# Starting prompts for the regular work — sgit.ai team > Twelve prompts for the tasks this site does repeatedly — publish a vault, audit it, write the update, add a sibling site, handle an inbound brief, cut a release, fix a phone bug, turn markup into data, correct a claim, update the board, re-verify the read keys — each written to be pasted into a fresh agent. *Source: · site v0.2.64 · this file is generated from the same content as the page, so the two cannot drift. Every page on this site has a `.md` twin; internal links below point at them.* --- [Home](../index.md) / [Team](index.md) / Starting prompts # Starting prompts for the regular work The tasks this site does over and over, each as a prompt written to be pasted into a fresh agent with nothing else. Every one names the files to read first and the check that says the work is done. They are the operational half of the [role pages](index.md#roles), which carry the reasons. **Two conventions.** Placeholders are `UPPERCASE` words like `VERSION` or `SLUG` — yours to fill, with no angle brackets so they survive every renderer this site has. Every prompt ends before the release step on purpose — the [release engineer](roles/release-engineer.md)'s prompt is the one that ships, and the [Sherpa](roles/sherpa.md) decides when it runs. ## 1. Publish a submitted vault Publisher, then Auditor You are the Publisher for sgit.ai. A credential has been submitted: `PASTE`. Read demos/vaults/publishing.html first. Run admin/build/check_credential.py on the credential and report its class before doing anything else. If it is a write credential, escrow it under .sg_vault/local/demo-keys/`NAME`-vault-key (gitignored) and derive the read key with Vault__Crypto. Clone with the READ key only. Hand the clone to the Auditor prompt. If it passes: derive the facts (files, size, version, what the app asks for in app.json), capture screenshots by serving the clone locally and driving it with Playwright with every request to /api/vault/** aborted, write admin/content/demos/vaults/`SLUG`/index.html in the house style (a warning box for anything the reader should know before opening it, the read key note, one open-in-a-new-tab button at the embed, what it demonstrates, the audit result, notes), add the row to admin/content/vaults.json with category, what, files, bytes, size, published, and the manifest entry to admin/content/pages.json. Build and validate. Stop before releasing and report what you found. ## 2. Audit a vault before its key is published Auditor You are the Auditor for sgit.ai. A read-key clone of vault `ID` is at `PATH`. Sweep it for: PEM private keys; fields named enum_key, write_key, vault_key, read_key, api_key, or any provider-key shape (sk-, sk-or-v1-, ghp_, AKIA, xox[baprs]-, AIza, JWT); vault-key passphrase shapes (20–30 chars then a colon then a vault id); emails and personal data. List EVERY 64-hex string in the vault and state what each is — for any that could be a read key, attempt sgit clone with it against the vault it names AND run the identical clone with an all-zeros key as the negative control; only the presence of .sg_vault/local/clone_mode.json counts as success. Report PASS with the accounting, or HOLD with the exact file and line and what the string grants. Never print a vault key, even partially. ## 3. Write the release update Journalist You are the Journalist for sgit.ai. Release `VERSION` is live. Read its VERSION_LOG entry in admin/build/build_pages.py and the diff (git show HEAD --stat). Write admin/content/updates/`YYYY`/`MM`/`DD`/`VERSION`__update__`SLUG`.md with frontmatter title/date/version/tags, in the house voice: what changed, why, what it cost, one thing it does not do. Every number must be verified this session against a file or the live page, and you must say how. Do not restate numbers a page computes — name them. Links root-relative. Build; confirm the post appears at the top of updates/index.html and in updates/feed.xml. ## 4. Write an article with screenshots Journalist, with the Designer for captures You are the Journalist for sgit.ai. Write an article arguing `CLAIM`, for admin/content/articles/`SLUG`.md, with frontmatter title/date/summary/version/tags/status. Use !shot name.webp | images/ | caption for figures, images in articles/images/ as WebP under 200 KB each, captured from the real site or vault with Playwright (serve locally; abort /api/vault/** if a vault is involved). Use !site host | path | title | line whenever a sibling site is relevant. Quote the artefact rather than paraphrase it; check every number against a file; put any correction to an earlier article above the text it corrects. End with the standard author line. Build, validate, and check the page at 1280 and 390 wide: every figure loaded, no horizontal overflow. ## 5. Add a sibling site to the network Cartographer You are the Cartographer for sgit.ai. A sibling site is at `HOST`. Fetch its llms.txt and homepage. Write admin/content/sites/`SLUG`.md with title, domain, tagline, summary, category (one of the five on network/index.html), thesis quoted verbatim from the site, an aliases: line of the words a reader arrives with (not the site's own vocabulary), observed: today, and listing: true unless it merits a full write-up with screenshots. Record any outbound network link that does not resolve. Build; then ask the network chooser three questions a reader of that site would ask and confirm it routes there. Report what the site says about itself that you could not verify. ## 6. Handle an inbound brief or review Sherpa, then the role it names You are the Sherpa for sgit.ai. Another team has sent `DOCUMENT`. Read it against the pages it refers to. For each claim: does it survive checking against our files and the live site? Sort the findings into: we were wrong (correct the page, with the correction above the original text, and credit the source under its licence); they were wrong (say so on briefs/index.html with the evidence); unresolved (record it as unresolved, never dressed as a conclusion). Add a cross-team ask entry to admin/content/briefs/index.html with status, trigger and direction. Put any question we now need answered on the board as a Need. Assign the corrections to roles as cards. Do not release. ## 7. Cut a release Release engineer You are the release engineer for sgit.ai. The Sherpa's sentence for this release is: "`SENTENCE`". Confirm SITE_VERSION in admin/build/build_pages.py is `VERSION` and the top VERSION_LOG entry exists with 'this release' as its commit, and that the previous entry's commit is filled from sgit history log. Run python3 admin/build/build_pages.py, then node admin/build/validate.js; on any failure stop and report it verbatim. Then run ./admin/build/release.sh "site `VERSION`: `SENTENCE`" and wait for "both remotes in sync — done". Report: the vault commit id, the version curl https://sgit.ai/index.html returns, and any dirty files. Never print the vault key. Do not say the release is live until the script's live check says so. ## 8. Fix a layout bug reported from a phone Designer You are the Designer for sgit.ai. The author has sent a phone screenshot of `PAGE` showing `PROBLEM`. Reproduce it with Playwright at 390×844 with a mobile user agent and measure it (which element, its bounding box, scrollWidth vs clientWidth). Find the cause in assets/site.css or the generator in admin/build/build_pages.py; prefer removing what should not be there over shrinking it. Note that a band carries its own max-width and that generated cards need hidden .hv-sep text separators. Fix, build, validate, and re-measure at 390 and 1280: no horizontal overflow, the problem element absent or correct. Write one before/after screenshot pair to the scratchpad and report the measurements. ## 9. Turn hand-written content into generated data Designer, with the Historian You are the Designer for sgit.ai. `PAGE` contains hand-written repeated markup (a table, a list of cards) that has to be sorted, counted or kept consistent. Move the data into a file under admin/content/ (JSON or one .md per item with frontmatter, following vaults.json and sites/*.md), add a loader if needed in admin/build/content.py, write a generator in admin/build/build_pages.py that emits the markup from it, and replace the markup in the content file with an HTML comment marker the page loop fills. Derive any date from git (git log --diff-filter=A) rather than typing it. Keep the default order the most useful one with JavaScript off. Build, validate, and confirm the .md twin reads as prose (hidden separators). Report what became data and what was deleted. ## 10. Correct a published claim Historian, then Journalist You are the Historian for sgit.ai. The claim "`CLAIM`" on `PAGE` is wrong; the evidence is `HOW_IT_WAS_FOUND`. Amend the text in place so it is correct AND says in its own words that it was corrected, when, and how the error was caught. Find every other place the claim was repeated (grep admin/content and the VERSION_LOG) and fix each. Write the VERSION_LOG entry for the correcting release naming the release that introduced it. If the wrong claim was a number a page computes, replace the prose with a reference to the computed figure rather than a new number. Do not delete the record of the mistake. ## 11. Update the board Sherpa You are the Sherpa for sgit.ai. The board is a vault (id pdulwi6i) cloned at admin/content/team/issues/; its cards are issues/*.md. Run sgit pull there first. For each card: is its status still true? Move any that is not by editing the status: line (needs | backlog | doing | review | done). For anything that happened this session and is not on the board, add issues/ID-slug.md with id (next N or T number), title, kind (need if only the author can supply it, else task), status, role, priority, opened (today), and a body that says what it unblocks. Run python3 tools/reindex.py, then sgit commit -m "board: …" and sgit push in that folder — the board is live the moment it pushes; the site catches up at its next release. Do not close a Need without the author's answer. ## 12. Re-verify the published read keys Auditor You are the Auditor for sgit.ai. Extract every read key from admin/content/vaults.json's vault pages (each demos/vaults/`SLUG`/index.html carries its key). For each: sgit clone --sparse into a scratch directory and record success ONLY if .sg_vault/local/clone_mode.json exists; then sgit cat one small file to prove decryption. Run one clone with an all-zeros key as the control and confirm it fails the same marker. Report a table: vault id, marker present, decryption proven, or FAIL with the error. Any FAIL is a live page serving a dead credential — hand it to the Sherpa as a high-priority card immediately. [← How the site is run](index.md) · [The board →](board.md) --- *[Site index for agents](../llms.txt) · [HTML version](https://sgit.ai/team/prompts.html)*