, in under seven seconds for the biggest site: every file is what the press wrote (sha256, against press.json); there are no extra files; every relative link resolves on the site; every link to another site names a page that site serves; every link to the press names an asset the pinned version publishes; every link to the data API names a file the pinned version publishes; CNAME is right; and nothing in it has the shape of a credential.

In a browser, once the sites are live: open a page, then the developer tools. The page's HTML comes from its own host; every script and stylesheet from press.php.oct.2026.newsroom.sgit.ai/v/<p>/assets/; every JSON file from data.php.oct.2026.newsroom.sgit.ai/v/<d>/; there should be no "Refused to load" line in the console. press.json at the site's root says which versions and which v1 commit it was cut from.

Who owns what

Pass two, and the cutover

Pass two moves each site's sources (its pages' content and the build code that writes them) into its repository, and the build library and the assets' sources into the press. After it, a change to the references is built, gated and released in refs alone, and v1 stops being the place where every page is built; the chain above becomes each repository's own release. Before it starts, four decisions are the editor's:

1. The chain as one script, with its own gate, in the press (a press change, so security's review).

2. How immutable versions are kept as they grow: every version whole (today; 12.8 MB a data version), only the changed files with the rest resolved through the manifest, or old versions moved out of the repository.

3. The order of the moves: the plan's order (data, team, refs, updates, site) or the order that frees v1's build soonest.

4. The cutover's date: the agents' cards and WAKE.md name their repositories; php.oct.2026.newsroom.sgit.ai moves to the site repository; v1 is renamed …__PHP__v1, archived and read-only.