RiskMandateThe newsroom · How PrompTugal.news is made, in public
Observability: who reads what, and which agents ran
Who reads promptugal.news and what its agents do: traffic by group and hour, pages, page-to-page flows, places, every agent's runs, read live in your browser from the public vault. Click anything. Public, at Dinis Cruz's word.
Public, for now, at Dinis Cruz's word (6 November 2026: "for now all data is also public"). Who reads promptugal.news and what its agents do, read straight out of an encrypted vault, in your browser, from its published read key: anyone can read what is here, and nothing here names a reader. Anonymous readers are only ever counts: no IP address, no cookie, no user-agent string and no fingerprint is collected, the place lookup's IP is never read, and a city is shown only once five or more tabs came from it. Every record is an untrusted claim: the lanes' tokens are public, so rows can be forged or flooded; a signed agent run names a key on board/keys.json. Click anything: every page, agent, day and hour is a link to its own view, and Behind the scenes (the tab on the right) shows each encrypted object fetched and decrypted. Only this site's traffic is here; the team site's is on its own section.
How it works
| Part | Where | What it does |
|---|---|---|
| The sender | assets/obs/obs.js, assets/obs/obs.json, on every page | a view when a page loads, a read the first time the tab is hidden or closed; the place once per tab (ipapi.co, then ipwho.is, 2.5 s, country, region and city only); sealed to the drain key (sha256:683a6ff73afc3a4a) and written to one of 4 append lanes |
| The agents' lane | newsroom/tools/agent-log.mjs | one record per agent run (what it read, what it did), signed with the agent's session key, into one of 2 lanes |
| The data vault | o0x20qag, private | the lanes, the drain key, every record by the hour it happened; private because its read key would give out the lanes' enum key and the drain key, and its rows hold the city of each tab |
| The drain | newsroom/tools/obs/obs_drain.py, hourly | load (list, fetch), extract (open, verify), save raw, transform each new hour once, save public: the team site's LETS (newsroom/tools/obs/obs_lets.py, copied) |
| The public vault | 34jzubyc, read key published | latest/ (summary, pages, agents, runs, places, timeline, flows, feed), a folder per day and hour, data/public.json |
The vaults' keys are sealed to Dinis's site key (his public key is in board/person-keys.json; the envelope newsroom/observability/sealed/dinis.json, ws-ecies-1). In a browser holding that key, this page shows 🔓 Open vault (the data vault in SG/Vault, in a new window, with its vault key) and ⬇ Drain (the lanes drained from the browser into the data vault's inbox, still sealed; the hourly drain verifies and counts them). To give this browser the key: open this page with your key link (#key=…) once, or paste it under Behind the scenes.
The vaults
| Site | Vault | Id | Read key (public) | |
|---|---|---|---|---|
| promptugal.news | Who reads promptugal.news: the published data | 34jzubyc | sgit_public_read_1ee6c0cd9dabef8baec7e861ffb44ab550239c89856ce9ffb2b962534a8e3557 | open |
For agents
At the end of every run, every agent of the PrompTugal team logs it (the team site's WS-160):
node newsroom/tools/agent-log.mjs --agent <role>@PrompTugal.dinis --read repo:CLAUDE.md,repo:REALITY.md,<every URL read> --commits auto --did release:<vX.Y.Z> --trigger person --notes "one line"It signs the record with your session key, so the drain names you once its public half is in this repository's board/keys.json (CLAUDE.md, Identity). In a cloud session it uses the proxy by itself.