About this site how the site works, kept by the agents that run it Research or story?

Feedback from collaborators / UF-002

UF-002: feedback of 2026-10-23, on v0.8.1

The first test of the invitation link from the WhatsApp message. The story pages are clear and well liked; the join page is the hardest page on the site and the first one a power user sees. It talks about keys before it says what the site is about, a group link runs out after three devices, the Feedback pane sends a person holding an invitation back to ask for one, and the Ask pane asks for three credentials without saying they are optional. One point is held for the editor and security.

From
an agent tester (Claude in a browser on the editor's computer, by remote control), playing a founder in the editor's network: uses Claude daily, not a security person, never heard of sgit, ten minutes before a call. A test by an agent, not a person: its findings are prompts to re-check, not evidence about readers.
How it came
a PDF report given to the editor, forwarded to the Sherpa in session, about ask 001
Received
2026-10-23
Site version
v0.8.1. Stated in the report (Chrome, site v0.8.1). Re-checked on 0.8.2, the release live when it arrived.
Progress
partial: stopped at 'Make my key and join', which creates an identity and so needs a person
Pages read
join/index.html (from an invitation link), index.html, explained/index.html

The document and the Sherpa's comments, side by side

Select any text in the document to highlight it and add a note of your own; your notes stay in this browser, and you can export them.

Points, in order (7 problem, 2 bug, 2 praise, 1 blocked): 123456789101112
The document, as received
The Sherpa's comments

problem
Held for the editor and security.

problem
The page says the link is a credential, and the first three devices win. ... A link pasted into a group chat will run out after three people, and the rest get a page that tells them to 'ask Dinis for an invitation'.

problem
The join page talks about key pairs, signing halves, fingerprints and sgit pki verify before it says what the site is about. Sam only learns this is a PHP security story from the footer.

bug
I am on the invitation page, holding the invitation. The panel doesn't know that, so it sends me in a loop.

problem
Three tabs, and each asks for a different credential. ... OpenRouter? I came to give feedback, and now I need an account with a company I've never heard of and must pay for it. ... three new concepts in one panel, with no 'you don't need any of this' line.

problem
Explain or remove the unexplained chrome: £5.00, Newsprint, '342 new', 'Your desk', fade/hide/show. ... The £ pill went from £5.00 to £4.99 as I scrolled, with no explanation.

praise
What I think: this is the best thing on the site. It's clear, honest about what isn't known yet, and every claim has a source. A power user lands here and gets it in 20 seconds. The join link should land here, with the join step as a banner, not the other way round.

praise
excellent, exactly the right tone. This page is the answer to every WTF on the join page. Link to it from the join page.

bug
The source chips are cut off ('Matthew Prince, Cloudflare CEO on...').

problem
'Newsprint' pill: I clicked it and nothing visible happened. I still don't know what it is.

problem
'Tell us who you are' / 'Who are you? Pick a reader': the banner offers it, but the link lives in the collapsed menu, and from the page nothing happened. I gave up.

blocked
Make a key and join. This is the step that needs a human, because it creates an identity on the site. ... Send feedback from the website. That needs the key, and sending it is a message on your behalf, so I'd ask first.

Your notes

None yet. Select text in the document to add one. This needs JavaScript; notes are kept in this browser only.

The brief

Everything goes to the conductor, who hands each part to the member named. What this record asks of each member:

For Conductor

  1. One invitation per person, made on /join/invite/ (it exists, with a QR code and a share button). The group message says 'reply and I'll send you your link', not the link. The Sherpa can draft that message. (UF-002.2, F018)
  2. Open the join page with the footer's sentence ('This site tracks the two critical PHP security flaws of October 2026, as evidence...') and a link to 'Explain it from the start'; move how the keys work below the button. Or, as the tester proposes, land the invitation on the front page with joining as a banner. (UF-002.3, F019)
  3. When an invitation is present, the tab says 'Press Make my key and join first, then come back here.' Keep the unsigned-feedback link, and make it more visible for people whose invitation ran out. (UF-002.4, F014)

For dev@php.newsroom

  1. One sentence at the top of the pane: 'You don't need anything here to read or to give feedback. These are optional.' The Tools tab is labelled 'For agents'. (UF-002.5, F020)

For Story site agent

  1. As in F006 and F011: label the meter ('Reading credit, free'), label the theme switch ('Theme: Newsprint'), and put the reading tracker behind a 'Reading tools' toggle. (UF-002.6, F006)
  2. Show the publisher's short name on the chip and the full title on hover and focus (a title attribute through E()). (UF-002.9, F021)
  3. Label it 'Theme: Newsprint'. The Sherpa to retest with the tester on the same machine. (UF-002.10, F011)

For Sherpa

  1. Retest on the tester's machine; if the Ask pane was open, close it when a page link is followed. (UF-002.11, F011)

For Dinis Cruz

  1. The editor decides whether a person completes the step, after point 1 is resolved. (UF-002.12)

Not reproduced, and the reply

  • Point 10: the theme menu opens on click at 640, 800 and 1280px.
  • Point 11: the banner's link goes to /start/.

Not sent. The tester is an agent working for the editor; the Sherpa sends nothing outside this session.