{
  "agent": "incident.archivist@web-summit.dinis",
  "state": "active: capturing; primary sources re-read each hour",
  "last_wake": "2026-11-11T11:30:00Z",
  "session_key": "record sha256:1767bd4a70295162 (encryption sha256:d3f6afe074c9293c); public half in data/keys.json",
  "vaults": [
    {
      "id": "f86qsbla",
      "kind": "display",
      "mode": "normal",
      "read_key": "published in data/vaults.json",
      "vault_key": "write key held only in this session (never sent in the clear anywhere); the conductor is taking the handover to Dinis"
    },
    {
      "id": "worixdil",
      "kind": "capture",
      "mode": "packed (sgit create --packs)",
      "read_key": "not published",
      "vault_key": "write key held only in this session (never sent in the clear anywhere); the conductor is taking the handover to Dinis"
    }
  ],
  "done": [
    "tools/capture.mjs: one address at a time, a few seconds apart, as 'Mozilla/5.0 (compatible; page-capture/1.0)', robots.txt read and obeyed, never logged in; keeps (outside git) the HTML as served, the document after scripts, the visible text, a full-page screenshot, a second screenshot with consent notices hidden (nothing clicked), status, headers, title, time, sha256 of each",
    "tools/capture-records.mjs: captures -> the two vaults and evidence/<source>/<yyyy>/<mm>/<dd>/<hhmm>-<slug>.json + its page; evidence/index.json, index.md, rows.json (timeline row id -> evidence id); changed / unchanged against the capture before, judged on the visible text",
    "app/evidence/: the page reads the screenshot from the display vault with the published read key (sgit.ai's house reader, path-directed), decrypts it in the browser and checks its sha256 against the record",
    "first captures (02:16 to 02:20 UTC): Web Summit's update and blog listing, IPMA's warnings timeline and communiqués, ANEPC's notice 21, the government's alert declaration",
    "02:26: the section is named Wayback (evidence/README.md; folder and ids unchanged); tempo.pt/Meteored, The Portugal News and Zoom Earth are never requested (evidence/sources.json, forbidden); a what-changed summary between two captures of an address",
    "02:35: a mistake of mine, corrected: the first list of addresses from the timeline and decisions was cut short by a faulty pattern (any address stopped at the first 2, 7 or x), so 23 captures were of addresses nobody cites (site front pages, 404s). Their records, pages and vault copies are removed (10 had been released between 5afb301 and f8492de; they remain in git history); the list is now built from signals.json and data/decisions/*.json and the missing addresses are being read again",
    "02:45: round over the timeline and decisions done: 79 addresses recorded (evidence/index.json), 56 timeline rows mapped (evidence/rows.json). Not captured: social platforms (5 addresses, by rule); 403 to our plain client: lisboa.pt, informacao.lisboa.pt, expresso.pt, rede-expressos.pt (recorded as answered 403, not retried in disguise); 502 from prociv.gov.pt/pt/noticias/ (twice); robots.txt unreadable: mai.gov.pt, lusoponte.pt; robots.txt disallows all: dgeste.mec.pt. Vault numbers: display 84 files, 21 MB; captures (packed) 420 files, 123 MB; each push took seconds",
    "02:58: weatherwatch's ten studies captured with a fixed 1280 x 1600 frame (frame.jpg; six shown, four kept privately); each record now carries the site's terms-page address where weatherwatch has read it; Wayback for data: evidence/data.json indexes feeds that publish reads.json",
    "03:24 hourly round: Web Summit's update and blog, IPMA's warnings timeline and communiqués, ANEPC's avisos listing and the government's declaration all UNCHANGED since 02:16 to 02:20; ANEPC's notice 21 answered 502 (recorded as a server error, not compared). Changed/unchanged now ignores a clock a source prints on every visit (IPMA: evidence/sources.json 'volatile') and server errors. 225 addresses in all; research press pages still being read",
    "04:24 hourly round: no primary source changed. Two captures had a different text hash only because the page rendered differently on that load (ANEPC's notice without its expanded menu; IPMA's communiqués with three news dates in raw form): read, judged 'same content' and recorded in evidence/reviewed.json; the tool now waits for the visible text to settle. ANEPC's avisos listing answered 502 this hour. 465 addresses, 480 captures. evidence/index.json is now one line per address (it had passed 256 KB); each address's captures and hashes are in evidence/<source>/index.json",
    "04:40: capture pages are made at build time by tools/capture-pages.mjs --out (205 ms for 515 captures; same addresses, identical HTML); the tracked per-capture .md files are removed; 500 addresses",
    "04:50: the research round is done (the container restarted mid-round; vaults, keys and captures survived, the last 16 press addresses were read again): 542 addresses, 557 captures; latest answer per address: 456 x 200, 31 x 403 (press and others refusing our plain client), 2 x 404, 4 x 5xx, 49 not captured (robots.txt, unreadable robots, social platforms); 111 captures shown, the rest kept privately. Vaults: display 267 files, 66 MB; captures (packed) 2,754 files, 811 MB; pushes still take under a minute",
    "05:23 hourly round: all seven primary pages answered 200 and are UNCHANGED since the first captures (02:16 to 02:20); unchanged re-reads now keep only hashes, summary and text in the private vault. 542 addresses, 564 captures",
    "05:28: Web Summit hold (the conductor's interim hold until Dinis decides; its Terms 48.2 and 52.1): websummit.com is never requested by the tool; its 9 addresses' 15 captures are not shown (no screenshot, no excerpt; address, title, time and hashes stay; records and ids unchanged); removed from the display vault's current state, full copies remain in the private capture vault. Note: the display vault's history still holds those screenshots under the published read key; removing them for good needs a new display vault or a rekey, which needs the write-key decision",
    "06:24 hourly round: IPMA's warnings timeline for Lisbon CHANGED between 05:23 and 06:25 (evidence ipma/2026/11/11/0523-pt-otempo-prev-sam -> ipma/2026/11/11/0625-pt-otempo-prev-sam): the yellow sea-state warning for Lisbon (10 Nov 21:24 to 11 Nov 06:00) is no longer listed, and in the page's list of regions Madeira's north coast, mountain regions and south coast read Laranja where they read Vermelho. IPMA's communiqués, ANEPC's avisos listing and the government's declaration unchanged; ANEPC's notice 21 answered 502. Reported to the conductor",
    "07:27 hourly round: nothing changed in substance. IPMA's warnings timeline differs from 06:25 only in its time axis labels (read and marked same content); communiqués, ANEPC's listing and the government's declaration unchanged; ANEPC's notice 21 answered 502 for the second hour running (the 05:24 capture is the one linked)",
    "08:24 hourly round: IPMA's warnings timeline for Lisbon CHANGED between 07:27 and 08:24 (ipma/2026/11/11/0727-pt-otempo-prev-sam -> ipma/2026/11/11/0824-pt-otempo-prev-sam): last update now reads 11 November 07:16; the Lisbon wind line reads orange 09:00 to 21:00 (gusts to 120 km/h) where it read red 12:00 to 21:00; the orange rain line starts 07:17; Évora reads orange in the list of regions. Reported to the conductor at once. Communiqués and the government's declaration unchanged; ANEPC's listing same content; ANEPC's notice 21 answered 502 for the third hour. The timeline's moving hour-axis labels are now ignored when comparing",
    "09:24 hourly round: IPMA's warnings timeline for Lisbon changed in one line since 08:24 (ipma/2026/11/11/0824-pt-otempo-prev-sam -> ipma/2026/11/11/0924-pt-otempo-prev-sam): the orange rain line (07:17 to 09:00) is no longer listed (its own end time). Now listed for Lisbon: rain red 09:00 to 18:00; wind orange 09:00 to 21:00; sea state orange 12:00 to 21:00 and yellow 21:00 to 03:00; last update 11 November 07:16; region label 'Lisboa Vermelho'. ANEPC's notice 21 answered 200 again, same content as before; communiqués, ANEPC's listing and the government's declaration unchanged. The comparison no longer calls a page changed when it returns to a rendering already seen since its last real change",
    "10:23 hourly round: all five primaries answered 200 and are unchanged since 09:24. IPMA's timeline for Lisbon still lists rain red 09:00 to 18:00, wind orange 09:00 to 21:00, sea state orange 12:00 to 21:00 and yellow 21:00 to 03:00; last update 11 November 07:16; region label 'Lisboa Vermelho'",
    "11:27 hourly round: all five primaries answered 200 and are unchanged since 09:24; IPMA's timeline for Lisbon lists the same four warnings, last update 11 November 07:16, region label 'Lisboa Vermelho'"
  ],
  "next": [
    "primaries re-read hourly at :23, changed / unchanged",
    "186 commercial or unclassified research addresses stay held until their terms are read",
    "new addresses as rows and research add them (evidence/rows.json is rebuilt each round)",
    "IPMA's feeds in evidence/data.json when incident.ipma@ publishes reads.json"
  ],
  "asks": [
    "Dinis: the two vault write keys (display f86qsbla, captures worixdil) are still held only in this session. Three attempts to hand them over were refused by this session's permission check (reading the key back; sealing it with tools/lane-handover.mjs, twice), the last after his 'Yes please continue' at about 09:35. The conductor's lane for keys is open; what is missing is a permission rule in this session for that one command, or Dinis running it himself. Nothing was ever sent or sealed."
  ]
}
