riskmandate.ai/admin·the site·the library·this page as markdownnoindex · not in the sitemap
Written by the agents that maintain this site and read by a person before it merges. Every count on this page is read off a file in the repository; where a page and a file disagree, the file is right.

admin / work / briefs/T09-stop-deploying-the-vault.md

T09 — Stop deploying the vault: inputs in the repository, the product in the vault

A task brief, sized for one agent. The source is .claude/briefs/T09-stop-deploying-the-vault.md; this page is that file, rendered.

From: docs/briefs/review__vault-pages-vs-the-vault.md §4. Size: half a day.
Touches: scripts/site/build-abp-vault.mjs, scripts/site/build-abp-pages.mjs, scripts/site/abp/abp-vaults.js, site/vaults/<slug>/ (derived files removed from site/), .gitignore, tests/site/test_pages.mjs, .github/workflows/ci-pipeline.yml.

The task

The application vaults' derived files, zip, PDF, loader, history and .vault/ link are committed under site/vaults/<slug>/ and deployed, so the site carries a second copy of the product and the pages fall back to it. Move the build output out of site/ (a build directory, git-ignored, or a root-level vaults/ that is not deployed), keep the four input files where they are, keep --check deriving and comparing, and make the pages read the vault or say they cannot.

Steps

  1. build-abp-vault.mjs writes to OUT = <root>/build/vaults/<slug>/ (inputs read from

    site/vaults/<slug>/); --check compares against OUT. CI runs the build before the check.

  2. build-abp-pages.mjs reads derived data (delta counts, tiers) from OUT.
  3. abp-vaults.js load() drops the snapshot fallback: source is live or the page shows

    .ab-fail with the key and the open-in-tab link. rm-abp-files links each file into the vault browser if the host supports a path in the fragment; otherwise to nothing, listing only.

  4. Remove site/vaults/<slug>/ derived files from git and add the ignore; keep the inputs.

    Decide what happens to site/vaults/_app/ (the page needs the renderer version, not bytes).

  5. Tests: the write-credential test still scans site/; the vault derivation check moves to

    build/. The test that pages.json accounts for every page is unaffected.

  6. Tell the store agent where the level-1 zip is built from now.

Constraints

  • The push to sgit still needs the write keys the lead holds; the build directory is what gets

    pushed. Say so in the work file.

  • Nothing about the derivation, the delta semantics or the no-score rule changes.
  • The page must be honest when the vault is unreachable: a failure with the key, never a

    stale copy presented as live.

Done means

  • git ls-files site/vaults/ shows inputs only; npm run check green; a vault page renders

    from the vault, and renders a visible failure with the endpoint blocked.

An operations surface for the people and agents building this site, public because every page here is. It is not a selling page and nothing on it is for sale. The site · the library · every release · the repository · the script that wrote this page.