This site is made by one person and two agents. The agents are described the way the site describes any agent: an Agent Behaviour Policy each, in the same grammar as the catalogue, with the grant measured on the thing itself, the mandate in the lead’s words, the gap derived, and a barrier on every row. Around them, three tiers of information and the workflow that moves a story from private to public.
The lead's mandate, represented: the one agent that reads the private vault and writes the public site.
Writes storyboards, draws them with image models, proposes cast, and delivers into its own folders of the private vault.
Everything the team touches is in one of three tiers, and the rule for each is one sentence. The controls under each are named by what they are under the enforcer test: a boundary is enforced by something the agent cannot reach; a setting can be flipped by the account; prose is a rule somebody wrote.
Everything under site/ and docs/ and .claude/ in this repository, because the site is served from site/ and the console renders the rest; the repository itself, open source; the board's ids, titles, owners and states.
Read by anyone. Written by the publisher, through the merge workflow; the lead.
The rule. Nothing goes here that is not meant for everyone. A story reaches here only through the publication workflow below.
What stands in the wayThe stories vault: every message between the parties, every draft, every picture not yet accepted, every decision not yet taken, the studio's working files and its decision record. The published mirror is the one public thing in it, and it is a copy.
Read by the three parties, and whoever the lead gives the read key to. Written by each party in its own folder; anyone in a mailroom, for its recipient.
The rule. It moves to public only when the lead has accepted it by message and the publisher has read it against the rules. What is said between agents stays in the vault; the board publishes that a request exists, never what it says.
What stands in the wayThe vault key (it derives the write key), the vault host's access token, the platform's tokens, any credential. Also secret-bearing: a chat or a conversation a secret was pasted into, and the transcript the harness keeps of it.
Read by the lead; an agent for the length of one session. Written by nobody, in a file.
The rule. Never in a file in either tree, never on a page, never in a message. Handed over in a session or set as an environment secret. A secret found in a file is an incident: rotate it first, then find how it got there.
What stands in the wayThe studio writes into its own folders of the private vault. The publisher pulls the vault, writes the repository, and a push to dev is the public site once the check has passed. The lead hands a key in a session and never in a file. The only thing that goes from the vault to the site without the lead’s yes is the board, and the board carries no message.
The workflow that makes a story public. The lead accepts; the publisher checks and ships; the studio never publishes. Every step leaves a file somebody else can find.
a picture or a story file in its own folders, with its record; a message to the publisher naming the path
fictionalised and said so; nobody's product or face; nothing scored; the site's words; every line belongs to the cast; the truth under it is one the site states
one message to the lead: what it is, where it came from, what goes live if the answer is yes
yes, no, or what to change, by message or in a session written down as the lead's
the story file and the picture into site/stories/; build; npm run check; a patch release with a note; merge into dev with the check green
the check job, then the deploy job
site/stories/ copied into published/ in the vault; the task closed; the board regenerated; one check-in commit
The site’s own line applies to the site: a prohibition carries its barrier. Most of what holds this team to its rules is a setting or a sentence, and the three things that would make boundaries of them are listed as not in place, without a verdict.
scripts/stories/mail.mjsEmail-FS-lite in one file: send, deliver, done, issue, board, status. No network.ours, in placescripts/site/build-team.mjsthis section from team.json and one file per agent; derives each delta the way the vaults do; refuses a row without a barrier, an evidence tier, an undo class and a note, a mandate that wants and refuses the same row, and any credential-shaped stringours, in placenpm run check40 tests and every generator's check, before every merge and in CI before every deployours, in placesgitthe encrypted vault: clone, pull, commit, push, historysgraph.ai's, in placethe platform's routinesa scheduled session for the publisher's check-inthe platform's, not yet useda write token scoped to one vaultwould bound three rows for both agents at onceasked of the sgit team, not in placea branch rule on dev requiring the checkwould turn the CI gate from a setting into a boundarythe code host's, not in placea secret scan before a commitwould refuse a key-shaped string before it is committed rather than afternot in placeThe checks each agent runs, and what it never does, are on its page. The tests that hold the public tier are the site’s own: npm run check before every merge, the same in CI before every deploy.
A new session of either agent starts from nothing and reads three things in order: its role, the skills it needs, and its ABP. Then it runs one check-in. The prompt for each is on its page, with a copy button; the publisher’s is also .claude/agents/publisher.md in the repository, the form a Claude Code session loads by name.
Sixteen template policies for the shapes people run are in the library; this page is the same grammar turned on the two agents that make the site. If yours would look different, that is the point of writing it down.