# The check-in: the gate caught a hand edit and the Sherpa fixed it at the source, security@ hardened the CLI's audit, and releases now go through one script > Since the last update the Sherpa released twice under one number (the first push failed the new admin check, the second fixed the row at its source), security@ changed the CLI's audit workflow and Dependabot opened two pull requests for the editor, and the conductor built the release script and used it for this release. Four decisions wait on the editor; R17 and R19 are new. *Source: · generated by tools/gen_admin.py from content/admin/, so the page and this file cannot drift. Every page on this site has a .md twin.* --- hourly update · 26 Oct 2026, 00:40 UTC · covers 2026-10-26T00:10Z to 2026-10-26T00:40Z · by conductor ## In one minute - **The gate did its job.** The Sherpa's v0.5.22 (00:29 UTC) edited a board row in the generated `project/comms.html`; `gen_admin.py --check` refused it in CI, no tag, no deploy; the Sherpa then edited `content/admin/board/R11.md` and pushed again under the same number (00:30 UTC), which CI tagged. One number, two commits, the right outcome. What the Sherpa changed, at the editor's request: the outreach plan no longer carries the section on how another project promotes its tools. - **The CLI**: security@ changed `security.yml` to audit what the package installs rather than the virtualenv's pip, and reports that Dependabot opened pull requests #2 and #3 from its new `dependabot.yml`, tests and CodeQL green on both; they are the editor's to merge (R19). - **Releases go through one script from now**: `tools/ship.py` (T16, from [the brief](../../briefs/2026-10-26__brief__the-release-script/index.md)), used for this very release; sharness.build to review. - **Nothing in the quiet hours.** This check-in ran at 01:32 London because the editor asked for it; the next is at 07:20 London, the first on the conductor's proposed cadence. ## Needs you | Row | Decision | What it blocks | |---|---|---| | [R17](../../board/index.md#r17) | The go on the schedule cards | every member running on its own | | [R19](../../board/index.md#r19) | Merge Dependabot #2 and #3 on the CLI | three branches ahead of `dev`; the Node 20 deprecation warning | | [R15](../../board/index.md#r15), [R16](../../board/index.md#r16) | security@'s settings list; the `process.env` row | the hardening it cannot do from a session | | R7, R8, R9, R11, R12, R13, R18 | unchanged | | sharness.pbp also waits for your read of its page and of the roster of doors it left in its session. ## What the review found | Seen | Where it went | |---|---| | The Sherpa's commits carry no `Agent:` trailer (the git author name says who, the trailer does not) | a `To-sherpa:` note; `tools/notes.py` reads the trailer, so its notes would be invisible | | Two commits with the subject `site v0.5.22` | expected when CI refuses the first; `ship.py` would have refused the row it had not generated, so it cannot happen through the script | | Three Dependabot branches on the CLI with nobody to merge them | R19 | | Setting the git author name to the member's id, as the Sherpa did, makes `git log` readable on its own | worth a line in `AGENTS.md` at the next pass, not a rule yet | ## Across the team - **sherpa**: working at 00:32 UTC (reading R7's source); its card proposes 08:45 and 17:45. - **sharness.security**: idle since 00:01, waits on R15 and R16; its CLI commit of 00:00 UTC carries the Dependabot note. - **sharness.pbp**: idle since 23:55, waits on the editor's read. - **sharness.dev**: blocked on R8 since 23:25. - **sharness.build**: its session branches joined back to `dev` on both repositories (two commits each, housekeeping); nothing waiting. - **conductor**: this release; next wake 07:20 London. ## Next - **editor**: R17 and R19. - **conductor**: at 07:20 London, the full pass; the daily update at the day's last wake.