Report: one repository into six, the first day in numbers

Report: one repository into six, the first day in numbers

Status: a report, written by dev@php.newsroom at the editor's request on 25 October 2026 ("write a detailed article … as much details as you can, as much statistics as you can … and even some of the challenges"). It is the first of four: this one is the day and its numbers; Report: one source for every file is the design; Report: one repository into six, the challenges is what went wrong and what it taught; Report: one repository into six, how to work in it is the runbook. Measured at site v0.22.5 (v1 commit 30dd7ddd6052), press v1.0.5 and data v0.1.5, between 18:00 and 18:20 UTC.

The site that tracks the two PHP flaws of October 2026 was one repository until 15:31 UTC on 25 October. By 18:12 UTC it was seven: the original (v1, still where every page is built and every agent writes) and six new ones that serve it in parts, each with its own gate, release and address. Every page v1 builds has exactly one owner among the new sites. Every old address answers on every site. No site holds a copy of a file another one serves. None of the six is live yet, for one reason only: GitHub Pages has not been told to deploy them (board row 328, the editor's).

The proposal (why split, and how) and the plan (who does what, in which order) were written before the work: the proposal and the plan. This report is what happened.

The day, by the clock (UTC, 25 October 2026)

In under three hours: 6 repositories went from an empty README to a working system; 8 releases of v1 (7 for the split; v0.22.0 was the design agent's), 6 of the press, 6 of the data API, 4 released cuts of each site. Every release went through its repository's own release script and gate; nothing was pushed by hand, nothing force-pushed, nothing to main.

The seven repositories

The press and the data API are big because they keep every published version whole (v/<version>/), which is the point: a version is an address that never changes. The data repository holds six versions of 474 files (12.8 MB each) plus its working copy; the press six versions of its 131 files (6.1 MB of assets each).

The four sites

Each site is v1's committed output at one commit, cut by first path segment (sites.json in the press says who owns which section). A page another site owns becomes a redirect page at its old address, so old links and search engines' indexes land.

v1 builds 1,096 pages (2,228 files in its outputs.txt): the 1,095 above, each owned once, and the 404 router, which every site keeps its own copy of because it is how GitHub Pages answers a view address (/agencies/as/security/). The "other files" are each page's markdown twin and a few feeds.

A redirect page is 600 to 750 bytes: a canonical link, a meta refresh, noindex, and one sentence with the link. The 3,284 of them cost 2.37 MB in all.

The links, rewritten

The partition reads every href and src of every page it writes. On the four sites, at v0.22.5:

refs carries the most cross-site links because every source and fact page links back to the stories and the claims that cite it, which the main site owns. team carries the most links to GitHub, because its pages (the appsec reviews, the agents' rounds) link to markdown sources that no site serves; those go to the file in v1's repository.

30 links do not resolve in v1 either; the partition leaves them as they were and lists them in each site's press.json: 27 on one prototype page (/admin/design/line/agencies/, one directory too shallow, board row 329, story-site's), two on graph/component/ (its page and its markdown twin link data/graph.json relative to the page) and one markdown ellipsis in an advisory (SA-2026-003). They are v1's to fix at the source.

The data API

"Runtime" is the group the pages' scripts fetch: items, telemetry, contributors, collaborators, control, personas, stack, subscriptions. Two of them (telemetry and subscriptions) hold their lane's write-only append token, as v1 always has; a published version keeps the token it was published with (flagged to security).

The press

The team's records

The team repository holds two things: the team's pages at its root (cut by the press like the other sites) and, under records/, what the agents write, imported from v1 until the cutover. The board, one JSON object in v1, is one file per row here, so two agents adding rows never touch the same file.

Its records' gate takes 0.11 s; its pages' gate 2.1 s.

The gates, timed

The point of the split is in that table. A change to the references is checked in 7 seconds instead of 75, and a change to the team's records in a tenth of a second.

What one source for every file saved

The first cut (press v1.0.0) gave every site its own copy of the assets and the data, because the pages' policy allowed scripts and requests only from their own host. Each site carried 726 copied files, 25.95 MB: 2,904 files and 104 MB across the four, every one a second (or fifth) source for a file that already existed. The editor ruled it out the same afternoon ("we don't want to have engineering issues, and ironically security issues, by having multiple sources for the same files"), and the policy changed instead. At v1.0.3 the copies were gone: each site keeps only its pages, its redirects, VERSION, the 404 router and .well-known/. How, and what the policy says now, is Report: one source for every file.

The browser test

The six hosts were served from their repositories in Chromium (Playwright intercepting each host name), and these pages loaded: the four front pages; sources, the graph, the parties, the component page and the Wikipedia article on refs; the stack tool, the risk graph's explorer and its changes, the reader, your desk, an article and a view address on the main site; what's new and the feeds on updates; the status page, the control room and the collaborators on team; a moved address on the main site (it redirects to refs). On each: no missing file, no Content-Security-Policy violation, the Ask pane opens. A page makes 23 to 27 requests to the press, 2 to 3 to the data API and 1 to 3 to its own site.

Separately, every executable inline script on the four sites (198) was hashed and checked against its own page's policy: all 198 are allowed, as v1's 195 are on v1 (the three more are the 404 router's copies).

What is left

• Deploy. Each of the six repositories needs its Pages source set to "Deploy from a branch: dev, / (root)" (board row 328). The press and the data API first: every page of the other four loads its scripts from the press.
• Pass two. Each site's sources (its pages' content and the build code that writes them) move into its repository and the build library into the press, so v1 stops being where every page is built. Until then every v1 release is followed by the chain: the press takes the assets, the data is imported, the four sites are cut (Report: one repository into six, how to work in it).
• The cutover. The agents' cards and WAKE.md name their repositories; php.oct.2026.newsroom.sgit.ai moves to the site repository; v1 is renamed …__PHP__v1, archived and read-only. The editor's go.