{
 "about": "Every vault behind this site: what each holds, who writes to it, and how to open it. Three kinds of credential appear here. A vault key reads and writes; it is never published. A read key reads only and cannot be turned into a vault key; the two public vaults publish theirs. An append token adds rows to one lane and cannot read anything; the telemetry lane publishes its token so every page can write to it.",
 "vaults": [
  {
   "slug": "evidence",
   "id": "3ytzxm3g",
   "name": "The evidence vault",
   "access": "public read",
   "app": true,
   "holds": "The story as it was assembled on the morning of 22 October 2026: every source as a folder with its capture (text, screenshot, HTML, headers, sha256 of each), the claims and the dated events each agent extracted, the editor's memos and the agents' notes. Its own app explores them.",
   "writers": "the collectors, the story-site agent and the newsroom lead; the editor",
   "page": "admin/vault/index.html",
   "data": "data/vault.json"
  },
  {
   "slug": "source-watch",
   "id": "oq9gflln",
   "name": "The source watch",
   "access": "public read",
   "app": false,
   "holds": "Every outside source on the story, watched on a schedule: country, sector, publisher and page; what access each check had; a snapshot whenever the content changed; and every snapshot and every change as a graph. The evidence vault's 184 sources were its first snapshots.",
   "writers": "researcher@php.newsroom, the agent that runs the watch",
   "page": "vaults/source-watch/index.html",
   "data": "data/source-watch.json"
  },
  {
   "slug": "telemetry",
   "id": "84wr8mib",
   "name": "The telemetry vault",
   "access": "private, with a public append lane",
   "app": true,
   "holds": "One anonymous event per page view (page, referrer host, country, region and city; no IP address, no cookie), each encrypted in the reader's browser to a key held by the drainer, and the counts drained from them.",
   "writers": "every page of this site, through the write-only lane; dev@php.newsroom drains it",
   "page": "admin/telemetry/index.html",
   "data": "data/telemetry.json",
   "facts": "imports the telemetry application (5wnsr5h8) at telemetry-ux/, read-only; opened with its vault key and the server access token, its Queue & drain page drains the lane in the browser",
   "note": "It opens as its own dashboard: the application is not in it but in a vault of its own, versioned there, which this vault links inside itself and loads on open. The key that decrypts the events sits in it sealed under a passphrase (identity/drain-key.json); the passphrase is typed by whoever drains."
  },
  {
   "slug": "subscriptions",
   "id": "wgeiqabu",
   "name": "The subscriptions vault",
   "access": "private, with a public append lane",
   "app": false,
   "holds": "Subscription requests (an email address, what to follow, how often), each encrypted in the reader's browser to a key held by the editor and the agent that sends, and the list of addresses with their status: requested, confirmed or left.",
   "writers": "readers, through the write-only lane on /subscribe/; dev@php.newsroom drains it; the agent at agent@diniscruz.ai confirms and sends",
   "page": "subscribe/index.html",
   "data": "data/subscriptions.json"
  },
  {
   "slug": "coverage",
   "id": "dcsmxese",
   "name": "The coverage vault",
   "access": "private",
   "app": false,
   "holds": "How other outlets presented the story: 24 pages (the BBC live page, CNN, The Register, The Hacker News, php.net, CISA, NCSC-NL, Wiz, Calif, php2shell.com, the PHPocalypse Tracker and more) captured on 22 October 2026 between 17:20 and 17:45 UTC, each with desktop, full-page and phone screenshots, the page text and a provenance file with the SHA-256 of every file; and the review of what this site should learn from them. Third-party pages, kept for the record and never republished.",
   "writers": "claude-story-site, the agent that designs this site",
   "facts": "24 sources, 24 captures, 159 files; 72 screenshots",
   "note": "The review written from it is published in the repository; its findings become facts on this site only once they cite a capture.",
   "page": "vaults/index.html#coverage",
   "data": "admin/content/reviews/2026-10-22__coverage-review.md"
  },
  {
   "slug": "conductor",
   "id": "5iwos28w",
   "name": "The conductor vault",
   "access": "private, with an append lane",
   "app": false,
   "holds": "Where the team is: the roster, the plan that opens every run and the digest that closes it, the broadcasts, and what members send the conductor through its lane, one token per member, each message encrypted to the conductor's key.",
   "writers": "conductor@php.newsroom only; every member of the team reads it",
   "note": "Its read key goes to members privately; the lane's tokens are not published.",
   "page": "team/channels/index.html#conductor",
   "data": "data/team.json"
  },
  {
   "slug": "issues",
   "id": "zjruy9vk",
   "name": "The issues vault",
   "access": "private",
   "app": false,
   "holds": "The team's tasks as files (Issues-FS-lite): one queue per member with open, blocked and done, one markdown card per task. The board on this site is a snapshot of it.",
   "writers": "each member of the team, only inside its own queue",
   "note": "Its key goes to members privately.",
   "page": "team/channels/index.html#issues",
   "data": "data/admin.json"
  },
  {
   "slug": "mail",
   "id": "fmb2tpl2",
   "name": "The mail vault",
   "access": "private",
   "app": false,
   "holds": "The team's messages (Email-FS-lite): a mailroom, an inbox, a done folder and an outbox per member, and each member's session notes.",
   "writers": "each member of the team, in its own folders and other members' mailrooms",
   "note": "Its key goes to members privately.",
   "page": "team/channels/index.html#mail",
   "data": "data/team.json"
  },
  {
   "slug": "telemetry-app",
   "id": "5wnsr5h8",
   "name": "The telemetry application",
   "access": "private",
   "app": true,
   "holds": "The application that reads the telemetry, and nothing else: eight pages (overview, audience, content, journeys, sources and devices, every event, the lane's queue and its drain, about), versioned in the vault itself: a VERSION file, a changelog and one commit per release. It holds no data; the telemetry vault links it read-only and runs its latest version over its own events.",
   "facts": "linked read-only inside the telemetry vault (84wr8mib) at telemetry-ux/; v0.1.1",
   "note": "It is held by the editor, sealed to the editor's key on pki.sgit.ai. Nothing in it is secret.",
   "writers": "dev@php.newsroom",
   "page": "admin/telemetry/index.html",
   "data": "data/telemetry.json"
  },
  {
   "slug": "telemetry-dashboard",
   "id": "i4diy82d",
   "name": "The telemetry dashboard (superseded)",
   "access": "private",
   "app": true,
   "holds": "A vault app that draws the telemetry: page views by hour, pages, countries, regions and cities, devices, referrers, languages, versions, pages per session and the latest events, each a filter. It holds no telemetry itself: the telemetry vault is linked inside it read-only (vault-in-vault), so the app always reads the latest drain.",
   "facts": "links the telemetry vault (84wr8mib) at telemetry/, read-only",
   "note": "Superseded on 22 October by the telemetry application (5wnsr5h8), which the telemetry vault now imports: the data vault opens the app, not the other way round. It is held by the editor, sealed to the editor's key on pki.sgit.ai. Its owner record carries the telemetry vault's read key only, never its write key.",
   "writers": "dev@php.newsroom",
   "page": "admin/telemetry/index.html",
   "data": "data/telemetry.json"
  },
  {
   "slug": "collaborators",
   "id": "58526ytp",
   "name": "The collaborators vault",
   "access": "private, with a public append lane",
   "app": false,
   "holds": "What the collaborators send from /collaborators/: requests to join (a name, an email address, the reader closest to them) and feedback on each ask, each encrypted in the sender's browser to a key held by the conductor and the editor.",
   "writers": "collaborators and anyone else, through the write-only lane on /collaborators/; conductor@php.newsroom drains it; the editor reads it",
   "note": "Its key, the lane's enum key and the key pair's passphrase are never published.",
   "page": "collaborators/index.html",
   "data": "data/collaborators.json"
  }
 ]
}