@anthusai/papyrus 1.0.0-next.60 → 1.0.0-next.62

package/app/api/cyclotron/priming-proof/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from "next/server";
+import { approvedPrimingProofReport } from "../../../../lib/priming-proof-report";
+import { SITE_BRAND } from "../../../../lib/site-brand";
+
+export function GET() {
+  const report = approvedPrimingProofReport(SITE_BRAND.id);
+  if (report === null) {
+    return NextResponse.json({ error: "No approved priming proof report for this publication yet." }, { status: 404 });
+  }
+  return NextResponse.json(report);
+}

package/app/cyclotron/page.tsx

@@ -0,0 +1,13 @@
+import type { Metadata } from "next";
+import { PrimingProofPage } from "../../components/priming-proof-page";
+import { approvedPrimingProofReport } from "../../lib/priming-proof-report";
+import { SITE_BRAND } from "../../lib/site-brand";
+
+export const metadata: Metadata = {
+  title: `Cyclotron proof | ${SITE_BRAND.articleTitleSuffix}`,
+  description: "How often the relevance classifier agrees with editors on a fixed held-out set, before and after editor labels.",
+};
+
+export default function CyclotronProof() {
+  return <PrimingProofPage report={approvedPrimingProofReport(SITE_BRAND.id)} />;
+}

package/app/tailwind.css

@@ -1,4 +1,5 @@
 @import "tailwindcss";
+@source "../../../cyclotron/trace-ui/src/**/*.{ts,tsx}";
 @source "../components/**/*.{ts,tsx}";
 @source "../app/**/*.{ts,tsx}";
 @source "../lib/**/*.{ts,tsx}";

package/components/newsroom-curation-provider.tsx

@@ -0,0 +1,17 @@
+'use client';
+
+import {createContext,useContext,useMemo,useRef,type ReactNode} from 'react';
+import {createCurationSession,requestCuration,type CurationBootstrap,type CurationRequest,type CurationSession} from '../lib/curation-client';
+import type {PublicationScope} from '../lib/publication-cyclotron';
+
+const Context=createContext<CurationSession|null>(null);
+
+/** Host opt-in. Absence preserves the released CMS and performs no new reads. */
+export function NewsroomCurationProvider({bootstrap,request=requestCuration,children}:{bootstrap:CurationBootstrap|null;request?:CurationRequest;children:ReactNode}){
+  const selected=useRef<PublicationScope|null>(bootstrap?.scope??null);
+  selected.current=bootstrap?.scope??null;
+  const session=useMemo(()=>bootstrap?createCurationSession(bootstrap,request,()=>selected.current):null,[bootstrap,request]);
+  return <Context.Provider value={session}>{children}</Context.Provider>;
+}
+
+export function useNewsroomCuration(){return useContext(Context);}

package/components/newsroom-references-view.tsx

@@ -1,5 +1,9 @@
 "use client";
 
+import type { PrimingPanelProps } from "cyclotron/components/priming-panel";
+import { ReferencePriming } from "./reference-priming";
+import { ReferenceCurationControls } from "./reference-curation-controls";
+
 import {
   ArchiveIcon,
   ChevronLeftIcon,
@@ -54,6 +58,8 @@ import {
 } from "./news-desk-taxonomy-client";
 
 type NewsroomReferencesViewProps = {
+  /** Present only when the host has configured optional example priming. */
+  priming?: PrimingPanelProps;
   /** The relevance cyclotron's status snapshot, shown above the list. */
   cyclotronStatus?: CyclotronStatus | null;
   /** Present for editors who may ask for a manual review rate. */
@@ -391,6 +397,7 @@ function ReferenceDetailPanel({
 }
 
 export function NewsroomReferencesView({
+  priming,
   cyclotronStatus,
   decisions,
   onRequestReviewRate,
@@ -507,6 +514,8 @@ export function NewsroomReferencesView({
             Review source intake before it becomes accepted evidence.
           </p>
         </div>
+        <ReferenceCurationControls disabled={disabled} />
+        {priming && !disabled ? <ReferencePriming {...priming} /> : null}
         {cyclotronStatus ? (
           <div className="shrink-0">
             <ReferenceCyclotronStatus onRequestRate={disabled ? undefined : onRequestReviewRate} status={cyclotronStatus} />

package/components/priming-proof-page.tsx

@@ -0,0 +1,92 @@
+import {
+  formatProofPercentage,
+  primingProofHeadline,
+  type PrimingProofReport,
+} from "../lib/priming-proof-report";
+
+function ProofMethod({ heldOutSize }: { heldOutSize: number | null }) {
+  return (
+    <section aria-labelledby="priming-proof-method" className="space-y-2 text-sm leading-relaxed">
+      <h2 id="priming-proof-method" className="text-base font-semibold uppercase tracking-wide">How the number is made</h2>
+      <p>
+        Editors already decided which candidate sources belong in this publication. A fixed, balanced sample of those
+        decisions{heldOutSize === null ? "" : ` (${heldOutSize} sources)`} is frozen as the held-out set and never used
+        for teaching. A classifier that always gives the same answer agrees on half of it.
+      </p>
+      <p>
+        Editors teach the classifier by pasting a source URL, reviewing what Papyrus extracted, and choosing publish or
+        reject. Each point below starts a fresh classifier that sees only the first N of those labels, then decides
+        every held-out source once. Nothing else changes between points: the same decision model, the publication&apos;s
+        mission and policies as the only rubric, and no automatic rubric rewriting.
+      </p>
+    </section>
+  );
+}
+
+export function PrimingProofPage({ report }: { report: PrimingProofReport | null }) {
+  if (report === null) {
+    return (
+      <main className="mx-auto max-w-3xl space-y-6 px-4 py-10" data-priming-proof="pending">
+        <header className="space-y-2 border-b pb-4">
+          <h1 className="text-3xl font-bold">Does teaching the classifier work?</h1>
+          <p className="text-muted-foreground">No approved proof run has been published for this publication yet.</p>
+        </header>
+        <ProofMethod heldOutSize={null} />
+      </main>
+    );
+  }
+  const { baseline, latest, agreementChangeInPoints } = primingProofHeadline(report);
+  const [positiveLabel, negativeLabel] = [report.positiveLabel, report.labels.find((label) => label !== report.positiveLabel)];
+  return (
+    <main className="mx-auto max-w-3xl space-y-8 px-4 py-10" data-priming-proof="published">
+      <header className="space-y-3 border-b pb-4">
+        <h1 className="text-3xl font-bold">Does teaching the classifier work?</h1>
+        <p className="text-lg" data-priming-proof-headline>
+          Agreement with editors went from <strong>{formatProofPercentage(baseline.agreement)}</strong> with no labels to{" "}
+          <strong>{formatProofPercentage(latest.agreement)}</strong> after {latest.labels} labels
+          {agreementChangeInPoints === null ? "" : ` (${agreementChangeInPoints >= 0 ? "+" : ""}${agreementChangeInPoints} points)`}.
+        </p>
+        <p className="text-sm text-muted-foreground">
+          {report.publication} · question: “{report.question}” · held-out set of {report.heldOut.size} sources frozen{" "}
+          {report.heldOut.frozenAt.slice(0, 10)} · run {report.ranAt.slice(0, 10)}
+          {report.decisionModel ? ` · decision model ${report.decisionModel}` : ""}
+        </p>
+      </header>
+      <section aria-labelledby="priming-proof-points" className="space-y-2">
+        <h2 id="priming-proof-points" className="text-base font-semibold uppercase tracking-wide">Before and after</h2>
+        <div className="overflow-x-auto">
+          <table className="w-full text-left text-sm tabular-nums">
+            <thead>
+              <tr className="border-b">
+                <th scope="col" className="py-2 pr-4">Editor labels</th>
+                <th scope="col" className="py-2 pr-4">Agreement</th>
+                <th scope="col" className="py-2 pr-4">Precision ({positiveLabel})</th>
+                <th scope="col" className="py-2 pr-4">Recall ({positiveLabel})</th>
+                <th scope="col" className="py-2">Labels used</th>
+              </tr>
+            </thead>
+            <tbody>
+              {report.points.map((point) => (
+                <tr key={point.labels} className="border-b" data-priming-proof-point={point.labels}>
+                  <td className="py-2 pr-4">{point.labels}</td>
+                  <td className="py-2 pr-4">{formatProofPercentage(point.agreement)}</td>
+                  <td className="py-2 pr-4">{formatProofPercentage(point.precision)}</td>
+                  <td className="py-2 pr-4">{formatProofPercentage(point.recall)}</td>
+                  <td className="py-2">
+                    {point.labelsByClass[positiveLabel] ?? 0} {positiveLabel}
+                    {negativeLabel ? `, ${point.labelsByClass[negativeLabel] ?? 0} ${negativeLabel}` : ""}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      </section>
+      <ProofMethod heldOutSize={report.heldOut.size} />
+      <p className="break-all text-xs text-muted-foreground">
+        Held-out fingerprint {report.heldOut.fingerprint}
+        {report.priming.fingerprint ? ` · labels fingerprint ${report.priming.fingerprint}` : ""}
+      </p>
+    </main>
+  );
+}

package/components/publication-cyclotron-panel.tsx

@@ -0,0 +1,57 @@
+'use client';
+
+import {useRef,useState} from 'react';
+import {ReviewControl,type ReviewControlReview} from 'cyclotron/components/review-control';
+import {CyclotronStatusView} from 'cyclotron/components/cyclotron-status';
+import {assertPublicationScope,publicationScopeKey,publicationReviewPayload,type PublicationStatus,type PublicationHistory,type PublicationHistoryRow,type PublicationReviewPayload} from '../lib/publication-cyclotron';
+
+function requestId(){
+ const bytes=crypto.getRandomValues(new Uint8Array(16));
+ return Array.from(bytes,value=>value.toString(16).padStart(2,'0')).join('');
+}
+
+/** Data-only shared operator panel. The authorized host owns reads, writes and refresh. */
+type PublicationPanelProps={mode:'embedded'|'remote';status:PublicationStatus;history:PublicationHistory;onReview?:(payload:PublicationReviewPayload)=>Promise<void>;onSteer?:(classifier:string)=>void};
+export function PublicationCyclotronPanel(props:PublicationPanelProps){
+ assertPublicationScope(props.status,props.history);
+ // Remount all drafts, retry identities, pending messages and busy state on scope change.
+ return <PublicationControls key={publicationScopeKey(props.status)} {...props}/>;
+}
+function PublicationControls({mode,status,history,onReview,onSteer}:PublicationPanelProps){
+ assertPublicationScope(status,history);
+ const context=publicationScopeKey(status);const current=useRef(context);current.current=context;
+ const [message,setMessage]=useState<{context:string;key:string;error:boolean;text:string}|null>(null);const [busy,setBusy]=useState<string|null>(null);
+ const [editing,setEditing]=useState<Record<string,boolean>>({});const requests=useRef<Record<string,{signature:string;id:string}>>({});
+ async function submit(row:PublicationHistoryRow,classifier:string,review:ReviewControlReview){
+  const key=`${context}:${row.decision.decisionId}:${classifier}:${row.context?.contextId??'legacy'}`;
+  try{
+   const signature=JSON.stringify(review);const previous=requests.current[key];
+   const id=previous?.signature===signature?previous.id:requestId();requests.current[key]={signature,id};
+   const payload=publicationReviewPayload(status,row,classifier,review,id);
+   if(!onReview)throw new Error('This host has not enabled human review');
+   setBusy(key);setMessage(null);await onReview(payload);
+   if(current.current===context){setMessage({context,key,error:false,text:'Human label acknowledged.'});setEditing(old=>({...old,[key]:false}));}
+  }catch(error){if(current.current===context)setMessage({context,key,error:true,text:error instanceof Error?error.message:'Review failed; its outcome must be checked before retrying.'});}
+  finally{if(current.current===context)setBusy(null);}
+ }
+ return <section data-publication-scope={context} aria-label="Publication Cyclotron controls" className="space-y-4">
+  <header><h2 className="text-lg font-semibold">Cyclotron · {status.publicationId}</h2><p className="text-sm text-muted-foreground">{mode==='embedded'?'Classifier data owned by this deployment.':'Canonical classifier data owned by the shared remote lab.'}</p></header>
+  {status.outputs.map(output=><section key={`${context}:${output.id}`} aria-label={output.question} className="space-y-3 rounded-md border p-3">
+   <CyclotronStatusView status={status.classifiers[output.id]} classifierName={output.question} variant="card"/>
+   {onSteer?<button type="button" disabled={Boolean(busy)} onClick={()=>onSteer(output.id)}>Evaluate classifier proposal</button>:null}
+   {history.history.map(row=>{
+    const prediction=row.decision.classifiers[output.id];if(!prediction)return null;
+    const key=`${context}:${row.decision.decisionId}:${output.id}:${row.context?.contextId??'legacy'}`;const saved=row.reviews[output.id];const historical=Boolean(row.historicalContext||row.provenanceUnavailable||row.feedbackReconciliationRequired);
+    return <article key={key} className="space-y-2 rounded-md border p-3">
+     {historical?<p className="text-sm">Historical source or binding revision · read-only</p>:null}{row.feedbackReconciliationRequired?<p role="status">Canonical feedback changed; provenance reconciliation is required before replay.</p>:null}<h3 className="font-medium">{String(row.item.title??row.decision.itemId)}</h3>
+     <p className="whitespace-pre-wrap text-sm">{String(row.item.abstract??row.item.text??'')}</p>
+     {!saved||editing[key]?<p className="text-sm" role="status">{historical?'This source revision is read-only.':!onReview?'Human review is unavailable in this session.':busy===key?'Submitting review… Your selection is preserved; wait for acknowledgement.':'Choose a label to enable Submit review. Explanation is optional.'}</p>:null}
+     <ReviewControl key={`${key}:${Boolean(editing[key])}`} itemId={`${row.decision.itemId}:${Array.from(new TextEncoder().encode(context+':'+output.id+':'+(row.context?.contextId??'legacy')),byte=>byte.toString(16).padStart(2,'0')).join('')}`} decision={{decisionId:row.decision.decisionId,...prediction,classes:output.classes}} question={output.question} mode="labels" positiveLabel={output.positiveLabel??undefined} disabled={Boolean(busy)||!onReview||historical} value={saved&&!editing[key]?{label:saved.label,reasonCode:saved.reasonCode,explanation:saved.explanation}:undefined} onReview={review=>void submit(row,output.id,{...review,itemId:row.decision.itemId})}/>
+     {message?.context===context&&message.key===key?<p role={message.error?'alert':'status'} className="text-sm">{message.text}</p>:null}
+     {saved&&onReview&&!historical&&!editing[key]?<button type="button" disabled={Boolean(busy)} onClick={()=>setEditing(old=>({...old,[key]:true}))}>Correct human label</button>:null}
+     <details><summary>Decision provenance and version</summary><pre className="max-h-64 overflow-auto whitespace-pre-wrap text-xs">{JSON.stringify({itemId:row.decision.itemId,source:row.item.source_uri,decisionId:row.decision.decisionId,prediction,bindingRevision:row.context?.binding.values.revision??status.bindingRevision,sourceRef:row.context?.sourceRef,contextId:row.context?.contextId},null,2)}</pre></details>
+    </article>;
+   })}
+  </section>)}
+ </section>;
+}

package/components/reference-curation-controls.tsx

@@ -0,0 +1,77 @@
+'use client';
+
+import {useCallback,useEffect,useRef,useState} from 'react';
+import {useNewsroomCuration} from './newsroom-curation-provider';
+import {PublicationCyclotronPanel} from './publication-cyclotron-panel';
+import {ReferencePriming} from './reference-priming';
+import {Button} from './ui/button';
+import {publicationSteeringPayload,type PublicationHistory,type PublicationStatus} from '../lib/publication-cyclotron';
+import type {CurationSession} from '../lib/curation-client';
+
+export function ReferenceCurationControls({disabled=false}:{disabled?:boolean}){
+  const session=useNewsroomCuration();
+  return session&&!disabled?<Controls key={session.key} session={session} disabled={disabled}/>:null;
+}
+
+function Controls({session,disabled}:{session:CurationSession;disabled:boolean}){
+  const [snapshot,setSnapshot]=useState<{status:PublicationStatus;history:PublicationHistory}|null>(null);
+  const [error,setError]=useState('');
+  const [loading,setLoading]=useState(true);
+  const [primingMessage,setPrimingMessage]=useState('');
+  const [steering,setSteering]=useState<string|null>(null);
+  const [rubric,setRubric]=useState('');
+  const [explanation,setExplanation]=useState('');
+  const [busy,setBusy]=useState(false);
+  const [trial,setTrial]=useState<{fingerprint:string;improved:boolean}|null>(null);
+  const [steeringMessage,setSteeringMessage]=useState('');
+  const steeringRequests=useRef<Record<string,string>>({});
+  const canReview=!disabled&&session.bootstrap.capabilities.includes('review');
+  const canSteer=!disabled&&session.bootstrap.capabilities.includes('steer');
+  const refresh=useCallback(async()=>{
+    setLoading(true);setError('');
+    try{setSnapshot(await session.snapshot());}
+    catch(failure){setSnapshot(null);setError(failure instanceof Error?failure.message:'Curation status unavailable');}
+    finally{setLoading(false);}
+  },[session]);
+  useEffect(()=>{
+    let active=true;
+    void session.snapshot().then(value=>{if(active){setSnapshot(value);setError('');}}).catch(failure=>{if(active){setSnapshot(null);setError(failure instanceof Error?failure.message:'Curation status unavailable');}}).finally(()=>{if(active)setLoading(false);});
+    return()=>{active=false;};
+  },[session]);
+  async function steer(action:'evaluate'|'promote'){
+    if(!snapshot||!steering||!session.bootstrap.bindingRef)return;
+    setBusy(true);setSteeringMessage('');
+    try{
+      const identity=JSON.stringify([action,steering,rubric.trim(),explanation.trim(),trial?.fingerprint??'',snapshot.status.classifiers[steering].cyclotron.fingerprint]);
+      const requestId=steeringRequests.current[identity]??=crypto.randomUUID();
+      const command=action==='evaluate'?{action,proposal:{rubric:rubric.trim()},explanation,requestId} as const:{action,trialFingerprint:trial?.fingerprint??'',explanation,requestId} as const;
+      const payload=publicationSteeringPayload(snapshot.status,steering,session.bootstrap.bindingRef,command);
+      const receipt=await session.publication.steer(payload);
+      const result=(receipt.steering as {result?:{trial_fingerprint?:string;improved?:boolean;promoted?:boolean}}|undefined)?.result;
+      if(action==='evaluate')setTrial(result?.trial_fingerprint?{fingerprint:result.trial_fingerprint,improved:result.improved===true}:null);
+      setSteeringMessage(action==='promote'?'Evaluated proposal promoted.':result?.improved?'Evaluation complete: the candidate improved the measured result.':'Evaluation complete: no improvement was reported.');
+      await refresh();
+    }catch(failure){setSteeringMessage(failure instanceof Error?failure.message:'Proposal outcome unavailable; check before retrying');}
+    finally{setBusy(false);}
+  }
+  return <section aria-label="Publication curation" className="max-h-[55dvh] min-h-0 shrink-0 space-y-3 overflow-y-auto rounded-md border p-3" data-curation-mode={session.bootstrap.mode}>
+    <div className="flex items-center justify-between gap-3"><h3 className="font-semibold">Publication curation</h3><Button variant="outline" size="sm" disabled={loading||busy} onClick={()=>void refresh()}>Refresh curation</Button></div>
+    <p className="text-xs text-muted-foreground">{session.bootstrap.mode==='remote'?'Remote workspace':'Embedded workspace'} · {session.bootstrap.scope.publicationId}</p>
+    {loading?<p role="status">Loading publication monitoring…</p>:null}
+    {error?<p role="alert">{error}</p>:null}
+    {snapshot?<PublicationCyclotronPanel mode={session.bootstrap.mode} status={snapshot.status} history={snapshot.history}
+      onReview={canReview?async payload=>{await session.publication.review(payload);await refresh();}:undefined}
+      onSteer={canSteer&&snapshot.status.features?.steering&&session.bootstrap.bindingRef?classifier=>{setSteering(classifier);setRubric('');setExplanation('');setTrial(null);setSteeringMessage('');}:undefined}/>:null}
+    {steering?<form aria-label="Classifier proposal" className="space-y-3 rounded-md border p-3" onSubmit={event=>{event.preventDefault();void steer('evaluate');}}>
+      <h4 className="font-semibold">Evaluate classifier proposal</h4>
+      <p className="text-sm">A proposal is evaluated before an explicit promotion. Existing classifications are not relabeled by opening this form.</p>
+      <label className="block text-sm">Proposed instructions<textarea className="mt-1 block min-h-24 w-full rounded border bg-background p-2" required value={rubric} onChange={event=>{setRubric(event.target.value);setTrial(null);}}/></label>
+      <label className="block text-sm">Why make this change?<textarea className="mt-1 block min-h-20 w-full rounded border bg-background p-2" required value={explanation} onChange={event=>setExplanation(event.target.value)}/></label>
+      <div className="flex flex-wrap gap-2"><Button type="submit" disabled={busy||!canSteer||!rubric.trim()||!explanation.trim()}>Evaluate proposal</Button><Button type="button" variant="outline" disabled={busy||!canSteer||!trial?.improved||!explanation.trim()} onClick={()=>void steer('promote')}>Promote evaluated proposal</Button><Button type="button" variant="ghost" disabled={busy} onClick={()=>setSteering(null)}>Close proposal</Button></div>
+      {steeringMessage?<p role="status">{steeringMessage}</p>:null}
+    </form>:null}
+    {session.bootstrap.priming&&canReview?<ReferencePriming client={session.priming} listId={session.bootstrap.priming.listId} classifiers={session.bootstrap.priming.classifiers}
+      onAccepted={draft=>{setPrimingMessage(`Accepted ${draft.rows.length} example item${draft.rows.length===1?'':'s'} for this pinned publication. Operation remains available without priming.`);void refresh();}}/>:null}
+    {primingMessage?<p role="status">{primingMessage}</p>:null}
+  </section>;
+}

package/components/reference-priming.tsx

@@ -0,0 +1,18 @@
+"use client";
+
+import { useState } from "react";
+import { PrimingPanel, type PrimingPanelProps } from "cyclotron/components/priming-panel";
+import { Button } from "./ui/button";
+
+/** Papyrus supplies its transport/configuration; Cyclotron owns preview and labels. */
+export function ReferencePriming(props: PrimingPanelProps) {
+  const [open, setOpen] = useState(false);
+  return (
+    <section className="shrink-0 space-y-3" aria-label="Representative reference examples">
+      <Button aria-expanded={open} onClick={() => setOpen((value) => !value)} variant="outline">
+        {open ? "Hide example priming" : "Curate reference examples (optional)"}
+      </Button>
+      {open ? <div className="max-h-[55dvh] space-y-3 overflow-y-auto pr-1"><p className="text-sm text-muted-foreground">Corrections to extracted content: describe what needs fixing, then enter the corrected title and abstract or summary. The note is saved with your correction; it does not automatically regenerate the content. Choose Publish / Not publish separately. An explanation of that judgment is optional.</p><PrimingPanel {...props} renderItem={props.renderItem ?? ((item) => <div className="space-y-2"><p className="whitespace-pre-wrap text-sm">{String(item.values.abstract ?? item.values.text ?? "")}</p><p className="break-all text-xs text-muted-foreground">{String(item.values.source_uri ?? "")}</p></div>)} /></div> : null}
+    </section>
+  );
+}

package/infra/amplify-app-shell.js

@@ -3,7 +3,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -85,6 +85,17 @@ export class AmplifyAppShellStack extends Stack {
                 ],
             }));
         }
+        const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+        const prospectusEnvironment = prospectusAccountsApiStageArn
+            ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+            : {};
+        if (prospectusAccountsApiStageArn) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "InvokeProspectusAccountsAsRegisteredSite",
+                actions: ["execute-api:Invoke"],
+                resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+            }));
+        }
         const cmsApp = new amplify.CfnApp(this, "App", {
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -134,6 +145,7 @@ export class AmplifyAppShellStack extends Stack {
                 SITE_ENV: "production",
                 PAPYRUS_CONTENT_SOURCE: "published",
                 ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+                ...prospectusEnvironment,
             }),
         });
         let stagingBranch;
@@ -153,6 +165,7 @@ export class AmplifyAppShellStack extends Stack {
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",
                     ...stagingMode,
+                    ...prospectusEnvironment,
                     NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
                         ? `https://${stagingDomainName}`
                         : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
@@ -191,6 +204,10 @@ export class AmplifyAppShellStack extends Stack {
         this.cmsAppId = cmsApp.attrAppId;
         new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
         new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+        new CfnOutput(this, "CmsComputeRoleArn", {
+            value: computeRole.roleArn,
+            description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+        });
         if (stagingEnabled) {
             new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
         }

package/infra/amplify-app-shell.ts

@@ -4,7 +4,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -96,6 +96,20 @@ export class AmplifyAppShellStack extends Stack {
       );
     }
 
+    const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+    const prospectusEnvironment = prospectusAccountsApiStageArn
+      ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+      : {};
+    if (prospectusAccountsApiStageArn) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "InvokeProspectusAccountsAsRegisteredSite",
+          actions: ["execute-api:Invoke"],
+          resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+        }),
+      );
+    }
+
     const cmsApp = new amplify.CfnApp(this, "App", {
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -148,6 +162,7 @@ export class AmplifyAppShellStack extends Stack {
         SITE_ENV: "production",
         PAPYRUS_CONTENT_SOURCE: "published",
         ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+        ...prospectusEnvironment,
       }),
     });
 
@@ -168,6 +183,7 @@ export class AmplifyAppShellStack extends Stack {
           PAPYRUS_SITE_BRAND: config.brand,
           SITE_ENV: "staging",
           ...stagingMode,
+          ...prospectusEnvironment,
           NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
             ? `https://${stagingDomainName}`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
@@ -209,6 +225,10 @@ export class AmplifyAppShellStack extends Stack {
     this.cmsAppId = cmsApp.attrAppId;
     new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
     new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+    new CfnOutput(this, "CmsComputeRoleArn", {
+      value: computeRole.roleArn,
+      description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+    });
     if (stagingEnabled) {
       new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
     }

package/infra/site-config.js

@@ -16,7 +16,24 @@ const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+/** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
+export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
+    "GET/v1/identities/me",
+    "POST/v1/identities/google/challenge",
+    "POST/v1/identities/google/resolve",
+    "GET/v1/accounts",
+    "GET/v1/accounts/*",
+    "POST/v1/accounts/*/authorize",
+    "GET/v1/account-directory",
+    "GET/v1/account-directory/*",
+];
+export function resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) {
+    const [, , , region, , apiPath] = prospectusAccountsApiStageArn.split(":");
+    const [apiId, stageName] = apiPath.split("/");
+    return `https://${apiId}.execute-api.${region}.amazonaws.com/${stageName}/`;
+}
 function originOfRedirectUrl(value) {
     try {
         return new URL(value).origin;
@@ -181,7 +198,7 @@ function parseStagingPreview(value) {
 }
 function parseCms(value) {
     const cmsRecord = requireObject(value, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -205,6 +222,7 @@ function parseCms(value) {
         stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
         redirects: parseRedirects(cmsRecord.redirects),
         stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
+        prospectusAccountsApiStageArn: optionalString(cmsRecord.prospectusAccountsApiStageArn, "cms.prospectusAccountsApiStageArn", PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN, "arn:aws:execute-api:<region>:<account>:<api id>/api"),
     };
     const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
     if (reservedWord) {
@@ -212,7 +230,7 @@ function parseCms(value) {
     }
     for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
         if (key in cms.environment) {
-            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
         }
     }
     if (cms.staging === false && cms.stagingDomainName) {

package/infra/site-config.ts

@@ -41,6 +41,7 @@ export type CmsConfig = {
   stagingDomainName?: string;
   stagingDomainPrefix?: string;
   redirects?: CmsRedirect[];
+  prospectusAccountsApiStageArn?: string;
 };
 
 export type AmplifyAppShellSiteConfig = {
@@ -95,7 +96,26 @@ const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+
+/** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
+export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
+  "GET/v1/identities/me",
+  "POST/v1/identities/google/challenge",
+  "POST/v1/identities/google/resolve",
+  "GET/v1/accounts",
+  "GET/v1/accounts/*",
+  "POST/v1/accounts/*/authorize",
+  "GET/v1/account-directory",
+  "GET/v1/account-directory/*",
+];
+
+export function resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn: string): string {
+  const [, , , region, , apiPath] = prospectusAccountsApiStageArn.split(":");
+  const [apiId, stageName] = apiPath.split("/");
+  return `https://${apiId}.execute-api.${region}.amazonaws.com/${stageName}/`;
+}
 function originOfRedirectUrl(value: string): string {
   try {
     return new URL(value).origin;
@@ -259,7 +279,7 @@ function parseStagingPreview(value: unknown): StagingPreviewConfig | undefined {
 
 function parseCms(value: unknown): CmsConfig {
   const cmsRecord = requireObject(value, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -288,6 +308,12 @@ function parseCms(value: unknown): CmsConfig {
     stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
     redirects: parseRedirects(cmsRecord.redirects),
     stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
+    prospectusAccountsApiStageArn: optionalString(
+      cmsRecord.prospectusAccountsApiStageArn,
+      "cms.prospectusAccountsApiStageArn",
+      PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN,
+      "arn:aws:execute-api:<region>:<account>:<api id>/api",
+    ),
   };
 
   const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
@@ -296,7 +322,7 @@ function parseCms(value: unknown): CmsConfig {
   }
   for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
     if (key in cms.environment) {
-      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
     }
   }
 

package/lib/approved-priming-proof-reports.ts

@@ -0,0 +1,6 @@
+/**
+ * Priming proof reports a publication owner approved for visitors, keyed by site brand id.
+ * A report reaches this map only through a reviewed commit of its
+ * `publications/priming-proofs/<brand id>.json` file; see docs/priming-proof.md.
+ */
+export const APPROVED_PRIMING_PROOF_REPORTS: Record<string, unknown> = {};

package/lib/curation-client.ts

@@ -0,0 +1,61 @@
+import {createPrimingClient} from 'cyclotron/priming-client';
+import {assertPublicationScope,createPublicationClient,publicationScopeKey,type PublicationEnvelope,type PublicationRevisionRef,type PublicationScope} from './publication-cyclotron';
+
+export type CurationBootstrap={
+  scope:PublicationScope;
+  mode:'embedded'|'remote';
+  priming:{listId:string;classifiers:{id:string;revision:number}[]}|null;
+  capabilities:readonly string[];
+  bindingRef:PublicationRevisionRef|null;
+};
+export type CurationRequest=<T>(path:string,body:Record<string,unknown>,scope:Readonly<PublicationScope>)=>Promise<T>;
+
+/** Same-origin only. The server verifies these expected pins against its session. */
+export const requestCuration:CurationRequest=async<T,>(path:string,body:Record<string,unknown>,scope:Readonly<PublicationScope>)=>{
+  if(!path.startsWith('/api/newsroom/curation/'))throw new Error('Same-origin curation route required');
+  const controller=new AbortController();
+  const timer=setTimeout(()=>controller.abort(),15000);
+  let response:Response;
+  let result;
+  try{
+  response=await fetch(path,{method:'POST',credentials:'same-origin',signal:controller.signal,headers:{
+    'Content-Type':'application/json','X-Cyclotron-Account':scope.accountId,
+    'X-Papyrus-Publication':scope.publicationId,'X-Papyrus-Binding':scope.bindingRevision,
+  },body:JSON.stringify(body)});
+  result=await response.json().catch(()=>null);
+  }catch(error){
+    const timeout=controller.signal.aborted||(error instanceof Error&&error.name==='AbortError');
+    throw new Error(timeout?'Curation request timed out. Your selection is preserved. Check the server and saved history before retrying; do not resubmit automatically.':'Cannot reach the curation server. Your selection is preserved. Check the preview is running and saved history before retrying; do not resubmit automatically.');
+  }finally{clearTimeout(timer);}
+  if(response.status===401)throw new Error('Sign in again: the curation session expired. Your selection is preserved.');
+  if(response.status===403)throw new Error('Your session does not have permission for this curation action. Your selection is preserved.');
+  if(!response.ok||!result||result.errors)throw new Error(`Curation request failed (HTTP ${response.status}): ${result?.error??result?.errors?.[0]?.message??'invalid server response'}. Check saved history before retrying; your selection is preserved.`);
+  return result as T;
+};
+
+/** One controller contract for both modes; no browser-selected service URL. */
+export function createCurationSession(bootstrap:CurationBootstrap,request:CurationRequest,currentScope:()=>PublicationScope|null){
+  const pinned=Object.freeze({...bootstrap.scope});
+  const scopeKey=publicationScopeKey(pinned);
+  const assertCurrent=()=>{
+    const selected=currentScope();
+    if(!selected||publicationScopeKey(selected)!==scopeKey)throw new Error('Curation account selection changed; refresh context');
+  };
+  const publication=createPublicationClient(pinned,(operation,payload,scope)=>request<PublicationEnvelope&Record<string,unknown>>('/api/newsroom/curation/publication',{operation,payload},scope),currentScope);
+  const priming=createPrimingClient(async<T,>(query:string,variables:Record<string,unknown>):Promise<T>=>{
+    assertCurrent();
+    const result=await request<{data:T}>('/api/newsroom/curation/priming',{query,variables},pinned);
+    assertCurrent();
+    return result.data;
+  });
+  return {
+    key:JSON.stringify([bootstrap.mode,scopeKey]),bootstrap,publication,priming,
+    async snapshot(){
+      const [status,history]=await Promise.all([publication.status(),publication.history()]);
+      assertCurrent();assertPublicationScope(status,history);
+      return {status,history};
+    },
+  };
+}
+
+export type CurationSession=ReturnType<typeof createCurationSession>;

package/lib/priming-proof-report.ts

@@ -0,0 +1,89 @@
+import { z } from "zod";
+import { APPROVED_PRIMING_PROOF_REPORTS } from "./approved-priming-proof-reports";
+
+export const PRIMING_PROOF_REPORT_VERSION = "cyclotron-priming-proof/v1";
+
+const nullableRatio = z.number().min(0).max(1).nullable();
+
+const primingProofPointSchema = z.object({
+  labels: z.number().int().min(0),
+  labelsByClass: z.record(z.string(), z.number().int().min(0)),
+  decided: z.number().int().min(0),
+  agreement: nullableRatio,
+  precision: nullableRatio,
+  recall: nullableRatio,
+  confusion: z.object({
+    truePositives: z.number().int().min(0),
+    falsePositives: z.number().int().min(0),
+    trueNegatives: z.number().int().min(0),
+    falseNegatives: z.number().int().min(0),
+  }),
+});
+
+export const primingProofReportSchema = z.object({
+  version: z.literal(PRIMING_PROOF_REPORT_VERSION),
+  proofId: z.string().min(1),
+  publication: z.string().min(1),
+  cyclotronId: z.string().min(1),
+  question: z.string().min(1),
+  labels: z.array(z.string().min(1)).length(2),
+  positiveLabel: z.string().min(1),
+  decisionModel: z.string().nullable(),
+  ranAt: z.string().min(1),
+  heldOut: z.object({
+    size: z.number().int().min(1),
+    byLabel: z.record(z.string(), z.number().int().min(0)),
+    fingerprint: z.string().min(1),
+    frozenAt: z.string().min(1),
+    source: z.string().min(1),
+  }),
+  priming: z.object({
+    acceptedExamples: z.number().int().min(0),
+    excludedBecauseInHeldOut: z.number().int().min(0),
+    fingerprint: z.string().nullable(),
+    order: z.string().min(1),
+  }),
+  conditions: z.object({
+    freshStorePerPoint: z.boolean(),
+    rubric: z.string().min(1),
+    optimizer: z.boolean(),
+    reviewProgram: z.boolean(),
+  }),
+  points: z.array(primingProofPointSchema).min(1),
+});
+
+export type PrimingProofReport = z.infer<typeof primingProofReportSchema>;
+export type PrimingProofPoint = z.infer<typeof primingProofPointSchema>;
+
+export type PrimingProofHeadline = {
+  baseline: PrimingProofPoint;
+  latest: PrimingProofPoint;
+  agreementChangeInPoints: number | null;
+};
+
+export function parsePrimingProofReport(value: unknown): PrimingProofReport {
+  const report = primingProofReportSchema.parse(value);
+  if (report.points[0].labels !== 0) {
+    throw new Error("A priming proof report must start with the zero-label baseline.");
+  }
+  return report;
+}
+
+export function approvedPrimingProofReport(brandId: string): PrimingProofReport | null {
+  const approvedReport = APPROVED_PRIMING_PROOF_REPORTS[brandId];
+  return approvedReport === undefined ? null : parsePrimingProofReport(approvedReport);
+}
+
+export function primingProofHeadline(report: PrimingProofReport): PrimingProofHeadline {
+  const baseline = report.points[0];
+  const latest = report.points[report.points.length - 1];
+  const agreementChangeInPoints =
+    baseline.agreement === null || latest.agreement === null
+      ? null
+      : Math.round((latest.agreement - baseline.agreement) * 1000) / 10;
+  return { baseline, latest, agreementChangeInPoints };
+}
+
+export function formatProofPercentage(ratio: number | null): string {
+  return ratio === null ? "n/a" : `${Math.round(ratio * 1000) / 10}%`;
+}

package/lib/prospectus-site-identity.ts

@@ -0,0 +1,303 @@
+
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+import { SignatureV4 } from "@smithy/signature-v4";
+import { HttpRequest } from "@smithy/protocol-http";
+import { Sha256 } from "@aws-crypto/sha256-js";
+import { CognitoJwtVerifier } from "aws-jwt-verify";
+import type { JwksCache } from "aws-jwt-verify/jwk";
+
+/**
+ * A Papyrus site's server-side view of Prospectus, the single account service.
+ *
+ * The site signs requests with its own runtime role (the Amplify SSR compute role
+ * registered in Prospectus). People sign in through the site's Google-only Cognito
+ * client; Prospectus binds that sign-in to a canonical person through a one-time
+ * challenge nonce. Papyrus keeps no account or membership tables: every answer here
+ * comes from Prospectus, and publication-level grants are never inferred from an
+ * account role.
+ */
+
+export type ProspectusRole = "owner" | "admin" | "member" | "viewer";
+export type ProspectusOperation = "console:read" | "console:write" | "members:read" | "members:write";
+
+export interface ProspectusPerson {
+  id: string;
+  createdAt: string;
+}
+
+export interface ProspectusAccountAuthorization {
+  allowed: true;
+  accountId: string;
+  personId: string;
+  product: string;
+  role: ProspectusRole;
+  operation: ProspectusOperation;
+  revision: number;
+}
+
+export interface ProspectusDirectoryAccount {
+  id: string;
+  name: string;
+  role: ProspectusRole;
+  products: Array<{ product: string; status: "active" | "disabled" }>;
+}
+
+export interface ProspectusRequest {
+  path: string;
+  method: "GET" | "POST";
+  body?: unknown;
+  humanAccessToken?: string;
+  identityToken?: string;
+}
+
+export type ProspectusTransport = (request: ProspectusRequest) => Promise<unknown>;
+
+export class ProspectusAccountsError extends Error {
+  constructor(
+    readonly status: number,
+    readonly code: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export interface TemporaryRuntimeCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+  expiration?: Date;
+}
+
+export interface SignedProspectusTransportOptions {
+  endpoint: string;
+  region: string;
+  runtimeCredentials?: () => Promise<TemporaryRuntimeCredentials>;
+  fetcher?: typeof fetch;
+}
+
+export function signedProspectusTransport(options: SignedProspectusTransportOptions): ProspectusTransport {
+  const endpoint = new URL(options.endpoint);
+  if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) {
+    throw new Error("Use an HTTPS Prospectus accounts endpoint.");
+  }
+  const runtimeCredentials = options.runtimeCredentials ?? defaultProvider();
+  const fetcher = options.fetcher ?? fetch;
+  return async ({ path, method, body, humanAccessToken, identityToken }) => {
+    const credentials = await runtimeCredentials();
+    if (!credentials.sessionToken || (credentials.expiration && credentials.expiration.getTime() <= Date.now())) {
+      throw new Error("Prospectus calls require the site's temporary runtime credentials; static access keys are refused.");
+    }
+    const url = new URL(`${endpoint.toString().replace(/\/$/, "")}${path}`);
+    const payload = body === undefined ? undefined : JSON.stringify(body);
+    const headers: Record<string, string> = {
+      host: url.host,
+      ...(humanAccessToken ? { "x-prospectus-human-token": humanAccessToken } : {}),
+      ...(identityToken ? { "x-prospectus-identity-token": identityToken } : {}),
+      ...(payload ? { "content-type": "application/json" } : {}),
+    };
+    const signer = new SignatureV4({ service: "execute-api", region: options.region, credentials, sha256: Sha256 });
+    const signed = await signer.sign(
+      new HttpRequest({ protocol: url.protocol, hostname: url.hostname, path: url.pathname, method, headers, body: payload }),
+    );
+    const response = await fetcher(url, { method, headers: signed.headers, body: payload, cache: "no-store", redirect: "error" });
+    const responseBody = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw new ProspectusAccountsError(response.status, responseBody.error ?? "request_failed", responseBody.message ?? "Prospectus request failed.");
+    }
+    return responseBody;
+  };
+}
+
+export class ProspectusSiteAccounts {
+  constructor(private readonly transport: ProspectusTransport) {}
+
+  requestGoogleSignInChallenge(): Promise<{ challengeId: string; nonce: string; expiresAt: number }> {
+    return this.transport({ path: "/v1/identities/google/challenge", method: "POST", body: {} }) as Promise<{
+      challengeId: string;
+      nonce: string;
+      expiresAt: number;
+    }>;
+  }
+
+  resolveGoogleSignIn(challengeId: string, humanAccessToken: string, identityToken: string): Promise<{ person: ProspectusPerson }> {
+    return this.transport({
+      path: "/v1/identities/google/resolve",
+      method: "POST",
+      body: { challengeId },
+      humanAccessToken,
+      identityToken,
+    }) as Promise<{ person: ProspectusPerson }>;
+  }
+
+  currentPerson(humanAccessToken: string): Promise<{ person: ProspectusPerson | null }> {
+    return this.transport({ path: "/v1/identities/me", method: "GET", humanAccessToken }) as Promise<{ person: ProspectusPerson | null }>;
+  }
+
+  authorizeAccountOperation(humanAccessToken: string, accountId: string, operation: ProspectusOperation): Promise<ProspectusAccountAuthorization> {
+    return this.transport({
+      path: `/v1/accounts/${encodeURIComponent(accountId)}/authorize`,
+      method: "POST",
+      body: { operation },
+      humanAccessToken,
+    }) as Promise<ProspectusAccountAuthorization>;
+  }
+
+  accountDirectory(humanAccessToken: string): Promise<{ person: ProspectusPerson | null; accounts: ProspectusDirectoryAccount[] }> {
+    return this.transport({ path: "/v1/account-directory", method: "GET", humanAccessToken }) as Promise<{
+      person: ProspectusPerson | null;
+      accounts: ProspectusDirectoryAccount[];
+    }>;
+  }
+}
+
+export interface GoogleOnlyCognitoClient {
+  hostedUiOrigin: string;
+  userPoolId: string;
+  clientId: string;
+  redirectUri: string;
+}
+
+export interface PendingProspectusSignIn {
+  challengeId: string;
+  nonce: string;
+  state: string;
+  codeVerifier: string;
+  expiresAt: number;
+}
+
+export interface CognitoTokens {
+  accessToken: string;
+  idToken: string;
+  refreshToken?: string;
+  expiresInSeconds: number;
+}
+
+export type CognitoTokenVerifier = (tokens: CognitoTokens, expectedNonce: string) => Promise<void>;
+
+function base64UrlRandom(byteLength: number): string {
+  return randomBytes(byteLength).toString("base64url");
+}
+
+function constantTimeEquals(left: string, right: string): boolean {
+  const leftBytes = Buffer.from(left);
+  const rightBytes = Buffer.from(right);
+  return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+}
+
+export async function beginProspectusGoogleSignIn(
+  accounts: ProspectusSiteAccounts,
+  cognitoClient: GoogleOnlyCognitoClient,
+): Promise<{ authorizationUrl: string; pendingSignIn: PendingProspectusSignIn }> {
+  const challenge = await accounts.requestGoogleSignInChallenge();
+  const state = base64UrlRandom(32);
+  const codeVerifier = base64UrlRandom(48);
+  const authorizationUrl = new URL("/oauth2/authorize", cognitoClient.hostedUiOrigin);
+  authorizationUrl.search = new URLSearchParams({
+    response_type: "code",
+    client_id: cognitoClient.clientId,
+    redirect_uri: cognitoClient.redirectUri,
+    scope: "openid email profile",
+    identity_provider: "Google",
+    state,
+    nonce: challenge.nonce,
+    code_challenge: createHash("sha256").update(codeVerifier).digest("base64url"),
+    code_challenge_method: "S256",
+  }).toString();
+  return {
+    authorizationUrl: authorizationUrl.toString(),
+    pendingSignIn: { challengeId: challenge.challengeId, nonce: challenge.nonce, state, codeVerifier, expiresAt: challenge.expiresAt },
+  };
+}
+
+export function cognitoTokenVerifier(cognitoClient: GoogleOnlyCognitoClient, signingKeyCache?: JwksCache): CognitoTokenVerifier {
+  const verifierOptions = signingKeyCache ? { jwksCache: signingKeyCache } : undefined;
+  const accessTokenVerifier = CognitoJwtVerifier.create({ userPoolId: cognitoClient.userPoolId, tokenUse: "access", clientId: cognitoClient.clientId }, verifierOptions);
+  const identityTokenVerifier = CognitoJwtVerifier.create({ userPoolId: cognitoClient.userPoolId, tokenUse: "id", clientId: cognitoClient.clientId }, verifierOptions);
+  return async (tokens, expectedNonce) => {
+    const accessClaims = await accessTokenVerifier.verify(tokens.accessToken);
+    const identityClaims = await identityTokenVerifier.verify(tokens.idToken);
+    if (identityClaims.nonce !== expectedNonce) throw new ProspectusAccountsError(401, "nonce_mismatch", "Sign-in did not carry this site's Prospectus challenge.");
+    if (identityClaims.sub !== accessClaims.sub) throw new ProspectusAccountsError(401, "token_pair_mismatch", "Access and identity tokens describe different people.");
+  };
+}
+
+export interface CompleteProspectusGoogleSignInInput {
+  accounts: ProspectusSiteAccounts;
+  cognitoClient: GoogleOnlyCognitoClient;
+  pendingSignIn: PendingProspectusSignIn;
+  returnedState: string;
+  authorizationCode: string;
+  verifyCognitoTokens?: CognitoTokenVerifier;
+  fetcher?: typeof fetch;
+  nowInSeconds?: number;
+}
+
+export async function completeProspectusGoogleSignIn(
+  input: CompleteProspectusGoogleSignInInput,
+): Promise<{ person: ProspectusPerson; accessToken: string; refreshToken?: string; accessTokenExpiresAt: number }> {
+  const nowInSeconds = input.nowInSeconds ?? Math.floor(Date.now() / 1000);
+  if (nowInSeconds >= input.pendingSignIn.expiresAt) {
+    throw new ProspectusAccountsError(401, "sign_in_expired", "Sign-in took too long. Start again.");
+  }
+  if (!constantTimeEquals(input.returnedState, input.pendingSignIn.state)) {
+    throw new ProspectusAccountsError(401, "state_mismatch", "Sign-in response does not belong to this browser's sign-in.");
+  }
+  const tokenResponse = await (input.fetcher ?? fetch)(new URL("/oauth2/token", input.cognitoClient.hostedUiOrigin), {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: input.cognitoClient.clientId,
+      code: input.authorizationCode,
+      redirect_uri: input.cognitoClient.redirectUri,
+      code_verifier: input.pendingSignIn.codeVerifier,
+    }).toString(),
+    cache: "no-store",
+    redirect: "error",
+  });
+  const tokenBody = await tokenResponse.json().catch(() => ({}));
+  if (!tokenResponse.ok || typeof tokenBody.access_token !== "string" || typeof tokenBody.id_token !== "string") {
+    throw new ProspectusAccountsError(401, "code_exchange_failed", "Cognito did not complete the sign-in.");
+  }
+  const tokens: CognitoTokens = {
+    accessToken: tokenBody.access_token,
+    idToken: tokenBody.id_token,
+    refreshToken: typeof tokenBody.refresh_token === "string" ? tokenBody.refresh_token : undefined,
+    expiresInSeconds: Number(tokenBody.expires_in) || 0,
+  };
+  await (input.verifyCognitoTokens ?? cognitoTokenVerifier(input.cognitoClient))(tokens, input.pendingSignIn.nonce);
+  const { person } = await input.accounts.resolveGoogleSignIn(input.pendingSignIn.challengeId, tokens.accessToken, tokens.idToken);
+  return {
+    person,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken,
+    accessTokenExpiresAt: nowInSeconds + tokens.expiresInSeconds,
+  };
+}
+
+export async function authorizeSignedInPersonForAccount(
+  accounts: ProspectusSiteAccounts,
+  humanAccessToken: string,
+  accountId: string,
+  operation: ProspectusOperation,
+): Promise<ProspectusAccountAuthorization> {
+  const { person } = await accounts.currentPerson(humanAccessToken);
+  if (!person) throw new ProspectusAccountsError(401, "unknown_person", "Sign in again: Prospectus does not recognize this session.");
+  const authorization = await accounts.authorizeAccountOperation(humanAccessToken, accountId, operation);
+  if (authorization.allowed !== true || authorization.personId !== person.id || authorization.accountId !== accountId || authorization.operation !== operation) {
+    throw new ProspectusAccountsError(403, "not_authorized", "Prospectus did not authorize this account operation.");
+  }
+  return authorization;
+}
+
+export const CYCLOTRON_LAB_PRODUCT = "cyclotron";
+
+export async function signedInPersonHasCyclotronLabAccess(accounts: ProspectusSiteAccounts, humanAccessToken: string): Promise<boolean> {
+  const directory = await accounts.accountDirectory(humanAccessToken);
+  if (!directory.person) return false;
+  return directory.accounts.some((account) =>
+    account.products.some((product) => product.product === CYCLOTRON_LAB_PRODUCT && product.status === "active"),
+  );
+}

package/lib/publication-cyclotron.ts

@@ -0,0 +1,74 @@
+import type {CyclotronDecision,CyclotronReview} from 'cyclotron/sdk-types';
+import type {CyclotronStatus} from 'cyclotron/cyclotron-status';
+import type {ReviewControlReview} from 'cyclotron/components/review-control';
+
+export type PublicationScope={accountId:string;publicationId:string;bindingRevision:string};
+export type PublicationEnvelope=PublicationScope&{contractVersion:'cyclotron-publication/v1';publicationId:string;bindingRevision:string;features?:{frozenContext:boolean;replayExport:boolean;steering:boolean};outputs:Array<{id:string;question:string;classes:string[];positiveLabel:string|null}>};
+export type PublicationStatus=PublicationEnvelope&{classifiers:Record<string,CyclotronStatus>};
+export type PublicationRevisionRef={listId:string;itemId:string;revision:number;contentHash:string};
+export type PublicationContext={contextId:string;decisionId:string;publicationId:string;sourceRef:PublicationRevisionRef;bindingRef:PublicationRevisionRef;source:{id:string;values:Record<string,unknown>};binding:{values:{accountId:string;publicationId:string;revision:string;outputs:string[]}}};
+export type PublicationHistoryRow={decision:CyclotronDecision;item:Record<string,unknown>;state?:string;reviews:Record<string,CyclotronReview>;context?:PublicationContext;historicalContext?:boolean;provenanceUnavailable?:boolean;feedbackReconciliationRequired?:boolean};
+export type PublicationHistory=PublicationEnvelope&{history:PublicationHistoryRow[]};
+export type PublicationReviewPayload={bindingRevision:string;decisionId:string;classifier:string;predictionVersion:number;predictionFingerprint:string;requestId:string;label:string;explanation:string;reasonCode:string|null;contextId?:string};
+export type PublicationSteeringInput={requestId:string;explanation:string}&({action:'evaluate';proposal:Record<string,unknown>}|{action:'promote';trialFingerprint:string});
+export type PublicationSteeringPayload=PublicationSteeringInput&{bindingRevision:string;bindingRef:PublicationRevisionRef;classifier:string;expectedFingerprint:string};
+
+function ordered(value:unknown):unknown{
+ if(Array.isArray(value))return value.map(ordered);
+ if(value&&typeof value==='object')return Object.fromEntries(Object.entries(value).sort(([a],[b])=>a.localeCompare(b)).map(([key,item])=>[key,ordered(item)]));
+ return value;
+}
+
+/** Stable cache/component identity; length-safe even when IDs contain delimiters. */
+export function publicationScopeKey(scope:PublicationScope):string{
+ if([scope.accountId,scope.publicationId,scope.bindingRevision].some(value=>typeof value!=='string'||!value.trim()))throw new Error('Complete publication account scope required');
+ return JSON.stringify([scope.accountId,scope.publicationId,scope.bindingRevision]);
+}
+
+export function assertPublicationScope(status:PublicationStatus,history:PublicationHistory){
+ if(status.contractVersion!=='cyclotron-publication/v1'||history.contractVersion!==status.contractVersion||publicationScopeKey(status)!==publicationScopeKey(history)||status.publicationId!==history.publicationId||status.bindingRevision!==history.bindingRevision)throw new Error('Publication snapshot binding mismatch');
+ const outputs=new Set(status.outputs.map(output=>output.id));
+ if(!outputs.size||outputs.size!==status.outputs.length||status.outputs.some(output=>status.classifiers[output.id]?.cyclotron.classifier!==output.id)||JSON.stringify(history.outputs)!==JSON.stringify(status.outputs))throw new Error('Publication snapshot is incomplete');
+ if(Object.keys(status.classifiers).some(id=>!outputs.has(id))||history.outputs.some(output=>!outputs.has(output.id))||history.history.some(row=>[...Object.keys(row.decision.classifiers),...Object.keys(row.reviews)].some(id=>!outputs.has(id))))throw new Error('Snapshot includes an output outside this publication');
+ if(history.history.some(row=>row.context&&(row.context.binding.values.accountId!==status.accountId||row.context.publicationId!==status.publicationId||row.context.decisionId!==row.decision.decisionId||JSON.stringify(ordered(row.context.source.values))!==JSON.stringify(ordered(row.item)))))throw new Error('Historical source context mismatch');
+}
+
+/** Explicit output target and incumbent pin; never a global review-rate mutation. */
+export function publicationSteeringPayload(status:PublicationStatus,classifier:string,bindingRef:PublicationRevisionRef,command:PublicationSteeringInput):PublicationSteeringPayload{
+ if(!status.outputs.some(output=>output.id===classifier)||!status.classifiers[classifier])throw new Error('Steering output is outside this publication');
+ if(!command.requestId.trim()||!command.explanation.trim())throw new Error('Steering needs a stable identity and explicit explanation');
+ const fingerprint=status.classifiers[classifier].cyclotron.fingerprint;
+ if(!fingerprint)throw new Error('Active classifier fingerprint unavailable');
+ if(command.action==='evaluate'){
+  if(!Object.keys(command.proposal).length||Object.keys(command.proposal).some(key=>!['rubric','tasks','example_ids','dynamic_elements'].includes(key)))throw new Error('Native proposal fields required');
+ }else if(command.action!=='promote'||!command.trialFingerprint.trim())throw new Error('An explicitly evaluated trial is required');
+ return {...command,explanation:command.explanation.trim(),bindingRevision:status.bindingRevision,bindingRef,classifier,expectedFingerprint:fingerprint};
+}
+
+export function publicationReviewPayload(binding:PublicationEnvelope,row:PublicationHistoryRow,classifier:string,review:ReviewControlReview,requestId:string):PublicationReviewPayload{
+ if(row.context&&row.context.binding.values.accountId!==binding.accountId)throw new Error('Review account context mismatch');
+ if(row.historicalContext||row.provenanceUnavailable||row.feedbackReconciliationRequired||row.context&&row.context.binding.values.revision!==binding.bindingRevision)throw new Error('Historical source or binding revision is read-only');
+ const output=binding.outputs.find(output=>output.id===classifier);const prediction=row.decision.classifiers[classifier];
+ if(!output||!prediction||review.decisionId!==row.decision.decisionId||review.itemId!==row.decision.itemId)throw new Error('Review does not match the displayed publication decision');
+ if(!review.label||!output.classes.includes(review.label))throw new Error('Choose an explicit classification label');
+ if(!requestId.trim())throw new Error('A stable review request identity is required');
+ return {bindingRevision:binding.bindingRevision,decisionId:row.decision.decisionId,classifier,predictionVersion:prediction.version,predictionFingerprint:prediction.fingerprint,requestId,label:review.label,explanation:review.explanation?.trim()??'',reasonCode:review.reasonCode,...(row.context?{contextId:row.context.contextId}:{})};
+}
+
+/** Host chooses an authenticated same-origin BFF; storage mode never changes UI semantics. */
+export function createPublicationClient(scope:PublicationScope,request:(operation:string,payload:Record<string,unknown>,scope:Readonly<PublicationScope>)=>Promise<PublicationEnvelope&Record<string,unknown>>,currentScope:()=>PublicationScope|null){
+ const pinned=Object.freeze({accountId:scope.accountId,publicationId:scope.publicationId,bindingRevision:scope.bindingRevision});
+ const key=publicationScopeKey(pinned);
+ const assertSelected=()=>{const current=currentScope();if(!current||publicationScopeKey(current)!==key)throw new Error('Publication account selection changed; refresh context');};
+ const command=async(operation:string,payload:Record<string,unknown>)=>{
+  assertSelected();
+  if('bindingRevision' in payload&&payload.bindingRevision!==pinned.bindingRevision)throw new Error('Publication binding changed; refresh context');
+  const value=await request(operation,payload,pinned);
+  assertSelected();
+  if(value.contractVersion!=='cyclotron-publication/v1'||publicationScopeKey(value)!==key)throw new Error('Publication response contract mismatch');
+  return value;
+ };
+ return {scope:pinned,cacheKey:key,command,status:async()=>await command('status',{}) as PublicationStatus,history:async()=>await command('history',{}) as PublicationHistory,
+  review:async(payload:PublicationReviewPayload)=>command('review',payload),
+  steer:async(payload:PublicationSteeringPayload)=>command('steer',payload),replayRecords:async()=>command('replay',{})};
+}

package/package.json

@@ -88,6 +88,7 @@
     "./components/newsroom-assignments-view": "./components/newsroom-assignments-view.tsx",
     "./components/newsroom-board-view": "./components/newsroom-board-view.tsx",
     "./components/newsroom-client-shell": "./components/newsroom-client-shell.tsx",
+    "./components/newsroom-curation-provider": "./components/newsroom-curation-provider.tsx",
     "./components/newsroom-ops-overview": "./components/newsroom-ops-overview.tsx",
     "./components/newsroom-ops-shell": "./components/newsroom-ops-shell.tsx",
     "./components/newsroom-organizer-shell": "./components/newsroom-organizer-shell.tsx",
@@ -98,11 +99,15 @@
     "./components/presentation-footer": "./components/presentation-footer.tsx",
     "./components/presentation-header": "./components/presentation-header.tsx",
     "./components/presentation-rhythm-hrule": "./components/presentation-rhythm-hrule.tsx",
+    "./components/priming-proof-page": "./components/priming-proof-page.tsx",
+    "./components/publication-cyclotron-panel": "./components/publication-cyclotron-panel.tsx",
     "./components/reader-auth-control": "./components/reader-auth-control.tsx",
     "./components/reader-auth-state": "./components/reader-auth-state.ts",
     "./components/reader-settings": "./components/reader-settings.ts",
     "./components/reader-theme-control": "./components/reader-theme-control.tsx",
+    "./components/reference-curation-controls": "./components/reference-curation-controls.tsx",
     "./components/reference-cyclotron-status": "./components/reference-cyclotron-status.tsx",
+    "./components/reference-priming": "./components/reference-priming.tsx",
     "./components/reference-relevance-review": "./components/reference-relevance-review.tsx",
     "./components/reference-source-preview": "./components/reference-source-preview.tsx",
     "./components/settings-page": "./components/settings-page.tsx",
@@ -135,6 +140,7 @@
     "./lib/amplify-outputs-guard": "./lib/amplify-outputs-guard.ts",
     "./lib/amplify-outputs-path": "./lib/amplify-outputs-path.ts",
     "./lib/amplify-server-runtime": "./lib/amplify-server-runtime.ts",
+    "./lib/approved-priming-proof-reports": "./lib/approved-priming-proof-reports.ts",
     "./lib/archive-data": "./lib/archive-data.ts",
     "./lib/archive-types": "./lib/archive-types.ts",
     "./lib/articles": "./lib/articles.ts",
@@ -153,6 +159,7 @@
     "./lib/content-repository": "./lib/content-repository.ts",
     "./lib/content-source-context": "./lib/content-source-context.ts",
     "./lib/content-types": "./lib/content-types.ts",
+    "./lib/curation-client": "./lib/curation-client.ts",
     "./lib/define-site": "./lib/define-site.ts",
     "./lib/demo-amplify-outputs": "./lib/demo-amplify-outputs.ts",
     "./lib/dev-sandbox-editor-auth": "./lib/dev-sandbox-editor-auth.ts",
@@ -200,7 +207,10 @@
     "./lib/plugin-settings": "./lib/plugin-settings.ts",
     "./lib/presentation-footer": "./lib/presentation-footer.ts",
     "./lib/pretext-layout": "./lib/pretext-layout.ts",
+    "./lib/priming-proof-report": "./lib/priming-proof-report.ts",
+    "./lib/prospectus-site-identity": "./lib/prospectus-site-identity.ts",
     "./lib/public-placeholder-config": "./lib/public-placeholder-config.ts",
+    "./lib/publication-cyclotron": "./lib/publication-cyclotron.ts",
     "./lib/publication-items": "./lib/publication-items.ts",
     "./lib/rate-limit-retry": "./lib/rate-limit-retry.ts",
     "./lib/reader-base-path": "./lib/reader-base-path.ts",
@@ -253,10 +263,12 @@
     "./app/[year]/[month]/[day]/page/[pageNumber]/page": "./app/[year]/[month]/[day]/page/[pageNumber]/page.tsx",
     "./app/[year]/[month]/[day]/section/[sectionKey]/page": "./app/[year]/[month]/[day]/section/[sectionKey]/page.tsx",
     "./app/api/archive/editions/route": "./app/api/archive/editions/route.ts",
+    "./app/api/cyclotron/priming-proof/route": "./app/api/cyclotron/priming-proof/route.ts",
     "./app/api/media/[...path]/route": "./app/api/media/[...path]/route.ts",
     "./app/api/revalidate/route": "./app/api/revalidate/route.ts",
     "./app/archive/page": "./app/archive/page.tsx",
     "./app/articles/[slug]/page": "./app/articles/[slug]/page.tsx",
+    "./app/cyclotron/page": "./app/cyclotron/page.tsx",
     "./app/layout": "./app/layout.tsx",
     "./app/newsroom/[section]/[...selection]/page": "./app/newsroom/[section]/[...selection]/page.tsx",
     "./app/newsroom/[section]/page": "./app/newsroom/[section]/page.tsx",
@@ -319,18 +331,22 @@
       "optional": true
     }
   },
-  "version": "1.0.0-next.60",
+  "version": "1.0.0-next.62",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
+    "@aws-crypto/sha256-js": "5.2.0",
     "@aws-sdk/client-cognito-identity-provider": "3.1045.0",
     "@aws-sdk/client-lambda": "^3.1045.0",
     "@aws-sdk/client-s3": "^3.1045.0",
     "@aws-sdk/client-ssm": "^3.1045.0",
+    "@aws-sdk/credential-provider-node": "3.972.84",
     "@aws-sdk/s3-request-presigner": "^3.1045.0",
     "@base-ui/react": "^1.5.0",
     "@chenglou/pretext": "^0.0.7",
     "@kanbus/ui": "https://github.com/AnthusAI/Kanbus/releases/download/ui-v0.2.0/kanbus-ui-0.2.0.tgz",
     "@radix-ui/colors": "3.0.0",
+    "@smithy/protocol-http": "5.4.1",
+    "@smithy/signature-v4": "5.7.4",
     "@streamdown/cjk": "^1.0.3",
     "@streamdown/code": "^1.1.1",
     "@streamdown/math": "^1.0.2",
@@ -339,10 +355,11 @@
     "ai": "^6.0.191",
     "anthus-vultus": "github:AnthusAI/Vultus#af98d57",
     "aws-amplify": "^6.17.0",
+    "aws-jwt-verify": "4.0.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-    "cyclotron": "https://github.com/AnthusAI/Cyclotron/releases/download/ui-v0.2.1/cyclotron-0.2.1.tgz",
+    "cyclotron": "https://github.com/AnthusAI/Cyclotron/releases/download/ui-v0.2.2/cyclotron-0.2.2.tgz",
     "esbuild": "^0.28.2",
     "gray-matter": "^4.0.3",
     "gsap": "^3.15.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.0.0-next.60",
+  "version": "1.0.0-next.62",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",
@@ -66,6 +66,14 @@
         "revalidate": "60"
       }
     },
+    {
+      "file": "app/api/cyclotron/priming-proof/route.ts",
+      "hasDefault": false,
+      "exports": [
+        "GET"
+      ],
+      "config": {}
+    },
     {
       "file": "app/api/media/[...path]/route.ts",
       "hasDefault": false,
@@ -107,6 +115,14 @@
         "revalidate": "60"
       }
     },
+    {
+      "file": "app/cyclotron/page.tsx",
+      "hasDefault": true,
+      "exports": [
+        "metadata"
+      ],
+      "config": {}
+    },
     {
       "file": "app/layout.tsx",
       "hasDefault": true,