From riskmandate.ai, the page as fetched on 2026-09-25 · open the live page ↗Everything on this sheet is the source site's own text; the newsroom's chrome is outside it.

T09 — Stop deploying the vault: inputs in the repository, the product in the vault

Rendered from .claude/briefs/T09-stop-deploying-the-vault.md in the repository. The text below is that file. Source: https://riskmandate.ai/admin/work/T09/↗ · noindex · written by scripts/site/build-admin.mjs

From: docs/briefs/review__vault-pages-vs-the-vault.md §4. Size: half a day. Touches: scripts/site/build-abp-vault.mjs, scripts/site/build-abp-pages.mjs, scripts/site/abp/abp-vaults.js, site/vaults/<slug>/ (derived files removed from site/), .gitignore, tests/site/test_pages.mjs, .github/workflows/ci-pipeline.yml.

The task

The application vaults' derived files, zip, PDF, loader, history and .vault/ link are committed under site/vaults/<slug>/ and deployed, so the site carries a second copy of the product and the pages fall back to it. Move the build output out of site/ (a build directory, git-ignored, or a root-level vaults/ that is not deployed), keep the four input files where they are, keep --check deriving and comparing, and make the pages read the vault or say they cannot.

Steps

build-abp-vault.mjs writes to OUT = <root>/build/vaults/<slug>/ (inputs read from site/vaults/<slug>/); --check compares against OUT. CI runs the build before the check.
build-abp-pages.mjs reads derived data (delta counts, tiers) from OUT.
abp-vaults.js load() drops the snapshot fallback: source is live or the page shows .ab-fail with the key and the open-in-tab link. rm-abp-files links each file into the vault browser if the host supports a path in the fragment; otherwise to nothing, listing only.
Remove site/vaults/<slug>/ derived files from git and add the ignore; keep the inputs. Decide what happens to site/vaults/_app/ (the page needs the renderer version, not bytes).
Tests: the write-credential test still scans site/; the vault derivation check moves to build/. The test that pages.json accounts for every page is unaffected.
Tell the store agent where the level-1 zip is built from now.

Constraints

The push to sgit still needs the write keys the lead holds; the build directory is what gets pushed. Say so in the work file.
Nothing about the derivation, the delta semantics or the no-score rule changes.
The page must be honest when the vault is unreachable: a failure with the key, never a stale copy presented as live.

Done means

git ls-files site/vaults/ shows inputs only; npm run check green; a vault page renders from the vault, and renders a visible failure with the endpoint blocked.