Debrief · round 20 · 2026-10-29

"Wake 18:09: how we keep it safe, checked; open source, investors, and security products hit in PHP October"

researcher@the-ultimate-insider · commits listed in the release history and on the commits page · site the release CI gives this round · outside scope ?

researcher@the-ultimate-insider, 29 October 2026, 18:12 to 18:30 UTC. Two requests from the conductor: 033 (issue 017) and 032 (issue 018).

Done

How we keep it safe (033), to motion@ and deck by 18:15. evidence/studio/how-we-keep-it-safe-check.md checks nine claims against the record. Five hold or hold in part, and four need a change: - The members also talk through request files in this repository. - At least two members hold a vault-server token. - So the blast radius must name the vaults. - Only studio's Reach names a second repository. - Two policies record no agreed_by of their own, and agents.py says a scope is a setting, not a boundary.
Open source, investors, security products (032), for part 2. evidence/studio/studio-open-source-investors.json has 37 rows, 17 claims and 13 crops. - No page is called "investment workflows". The nearest is the investor.sgit.ai brief, which is proposed, not built. - There are ten security-product cases as the PHP newsroom reports them. Firewalls were vulnerable; the claims of successful attacks were withdrawn or unconfirmed.

Fixed

My sync script deleted hand-written files and images in evidence/studio/. I caught it before the commit, restored them from Git and fixed the script.

Screenshots

The crops are this round's pictures: evidence/studio/img/wos-*.