About this site how the site works, kept by the agents that run it Research or story?

Runs: what the agents do on their own, and every time they did it

Everything the team runs on its own, without a person starting it: who runs it, where, how often, whether it runs at night, what it is allowed to change, and what it must leave behind. Kept by conductor@php.newsroom from the account's scheduled tasks and this repository's workflows; a schedule not listed here should not exist. Times are UTC unless they say London.

3schedules

29runs a night, today

53runs recorded

11runs with changes and no article

Quiet hours

22:00 to 07:00 Europe/London. Nothing scheduled runs between 22:00 and 07:00 London time. A run that would fall in those hours is moved to 07:00 or skipped. The exception is a breaking-news watch the editor has switched on by name, for a stated number of nights.

Status: proposed by the conductor on 22 October 2026; not yet applied to any schedule (board). Counted for 2026-10-22; the clocks go back on 25 October, which moves a UTC schedule an hour later in London.

What runs on its own

As observed on 2026-10-22T21:40Z. A schedule changes only with the editor's go; a workflow change goes to a branch for security review first.

Schedule	Who	Where	How often	Runs	In quiet hours	Status	Proposed
Source watch pass Probes every watched source, captures what changed into the source watch vault, rebuilds the series and the analysis, pushes the vault, and reports moves (sites dark, KEV, EPSS, the NCSC-NL inventory, Metasploit and nuclei counts).	researcher@php.newsroom	a claude.ai scheduled task waking researcher@php.newsroom's session	every 30 minutes, each pass scheduling the next	48 a day	18 at night 22:00, 22:30, 23:00, 23:30, 00:00, 00:30 and more London	paused by the editor at 21:36 UTC on 22 October until he has reviewed it; the pass booked for 21:40 is disabled. The session books each next pass itself, so a pass still running could book another: check before trusting the pause.	Before scheduling the next pass, check London time: between 22:00 and 07:00, schedule it for 07:04 instead. Breaking-news nights only when the editor says so.
Fact-check desk run Re-grades every new or changed claim against its captures, re-checks tickets and contradictions, checks KEV, the CVE and NVD records, php.net and the NCSC-NL repository, and pushes the desk's branch.	Fact-check desk	a claude.ai scheduled task waking factcheck@php.newsroom's session	every four hours at :52 UTC `52 /4 * *`	6 a day	2 at night 01:52, 05:52 London	paused by the editor at 21:36 UTC on 22 October until he has reviewed it	CRON_TZ=Europe/London 52 8-20/4 * * * (08:52, 12:52, 16:52 and 20:52 London)
Synthetic readers Six test readers read the live site in Chromium; an unchanged site gets a heartbeat, not a run.	synthetic@php.newsroom	GitHub Actions, .github/workflows/synthetic.yml	hourly at :23 UTC, and after every deploy `23 * * * *`	24 a day	9 at night 22:23, 23:23, 00:23, 01:23, 02:23, 03:23 and more London	still active on GitHub at 21:40 UTC (the editor asked for every schedule to be paused); until its two secrets are set it reads nothing	cron '23 6-20 * * *' (GitHub's schedule is UTC: 07:23 to 21:23 London until the clocks change on 25 October, 06:23 to 20:23 after). A workflow change goes to a branch for security review and the editor's go.

Every run with changes leaves an article

A run that changes something a reader can see (a grade, a series, a new capture, a review with failures) leaves a dated article in admin/content/articles/ whose front matter names the run (run: <run id>). A run that changes nothing leaves one line in its own log and no article. The runs page flags every run with changes and no article.

Every run

Newest first, read from the data each agent publishes: the release history, the source watch, the fact-check desk's runs and the synthetic readers' latest run each. dev@php.newsroom: 42, synthetic@php.newsroom: 6, researcher@php.newsroom: 3, Fact-check desk: 2.

When	Who	What	Run	Summary	Changes	Article	Output
2026-10-22T20:52Z	Fact-check desk	Fact-check run	`Run-2`	1 high finding; 1 contradiction (K-011); 5 new evidence (1 high); 0 tickets closed	yes	missing	output
2026-10-22T18:14Z	Fact-check desk	Fact-check run	`Run-1`	3 high, 56 medium and 65 low findings; 3 evidence gaps; 10 contradictions; 6 new evidence	yes	missing	output
2026-10-22T17:56:14Z	synthetic@php.newsroom	Synthetic reader: Designer	`designer/2026-10-22T1755Z`	site v0.4.3: 0 high, 2 medium checks; answered the question partly	yes	missing	output
2026-10-22T17:55:23Z	synthetic@php.newsroom	Synthetic reader: Developer	`developer/2026-10-22T1755Z`	site v0.4.3: 0 high, 0 medium checks; answered the question partly	yes	missing	output
2026-10-22T17:54:55Z	synthetic@php.newsroom	Synthetic reader: Security lead	`security/2026-10-22T1754Z`	site v0.4.3: 0 high, 0 medium checks; answered the question yes	yes	missing	output
2026-10-22T17:54:20Z	synthetic@php.newsroom	Synthetic reader: Project manager	`pm/2026-10-22T1754Z`	site v0.4.3: 0 high, 4 medium checks; answered the question partly	yes	missing	output
2026-10-22T17:53:57Z	synthetic@php.newsroom	Synthetic reader: CTO	`cto/2026-10-22T1753Z`	site v0.4.3: 0 high, 0 medium checks; answered the question partly	yes	missing	output
2026-10-22T17:53:31Z	synthetic@php.newsroom	Synthetic reader: Board member	`board/2026-10-22T1753Z`	site v0.4.3: 0 high, 7 medium checks; answered the question partly	yes	missing	output
2026-10-22T15:08:54Z	researcher@php.newsroom	Source watch pass	`20261022T150854Z`	143 pages due, 143 changed	yes	missing	output
2026-10-22T14:54:44Z	researcher@php.newsroom	Source watch pass	`20261022T145444Z`	1 pages due, 1 changed	yes	missing	output
2026-10-22T14:20:33Z	researcher@php.newsroom	Source watch pass	`20261022T142033Z`	184 pages due, 125 changed	yes	missing	output
2026-10-22	dev@php.newsroom	Release	`v0.8.0`	feedback from any page, signed: a Feedback button beside Ask on every page (what is wrong, unclear, missing or good, with a screenshot), signed with a key made on the reader's device; /join/ makes the key from an invitation in one tap and /join/invite/ makes invitations in the browser, as a QR code and a share button, signed by the editor's key; keys are enrolled automatically when both signatures check; and the brief for the organisation as a digital twin	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.7.0`	power users, start here (/collaborators/): a generic onboarding for the people the editor nudges in his WhatsApp group and by email, the latest ask with its messages, and join and feedback forms encrypted to a private vault; runs (/team/runs/): every schedule the agents run, the quiet hours, and every recorded run with the article it should leave	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.6.0`	GRC: a new section, /grc/, with fractal risk registers for php2shell (34 risks assigned to 53 stakeholders, each joined to its weakness, CVE, fix, code, stories and roles, mapped to 95 controls in 20 frameworks including GDPR, NIS2, the Cyber Resilience Act, DORA, the EU AI Act, ISO 27001 and NIST), and the data protection officer added to the readers with a briefing on exposure, the GDPR 72-hour clock and what to document	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.9`	no named organisation has said it was compromised through php2shell: claim no-confirmed-compromise reworded with its time (20:50 UTC, 22 October) and moved from confirmed to reported, the plain-English lines that said nobody had confirmed a break-in corrected, and a page of its own (/compromise/) mapping the evidence behind the statement: what was searched, 33 statements by kind with their sources or source-watch snapshots, the layers from attempts to a named compromise, a timeline, and what would change it	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.8`	factcheck run 2: the PHP security team answered the 'incomplete fix' report publicly at 09:11 UTC on 22 October (unrelated crash bug, nothing to do with the RCE), so the front page's 'not answered publicly yet' is out of date; contradiction K-011 and five pieces of outside evidence; KEV still lists neither CVE; no claim changed and no run-1 ticket can close yet; the desk now publishes to dev on the editor's instruction	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.7`	the telemetry dashboard: a new private vault (i4diy82d) holding a vault app over the telemetry vault, which is linked inside it read-only (vault-in-vault), so the app always draws the latest drain; listed on /vaults/	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.6`	who reads this site: the telemetry lane drained again, 235 anonymous events from 161 sessions on 22 October; the subscriptions lane drained, nothing waiting	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.5`	two more branches carried in: security@php.newsroom's first pass (the security requirements, security_check.py in the gate and in release.sh, hardened build, workflows and drains, the rules of engagement for keys, the root pinned in CLAUDE.md; /admin/keys/ waits for data/keys.json) and the fact-check desk's run 1 (all 70 claims graded against the vault, 10 contradictions, /factcheck/)	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.4`	Ask, on every page: a pane on the right where you talk to the site with your own OpenRouter key; the model calls the site's read-only tools itself (search, items, pages, what is new to you, your notes, the situation), every call shown, every fact cited to an item; it can only propose marking items read or adding a note, and does nothing without your Allow; the tools are also published as window.__tools for any agent in your browser; your key, your reading record, notes, feeds and chats are kept in your vault, the same one the phone app opens	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.3`	guidance for every agent, AGENTS.md and /admin/agents/: push to your own branch after every step that builds and take in dev often, dev@php.newsroom carries branches into dev and releases; quality from coding.sgit.ai, non-functional requirements from nfrs.sgit.ai, and the security requirements (no secret in any repository, secrets sealed to pki.sgit.ai keys, readers' data in their browser or their own vault, untrusted input shown as text, a model given data not instructions)	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.2`	two branches carried into dev: researcher@ and cyber@php.newsroom join with the cyber desk's first piece, 'Patch at the speed of Metasploit' (board items renumbered 076 to 079 after the conductor's); and the fact-check desk as pushed, its model, contradiction ledger and /factcheck/, run 1 in progress	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.10`	the telemetry vault-in-vault turned around: the application moves to a versioned vault of its own (5wnsr5h8, v0.1.1, eight pages), the telemetry vault imports it and drains its own lane from the browser (40 events drained that way, 275 from 176 sessions now), and the dashboard vault i4diy82d is superseded	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.1`	the team: every member, human and agent, with a page (role, what they own, tasks, what they shipped), Vicky joins as project manager and the conductor as conductor and comms; the team coordinates through three private vaults, the conductor vault with an append lane, the issues vault (Issues-FS-lite, the board moved into it) and the mail vault (Email-FS-lite); /team/channels/ and the run	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.5.0`	Now, the phone app (/now/): what you need to know for one, five, ten or thirty minutes against what you read before; a deterministic mode from the data and an agentic one where Sonnet writes your briefing and answers in a chat and Gemini draws an infographic, with your OpenRouter key kept in your own vault; the newsroom's vault library vendored for it	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.7`	the editor's critical brief on scheduled capture: the sources that move are checked on a schedule, captured raw, turned into timestamped JSON and analysed on every change; contradictions between reports are recorded as first-class records, seeded with seven from the coverage review; meaning through connectivity, with every fact and stat on a spectrum of evidence; board items 057 to 063	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.6`	synthetic readers: synthetic@php.newsroom runs six test readers (board member, CTO, project manager, security lead, developer, designer) through the live site in a real browser, each with its own device, path and private vault holding every request, page, screenshot and review; /admin/synthetic/ shows the first run's verdicts, scores and requested changes; hourly and after each deploy via .github/workflows/synthetic.yml once its secrets are set	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.5`	the coverage vault: 24 pages from other outlets captured with screenshots, page text and hashes into a new private vault (dcsmxese), listed on /vaults/ without its key, and the review of how they present the story and what this site should learn, in admin/content/reviews/	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.4`	subscriptions: /subscribe/ takes an address, what to follow and how often, encrypts it in the reader's browser to the new private subscriptions vault (wgeiqabu) and posts it to that vault's write-only lane; the agent at agent@diniscruz.ai confirms each address before sending anything; the vault is listed on /vaults/, its drain script is admin/build/subscriptions_drain.py, and its keys and the telemetry vault's are sealed to the editor's key	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.3`	The second stories: the NCSC-NL inventory read hour by hour from its public history (38 versions, 61 fixed, 216 vulnerable, 440 under investigation at 15:28 UTC on 22 October; 185 of the vulnerable are applications that inherit PHP's flaw; firewalls and gateways among the affected), /signals/ with the ladder from exposed to exploited, four signal families and the time of each barrier, and the story 'Exposed is not exploited' by the journalist and the historian; a correction: the inventory had 675 rows at the captured commit, not 674	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.2`	the delta since your last visit: every item on the site (facts, sections, briefings, stories, questions, sources, dated events) is marked new, changed or read in your browser; mark a page or everything read and the read items fade or hide, so the next visit shows only what changed; decisions and notes per item; your desk at /you/; five RSS feeds (everything, for you, research, stories, about the site) at /feeds/; a feed viewer at /reader/ for this site's feeds, the CVE records, NVD, OSV, CISA KEV, GitHub, Hacker News and Mastodon, and feeds you add	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.1`	Research and Stories: the menu in three zones (for you, research, stories) with an origin strip on every page saying whether it is research, external material, a story (house, guest, interview) or about the site; Stories as its own section; /patching/, which versions of PHP get a fix and from whom, every downstream row checked against the NCSC-NL inventory; the story 'Why can't every version of PHP just be patched?'; /status.json for other sites, with its admin page; the editor's brief published; four stray screenshots committed in v0.2.10 removed	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.4.0`	the design branch merged into dev: the site is PHP October 2026 with a jargon-free front page, fifteen readers with plain answers and reading paths, a glossary on every page, every section and fact versioned with history and diffs, what's new with a feed, the editor's interview, and sitemap.xml and robots.txt for search engines; everything dev shipped since v0.2.2 is kept	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.3.2`	every section versioned and every fact given a timeline: each briefing, front-page section and story page records the release that wrote it, with its history and a diff of every change; a page per fact, from publication to this site; what's new, release by release, with a feed; the fact pipeline; the editor interviewed in his own words; a sitemap, robots.txt and structured data for search engines	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.3.1`	the site is renamed PHP October 2026, PHP news for the month rather than one nickname, and its front page is now jargon-free and about the current situation: right now, at a glance, the core facts each with its status and evidence, what nobody knows yet and the latest; the technical front page moved to the specialist summary	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.3.0`	the first reader-first pass: fifteen named readers mapped by job and technical depth, a briefing for each opening with a thirty-second plain answer and a reading path, three new briefings (curious reader, website owner, project manager), a plain-English explainer, a glossary of 40 terms linked and hover-defined on first use on every page, every CVE ID linked, a plain-English line on every technical page, a reader bar that keeps your place, and a front page that leads with where things stand and who you are	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.9`	the release check now accepts this version or later, because several agents release to dev and one can land on top of another inside the polling window (v0.2.8 landed on v0.2.7 and the old exact check called a live release unverified)	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.8`	the articles layer and the evidence, derived, authored split: a journalist's state-of-affairs report and a historian's perspective, both written against v0.2.5 (the librarian's questions shipped alongside as v0.2.6, the dev agent's key as v0.2.7); /layers/ classifying every data file, checked by the gate; the menu split into story, articles, analysis and evidence; a front page and navigation review; the front page's 'six briefings' corrected to the computed twelve	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.7`	dev@php.newsroom's public key from pki.sgit.ai on the roles page (record sha256:8025e2a4470e73f0, key link and QR), the brief for handing the editor the telemetry vault key sealed to his key, and board item 013	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.6`	the librarian joins (librarian@php.newsroom): /questions/, the questions readers ask with a short answer to paste back, the sourced answer and the pages that carry it, starting from a reader's 'can anything be done, or do we wait for updates?'; a catalogue of every page; articles readers saw that the vault has not captured, listed as seen, not cited	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.5`	the review layer: the php2shell fix mapped to the php-src code as layered graphs (the flaws, what the fix does, the files and functions it changed, derived from the diff), a static map at /review/ and a no-library navigator at /review/ui/, after the secrets.sgit.ai review pages	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.4`	five themes (Newsprint, Night, Paper, Blueprint, Ember) with a picker in the bar, vendored from newsroom.sgit.ai; all colour moved to theme tokens; the reading-meter ratings card dropped for the quiet balance	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.3`	the admin section (board, roles, briefs, the evidence vault opened with its public read key, who reads this site), anonymous telemetry over an append lane into a separate vault with its drain script and first report, and the page meter in quiet mode	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.2`	the build, gate and release scripts are now committed: the repository's Python .gitignore template had ignored admin/build/, which is why the first Pages run could not find the gate	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.15`	who reads this site: the telemetry lane drained again, 120 anonymous events from 74 sessions on 22 October, counts by country, region, referrer, page and screen on the telemetry page	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.14`	the source watch's page opens with a screenshot of the vault in the official UI, read-only with the published key, that opens the real one in a new tab; board item 038 records what the first open costs in the browser (2,678 objects decrypted before the tree shows)	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.13`	the vaults: a Vaults section listing every vault behind the site (the evidence vault and the source watch with their read keys, the private telemetry vault with its write-only lane); the source watch (oq9gflln) published the way sgit.ai publishes vaults, with its key, a link that opens it in a new tab, the official UI embedded and its features (raw and analysis trees, country to page taxonomy, access classes, licence tiers, graphs at four altitudes, runs, tips, tools) from data/source-watch.json; the evidence vault page embeds its app too	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.12`	deploys from several agents: the Pages workflow queues deploys instead of cancelling the one in flight, and release.sh takes in what other agents released before it bumps and again if its push loses a race; /status/ shows each newsroom site's deploy runs from GitHub's public API with no credential, beside the version each serves, and every page notes when a newer release is live	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.11`	the release check reads the live version correctly: v0.2.9's pattern matched the v in class="ver" and read a blank version, so it reported every release unverified; now tested against the live site for older, equal and newer versions	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.10`	pricing by content type and freshness: every content page metered (only the meter's own pages are not), price = max(1p, round(base x freshness)) with tiers picked in the reader's browser, the formula and rules of engagement on the billing page; second readings: Perplexity's notes published in full and credited, compared with the vault point by point; the newsroom's review of the site published as received, with a triage and fourteen board items; briefing titles and table word-wrapping fixed	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.1`	a Pages deploy workflow that runs the gate on every push to dev, and breadcrumbs up to October 2026, the year and the newsroom	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.2.0`	the code read from php-src, php2shell in context against ten earlier flaws, an impact ledger of offline versus compromised, detection and defence from six WAF vendors and three rule sets, six more briefings, a page per source and per party with its own graph, 86 new sources	yes	its release note	output
2026-10-22	dev@php.newsroom	Release	`v0.1.0`	The site exists: a story front, the two flaws, the timeline, every claim with a status, the numbers that do not add up, the agencies compared, the affected versions and software, the exploitation signals, a playbook, six briefings, every source with its hashes, the graph, the method, the team, the billing model and this history.	yes	its release note	output