11 (brief) — Publishing pipelines: the scenario
Summary
The brief that scoped the pipelines tabletop, written on the other side of this collaboration: it was drafted in the nhi.sgit.ai site session (the one that maintains these pages), published on this site's briefs/ channel, and adopted into the pack verbatim plus an intake note. §0 states the two ignore systems side by side and pre-registers two findings established by code inspection before any run: the .sg_vault/backups/ key-leak hazard (backup zips can carry the vault key itself), and the missing attach command. Ten steps with a cast of eight — publisher, two CI runners, a fork contributor, two hosts, a reader, a rollback operator — each trap to be walked into deliberately; §5 lists the edits the pack files owed independent of the run, which landed as r10 and r12. The intake note records one deviation: the maintainer removed the publish folder's self-ignore entirely rather than keeping it as a gate.
Key concepts
- Pre-registered findings — the keyed-backup hazard and the attach gap were established by inspection before the run — the tabletop's job is to confirm them by execution, which it did
- Traps walked into deliberately — the forgotten --visibility, the fork PR without secrets, the keyed backup — each must end as a fix or a decided behaviour, never a surprise left for production
- Cross-session authorship — written on nhi.sgit.ai, executed in the CLI repo, captured back here — the site working as the public comms channel it documents
Key ideas
- The brief carries its own fallback clause: simulated hosting is allowed but must be marked, and the run loses most of its point — the maintainer chose simulation, and the NOT MEASURABLE rows now define the real-GitHub run's scope.
- Definition of done includes: no lab-script recoveries left standing — every command shipped or filed as a named proposal.
- §5's owed edits stand on code inspection alone, so they did not wait for the run.