@anthusai/papyrus 1.0.0-next.61 → 1.0.0-next.63

package/amplify/data/resource.js

@@ -893,9 +893,11 @@ const schema = a.schema({
         createdAt: a.datetime().required(),
         updatedAt: a.datetime().required(),
         newsroomFeedKey: a.string(),
+        itemLineageId: a.id(),
     })
         .secondaryIndexes((index) => [
         index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+        index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
         index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
         index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
         index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1632,6 +1634,7 @@ const schema = a.schema({
         type: a.string().required(),
         status: a.string().required(),
         typeStatus: a.string().required(),
+        stage: a.string(),
         slug: a.string().required(),
         shortSlug: a.string(),
         section: a.string(),
@@ -1663,6 +1666,7 @@ const schema = a.schema({
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
         index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+        index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),

package/amplify/data/resource.ts

@@ -970,9 +970,11 @@ const schema = a.schema({
       createdAt: a.datetime().required(),
       updatedAt: a.datetime().required(),
       newsroomFeedKey: a.string(),
+      itemLineageId: a.id(),
     })
     .secondaryIndexes((index) => [
       index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+      index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
       index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
       index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
       index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1733,6 +1735,7 @@ const schema = a.schema({
       type: a.string().required(),
       status: a.string().required(),
       typeStatus: a.string().required(),
+      stage: a.string(),
       slug: a.string().required(),
       shortSlug: a.string(),
       section: a.string(),
@@ -1764,6 +1767,7 @@ const schema = a.schema({
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
       index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+      index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),

package/amplify/data/schema.js

@@ -799,9 +799,11 @@ const baseDefinitions = {
         createdAt: a.datetime().required(),
         updatedAt: a.datetime().required(),
         newsroomFeedKey: a.string(),
+        itemLineageId: a.id(),
     })
         .secondaryIndexes((index) => [
         index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+        index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
         index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
         index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
         index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1511,6 +1513,7 @@ const baseDefinitions = {
         changeReason: a.string(),
         contentHash: a.string(),
         type: a.string().required(),
+        stage: a.string(),
         status: a.string().required(),
         typeStatus: a.string().required(),
         slug: a.string().required(),
@@ -1544,6 +1547,7 @@ const baseDefinitions = {
         index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
         index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
         index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+        index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
         .authorization((allow) => [
         allow.groups(contentWriteGroups),

package/amplify/data/schema.ts

@@ -870,9 +870,11 @@ const baseDefinitions = {
       createdAt: a.datetime().required(),
       updatedAt: a.datetime().required(),
       newsroomFeedKey: a.string(),
+      itemLineageId: a.id(),
     })
     .secondaryIndexes((index) => [
       index("newsroomFeedKey").sortKeys(["createdAt"]).queryField("listAssignmentsByNewsroomFeedAndCreatedAt"),
+      index("itemLineageId").sortKeys(["createdAt"]).queryField("listAssignmentsByItemLineageAndCreatedAt"),
       index("queueStatusKey").sortKeys(["priority", "createdAt"]).queryField("listAssignmentsByQueueStatusAndPriority"),
       index("assignmentTypeKey").sortKeys(["status", "createdAt"]).queryField("listAssignmentsByTypeStatusAndCreatedAt"),
       index("status").sortKeys(["updatedAt"]).queryField("listAssignmentsByStatusAndUpdatedAt"),
@@ -1606,6 +1608,7 @@ const baseDefinitions = {
       changeReason: a.string(),
       contentHash: a.string(),
       type: a.string().required(),
+      stage: a.string(),
       status: a.string().required(),
       typeStatus: a.string().required(),
       slug: a.string().required(),
@@ -1639,6 +1642,7 @@ const baseDefinitions = {
       index("typeStatus").sortKeys(["publishedAt"]).queryField("listItemsByTypeStatusAndPublishedAt"),
       index("sectionStatus").sortKeys(["publishedAt"]).queryField("listItemsBySectionStatusAndPublishedAt"),
       index("versionState").sortKeys(["updatedAt"]).queryField("listItemsByVersionStateAndUpdatedAt"),
+      index("stage").sortKeys(["updatedAt"]).queryField("listItemsByStageAndUpdatedAt"),
     ])
     .authorization((allow) => [
       allow.groups(contentWriteGroups),

package/app/api/cyclotron/priming-proof/route.ts

@@ -0,0 +1,11 @@
+import { NextResponse } from "next/server";
+import { approvedPrimingProofReport } from "../../../../lib/priming-proof-report";
+import { SITE_BRAND } from "../../../../lib/site-brand";
+
+export function GET() {
+  const report = approvedPrimingProofReport(SITE_BRAND.id);
+  if (report === null) {
+    return NextResponse.json({ error: "No approved priming proof report for this publication yet." }, { status: 404 });
+  }
+  return NextResponse.json(report);
+}

package/app/cyclotron/page.tsx

@@ -0,0 +1,13 @@
+import type { Metadata } from "next";
+import { PrimingProofPage } from "../../components/priming-proof-page";
+import { approvedPrimingProofReport } from "../../lib/priming-proof-report";
+import { SITE_BRAND } from "../../lib/site-brand";
+
+export const metadata: Metadata = {
+  title: `Cyclotron proof | ${SITE_BRAND.articleTitleSuffix}`,
+  description: "How often the relevance classifier agrees with editors on a fixed held-out set, before and after editor labels.",
+};
+
+export default function CyclotronProof() {
+  return <PrimingProofPage report={approvedPrimingProofReport(SITE_BRAND.id)} />;
+}

package/components/news-desk-taxonomy-client.ts

@@ -39,6 +39,7 @@ import type {
   UserDirectoryEntry,
 } from "../lib/category-repository";
 import { relationTypeKey } from "../lib/semantic-graph";
+import { CONTENT_ITEM_STAGES, type ContentItemVersionRecord } from "../lib/content-item-lifecycle";
 import { DOCTRINE_DEFINITIONS, getCategoryDoctrineDefinitions, type DoctrineCategory } from "../lib/doctrine";
 import { configureAmplifyClient } from "./amplify-client-provider";
 import { isUnauthenticatedError, loadReaderSessionSnapshot, type ReaderAuthSnapshot } from "./reader-auth-state";
@@ -253,7 +254,7 @@ const UPDATE_MESSAGE_MUTATION = `
 const NEWSROOM_ASSIGNMENT_FEED_QUERY = `
   query ListAssignmentsByNewsroomFeedAndCreatedAt($newsroomFeedKey: String!, $sortDirection: ModelSortDirection, $limit: Int, $nextToken: String, $filter: ModelAssignmentFilterInput) {
     listAssignmentsByNewsroomFeedAndCreatedAt(newsroomFeedKey: $newsroomFeedKey, sortDirection: $sortDirection, limit: $limit, nextToken: $nextToken, filter: $filter) {
-      items { id assignmentTypeKey queueKey queueStatusKey status priority title summary assigneeType assigneeId assigneeKey claimedAt claimExpiresAt completedAt canceledAt corpusId categorySetId classifierId sectionId sectionKey sectionType sectionStatusKey sectionQueueStatusKey primaryFocusCategoryKey topicScopeCategoryKeys sourceSnapshotId importRunId createdBy createdAt updatedAt newsroomFeedKey }
+      items { id assignmentTypeKey queueKey queueStatusKey status priority title summary assigneeType assigneeId assigneeKey claimedAt claimExpiresAt completedAt canceledAt corpusId categorySetId classifierId sectionId sectionKey sectionType sectionStatusKey sectionQueueStatusKey primaryFocusCategoryKey topicScopeCategoryKeys sourceSnapshotId importRunId createdBy createdAt updatedAt newsroomFeedKey itemLineageId }
       nextToken
     }
   }
@@ -2157,6 +2158,41 @@ export async function loadNewsroomAssignmentPage(options: NewsroomAssignmentPage
   });
 }
 
+const CONTENT_ITEMS_BY_STAGE_QUERY = `
+  query ListItemsByStageAndUpdatedAt($stage: String!, $sortDirection: ModelSortDirection, $limit: Int, $nextToken: String) {
+    listItemsByStageAndUpdatedAt(stage: $stage, sortDirection: $sortDirection, limit: $limit, nextToken: $nextToken) {
+      items { id lineageId versionNumber stage type status title headline slug section updatedAt }
+      nextToken
+    }
+  }
+`;
+
+export async function loadNewsroomContentItemVersions(): Promise<ContentItemVersionRecord[]> {
+  configureAmplifyClient();
+  const client = generateClient<Schema>() as unknown as {
+    graphql: (options: Record<string, unknown>) => Promise<GraphQLConnectionResponse<ContentItemVersionRecord>>;
+  };
+  const field = "listItemsByStageAndUpdatedAt";
+  const versionsPerStage = await Promise.all(CONTENT_ITEM_STAGES.map(async (stage) => {
+    const versions: ContentItemVersionRecord[] = [];
+    let nextToken: string | null = null;
+    do {
+      const response: GraphQLConnectionResponse<ContentItemVersionRecord> = await client.graphql({
+        query: CONTENT_ITEMS_BY_STAGE_QUERY,
+        variables: { stage, sortDirection: "DESC", limit: NEWSROOM_PAGE_LIMIT, nextToken },
+        authMode: USER_POOL_AUTH_MODE,
+      });
+      assertNoGraphQLErrors(response.errors);
+      const connection = response.data?.[field];
+      if (!connection) throw new Error(`Missing GraphQL connection payload for ${field}.`);
+      versions.push(...((connection.items ?? []).filter(Boolean) as ContentItemVersionRecord[]));
+      nextToken = connection.nextToken ?? null;
+    } while (nextToken);
+    return versions;
+  }));
+  return versionsPerStage.flat();
+}
+
 export async function loadModelPayloadsForOwner(
   ownerKind: string,
   ownerId: string,

package/components/newsroom-board-view.tsx

@@ -6,10 +6,9 @@ import { IssueCollection, IssueDetailPanel, IssueTypeFilter, issueTypeFromFilter
 import "@kanbus/ui/styles/kanban.css";
 import "./newsroom-newsprint-board.css";
 import { canReadNewsroomBoard, newsroomBoardConfig, projectNewsroomBoard, type NativeBoardIssue } from "../lib/newsroom-board";
-import { resolveArticlesBackend } from "../lib/newsroom-articles";
-import { SITE_BRAND } from "../lib/site-brand";
+import { getContentItemName, SITE_BRAND } from "../lib/site-brand";
 import { getNewsroomNavHref } from "../lib/newsroom-nav";
-import { loadNewsroomAssignmentPage, loadNewsroomReferencePage } from "./news-desk-taxonomy-client";
+import { loadNewsroomAssignmentPage, loadNewsroomContentItemVersions, loadNewsroomReferencePage } from "./news-desk-taxonomy-client";
 import { useOptionalNewsDeskClient } from "./news-desk-client-provider";
 import { NewsDeskAccessGate } from "./newsroom-access-gate";
 import { NewsroomOpsShell, NewsroomOpsStatusBanner } from "./newsroom-ops-shell";
@@ -45,12 +44,12 @@ export function NewsroomBoardView() {
     if (!allowed) { setLoading(false); return; }
     setLoading(true); busy.current = true;
     Promise.all([
-      resolveArticlesBackend(false).listRows(),
+      loadNewsroomContentItemVersions(),
       loadNewsroomReferencePage({ limit: 50 }),
       loadNewsroomAssignmentPage({ limit: 50 }),
-    ]).then(([articles, references, assignments]) => {
+    ]).then(([contentItemVersions, references, assignments]) => {
       if (generation.current !== request) return;
-      setIssues(projectNewsroomBoard({ articles, references: references.items, assignments: assignments.items }));
+      setIssues(projectNewsroomBoard({ contentItemVersions, references: references.items, assignments: assignments.items }));
       setTokens({ reference: references.nextToken, assignment: assignments.nextToken });
     }).catch((reason: unknown) => {
       if (generation.current === request) setError(reason instanceof Error ? reason.message : "Could not load newsroom records.");
@@ -81,7 +80,7 @@ export function NewsroomBoardView() {
         <IssueTypeFilter config={config} value={filter} onChange={value => { setFilter(value); setSelected(null); }} name="Record type" />
         <div role="group" aria-label="Record presentation"><button type="button" aria-pressed={view === "board"} onClick={() => setView("board")}>Board</button><button type="button" aria-pressed={view === "list"} onClick={() => setView("list")}>List</button><button type="button" disabled={loading} onClick={() => setRevision(current => current + 1)}>Refresh records</button></div>
       </div>
-      <p className="organizer-board-note">Native CMS records and statuses. Open a record to use its existing editor or workflow controls. Story linking is not configured.</p>
+      <p className="organizer-board-note">{`Each ${getContentItemName().singular.toLowerCase()} appears once, in the column for its stage. Open a record to use its existing editor or workflow controls.`}</p>
       {error && <NewsroomOpsStatusBanner tone="error">{error}</NewsroomOpsStatusBanner>}
       <p role="status" className="organizer-board-note">{loading ? "Loading records…" : `${issues.length} records loaded. References and assignments load in pages.`}</p>
       <div className="organizer-board-body" data-detail-open={Boolean(issue)}>
@@ -91,7 +90,7 @@ export function NewsroomBoardView() {
           selectedIssueId={selected} detailOpen={Boolean(issue)} onSelectIssue={item => setSelected(item.id)} ariaLabel="Newsroom records"
           emptyMessage={loading ? "Loading records…" : error ? "Records could not be loaded." : "No records in this selection."} />
         {issue && <IssueDetailPanel issue={issue} onClose={() => setSelected(null)} fields={[{ label: "CMS record ID", value: issue.nativeId }, { label: "Status", value: issue.nativeStatus }]}>
-          <Link href={getNewsroomNavHref(issue.href)}>Open {issue.type} workspace</Link>
+          <Link href={getNewsroomNavHref(issue.href)}>Open {issue.type}</Link>
         </IssueDetailPanel>}
       </div>
       <div className="organizer-board-pages">{tokens.reference && <button disabled={loading} type="button" onClick={() => void loadMore("reference")}>Load more references</button>}{tokens.assignment && <button disabled={loading} type="button" onClick={() => void loadMore("assignment")}>Load more assignments</button>}</div>

package/components/priming-proof-page.tsx

@@ -0,0 +1,94 @@
+import {
+  formatProofPercentage,
+  primingProofHeadline,
+  type PrimingProofReport,
+} from "../lib/priming-proof-report";
+
+function ProofMethod({ heldOutSize, teachingSource }: { heldOutSize: number | null; teachingSource: string | null }) {
+  return (
+    <section aria-labelledby="priming-proof-method" className="space-y-2 text-sm leading-relaxed">
+      <h2 id="priming-proof-method" className="text-base font-semibold uppercase tracking-wide">How the number is made</h2>
+      <p>
+        Editors already decided which candidate sources belong in this publication. A fixed, balanced sample of those
+        decisions{heldOutSize === null ? "" : ` (${heldOutSize} sources)`} is frozen as the held-out set and never used
+        for teaching. A classifier that always gives the same answer agrees on half of it.
+      </p>
+      <p>
+        Editors teach the classifier with labels: their other reviews of candidate sources, and sources they paste,
+        check after Papyrus extracts them, and mark publish or reject.
+        {teachingSource === null ? "" : ` This run taught from ${teachingSource}.`} Each point below starts a fresh
+        classifier that sees only the first N of those labels, then decides
+        every held-out source once. Nothing else changes between points: the same decision model, the publication&apos;s
+        mission and policies as the only rubric, and no automatic rubric rewriting.
+      </p>
+    </section>
+  );
+}
+
+export function PrimingProofPage({ report }: { report: PrimingProofReport | null }) {
+  if (report === null) {
+    return (
+      <main className="mx-auto max-w-3xl space-y-6 px-4 py-10" data-priming-proof="pending">
+        <header className="space-y-2 border-b pb-4">
+          <h1 className="text-3xl font-bold">Does teaching the classifier work?</h1>
+          <p className="text-muted-foreground">No approved proof run has been published for this publication yet.</p>
+        </header>
+        <ProofMethod heldOutSize={null} teachingSource={null} />
+      </main>
+    );
+  }
+  const { baseline, latest, agreementChangeInPoints } = primingProofHeadline(report);
+  const [positiveLabel, negativeLabel] = [report.positiveLabel, report.labels.find((label) => label !== report.positiveLabel)];
+  return (
+    <main className="mx-auto max-w-3xl space-y-8 px-4 py-10" data-priming-proof="published">
+      <header className="space-y-3 border-b pb-4">
+        <h1 className="text-3xl font-bold">Does teaching the classifier work?</h1>
+        <p className="text-lg" data-priming-proof-headline>
+          Agreement with editors went from <strong>{formatProofPercentage(baseline.agreement)}</strong> with no labels to{" "}
+          <strong>{formatProofPercentage(latest.agreement)}</strong> after {latest.labels} labels
+          {agreementChangeInPoints === null ? "" : ` (${agreementChangeInPoints >= 0 ? "+" : ""}${agreementChangeInPoints} points)`}.
+        </p>
+        <p className="text-sm text-muted-foreground">
+          {report.publication} · question: “{report.question}” · held-out set of {report.heldOut.size} sources frozen{" "}
+          {report.heldOut.frozenAt.slice(0, 10)} · run {report.ranAt.slice(0, 10)}
+          {report.decisionModel ? ` · decision model ${report.decisionModel}` : ""}
+        </p>
+      </header>
+      <section aria-labelledby="priming-proof-points" className="space-y-2">
+        <h2 id="priming-proof-points" className="text-base font-semibold uppercase tracking-wide">Before and after</h2>
+        <div className="overflow-x-auto">
+          <table className="w-full text-left text-sm tabular-nums">
+            <thead>
+              <tr className="border-b">
+                <th scope="col" className="py-2 pr-4">Editor labels</th>
+                <th scope="col" className="py-2 pr-4">Agreement</th>
+                <th scope="col" className="py-2 pr-4">Precision ({positiveLabel})</th>
+                <th scope="col" className="py-2 pr-4">Recall ({positiveLabel})</th>
+                <th scope="col" className="py-2">Labels used</th>
+              </tr>
+            </thead>
+            <tbody>
+              {report.points.map((point) => (
+                <tr key={point.labels} className="border-b" data-priming-proof-point={point.labels}>
+                  <td className="py-2 pr-4">{point.labels}</td>
+                  <td className="py-2 pr-4">{formatProofPercentage(point.agreement)}</td>
+                  <td className="py-2 pr-4">{formatProofPercentage(point.precision)}</td>
+                  <td className="py-2 pr-4">{formatProofPercentage(point.recall)}</td>
+                  <td className="py-2">
+                    {point.labelsByClass[positiveLabel] ?? 0} {positiveLabel}
+                    {negativeLabel ? `, ${point.labelsByClass[negativeLabel] ?? 0} ${negativeLabel}` : ""}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      </section>
+      <ProofMethod heldOutSize={report.heldOut.size} teachingSource={report.priming.source} />
+      <p className="break-all text-xs text-muted-foreground">
+        Held-out fingerprint {report.heldOut.fingerprint}
+        {report.priming.fingerprint ? ` · labels fingerprint ${report.priming.fingerprint}` : ""}
+      </p>
+    </main>
+  );
+}

package/components/topic-steering-workspace.tsx

@@ -15042,6 +15042,9 @@ function buildUiCopywritingAssignment({ actorLabel, assignment, decision, messag
   message: MessageRecord;
   now: string;
 }): AssignmentRecord {
+  if (!assignment.itemLineageId) {
+    throw new Error(`Assignment ${assignment.id} has no content item lineage; copywriting must continue the same content item.`);
+  }
   const type = decision === "brief" ? "brief" : "article";
   const assignmentTypeKey = type === "brief" ? "copywriting.brief-draft" : "copywriting.article-draft";
   const section = assignment.sectionKey ?? assignment.sectionId ?? "unsectioned";
@@ -15094,6 +15097,7 @@ function buildUiCopywritingAssignment({ actorLabel, assignment, decision, messag
     createdAt: now,
     updatedAt: now,
     newsroomFeedKey: "assignment#open",
+    itemLineageId: assignment.itemLineageId,
     metadata,
   };
 }

package/infra/amplify-app-shell.js

@@ -3,7 +3,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -85,6 +85,17 @@ export class AmplifyAppShellStack extends Stack {
                 ],
             }));
         }
+        const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+        const prospectusEnvironment = prospectusAccountsApiStageArn
+            ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+            : {};
+        if (prospectusAccountsApiStageArn) {
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "InvokeProspectusAccountsAsRegisteredSite",
+                actions: ["execute-api:Invoke"],
+                resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+            }));
+        }
         const cmsApp = new amplify.CfnApp(this, "App", {
             name: cmsAppName,
             description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -134,6 +145,7 @@ export class AmplifyAppShellStack extends Stack {
                 SITE_ENV: "production",
                 PAPYRUS_CONTENT_SOURCE: "published",
                 ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+                ...prospectusEnvironment,
             }),
         });
         let stagingBranch;
@@ -153,6 +165,7 @@ export class AmplifyAppShellStack extends Stack {
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",
                     ...stagingMode,
+                    ...prospectusEnvironment,
                     NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
                         ? `https://${stagingDomainName}`
                         : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
@@ -191,6 +204,10 @@ export class AmplifyAppShellStack extends Stack {
         this.cmsAppId = cmsApp.attrAppId;
         new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
         new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+        new CfnOutput(this, "CmsComputeRoleArn", {
+            value: computeRole.roleArn,
+            description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+        });
         if (stagingEnabled) {
             new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
         }

package/infra/amplify-app-shell.ts

@@ -4,7 +4,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -96,6 +96,20 @@ export class AmplifyAppShellStack extends Stack {
       );
     }
 
+    const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
+    const prospectusEnvironment = prospectusAccountsApiStageArn
+      ? { PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) }
+      : {};
+    if (prospectusAccountsApiStageArn) {
+      computeRole.addToPolicy(
+        new iam.PolicyStatement({
+          sid: "InvokeProspectusAccountsAsRegisteredSite",
+          actions: ["execute-api:Invoke"],
+          resources: PROSPECTUS_PAPYRUS_SITE_ROUTES.map((route) => `${prospectusAccountsApiStageArn}/${route}`),
+        }),
+      );
+    }
+
     const cmsApp = new amplify.CfnApp(this, "App", {
       name: cmsAppName,
       description: `Papyrus newsroom CMS for ${config.siteId} (WEB_COMPUTE)`,
@@ -148,6 +162,7 @@ export class AmplifyAppShellStack extends Stack {
         SITE_ENV: "production",
         PAPYRUS_CONTENT_SOURCE: "published",
         ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
+        ...prospectusEnvironment,
       }),
     });
 
@@ -168,6 +183,7 @@ export class AmplifyAppShellStack extends Stack {
           PAPYRUS_SITE_BRAND: config.brand,
           SITE_ENV: "staging",
           ...stagingMode,
+          ...prospectusEnvironment,
           NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
             ? `https://${stagingDomainName}`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]),
@@ -209,6 +225,10 @@ export class AmplifyAppShellStack extends Stack {
     this.cmsAppId = cmsApp.attrAppId;
     new CfnOutput(this, "CmsAppId", { value: cmsApp.attrAppId, description: `Amplify app id for ${cmsAppName}` });
     new CfnOutput(this, "CmsOrigin", { value: productionOrigin });
+    new CfnOutput(this, "CmsComputeRoleArn", {
+      value: computeRole.roleArn,
+      description: `SSR compute role for ${cmsAppName}; the roleArn of its Prospectus site registration`,
+    });
     if (stagingEnabled) {
       new CfnOutput(this, "StagingOrigin", { value: stagingOrigin });
     }

package/infra/site-config.js

@@ -16,7 +16,24 @@ const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+/** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
+export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
+    "GET/v1/identities/me",
+    "POST/v1/identities/google/challenge",
+    "POST/v1/identities/google/resolve",
+    "GET/v1/accounts",
+    "GET/v1/accounts/*",
+    "POST/v1/accounts/*/authorize",
+    "GET/v1/account-directory",
+    "GET/v1/account-directory/*",
+];
+export function resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn) {
+    const [, , , region, , apiPath] = prospectusAccountsApiStageArn.split(":");
+    const [apiId, stageName] = apiPath.split("/");
+    return `https://${apiId}.execute-api.${region}.amazonaws.com/${stageName}/`;
+}
 function originOfRedirectUrl(value) {
     try {
         return new URL(value).origin;
@@ -181,7 +198,7 @@ function parseStagingPreview(value) {
 }
 function parseCms(value) {
     const cmsRecord = requireObject(value, "cms");
-    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview"], "cms");
+    rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
     const buildComputeType = cmsRecord.buildComputeType;
     if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
         fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -205,6 +222,7 @@ function parseCms(value) {
         stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
         redirects: parseRedirects(cmsRecord.redirects),
         stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
+        prospectusAccountsApiStageArn: optionalString(cmsRecord.prospectusAccountsApiStageArn, "cms.prospectusAccountsApiStageArn", PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN, "arn:aws:execute-api:<region>:<account>:<api id>/api"),
     };
     const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
     if (reservedWord) {
@@ -212,7 +230,7 @@ function parseCms(value) {
     }
     for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
         if (key in cms.environment) {
-            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
+            fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
         }
     }
     if (cms.staging === false && cms.stagingDomainName) {

package/infra/site-config.ts

@@ -41,6 +41,7 @@ export type CmsConfig = {
   stagingDomainName?: string;
   stagingDomainPrefix?: string;
   redirects?: CmsRedirect[];
+  prospectusAccountsApiStageArn?: string;
 };
 
 export type AmplifyAppShellSiteConfig = {
@@ -95,7 +96,26 @@ const GITHUB_OWNER_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}
 const GITHUB_REPO_PATTERN = /^[A-Za-z0-9_.-]+$/;
 const COGNITO_DOMAIN_PREFIX_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const COGNITO_RESERVED_WORDS = ["aws", "amazon", "cognito"];
-const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER"];
+const PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN = /^arn:aws:execute-api:[a-z0-9-]+:\d{12}:[a-z0-9]+\/api$/;
+const TEMPLATE_MANAGED_ENVIRONMENT_KEYS = ["PAPYRUS_COGNITO_DOMAIN_PREFIX", "PAPYRUS_APPLY_COGNITO_DOMAIN_PREFIX", "PAPYRUS_DISABLE_GOOGLE_OAUTH", "PAPYRUS_REVALIDATE_SECRET_PARAMETER", "PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT"];
+
+/** Routes Prospectus admits for a registered Papyrus site (Prospectus accounts/papyrus-sites.ts). */
+export const PROSPECTUS_PAPYRUS_SITE_ROUTES = [
+  "GET/v1/identities/me",
+  "POST/v1/identities/google/challenge",
+  "POST/v1/identities/google/resolve",
+  "GET/v1/accounts",
+  "GET/v1/accounts/*",
+  "POST/v1/accounts/*/authorize",
+  "GET/v1/account-directory",
+  "GET/v1/account-directory/*",
+];
+
+export function resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn: string): string {
+  const [, , , region, , apiPath] = prospectusAccountsApiStageArn.split(":");
+  const [apiId, stageName] = apiPath.split("/");
+  return `https://${apiId}.execute-api.${region}.amazonaws.com/${stageName}/`;
+}
 function originOfRedirectUrl(value: string): string {
   try {
     return new URL(value).origin;
@@ -259,7 +279,7 @@ function parseStagingPreview(value: unknown): StagingPreviewConfig | undefined {
 
 function parseCms(value: unknown): CmsConfig {
   const cmsRecord = requireObject(value, "cms");
-  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview"], "cms");
+  rejectUnknownKeys(cmsRecord, ["appName", "domainName", "staging", "cognitoDomainPrefix", "applyCognitoDomainPrefix", "buildComputeType", "environment", "stagingDomainName", "domainPrefix", "stagingDomainPrefix", "redirects", "stagingPreview", "prospectusAccountsApiStageArn"], "cms");
   const buildComputeType = cmsRecord.buildComputeType;
   if (buildComputeType !== undefined && buildComputeType !== "STANDARD" && buildComputeType !== "STANDARD_8GB") {
     fail("cms.buildComputeType", `must be "STANDARD" or "STANDARD_8GB", got ${JSON.stringify(buildComputeType)}`);
@@ -288,6 +308,12 @@ function parseCms(value: unknown): CmsConfig {
     stagingDomainPrefix: optionalString(cmsRecord.stagingDomainPrefix, "cms.stagingDomainPrefix", DOMAIN_PREFIX_PATTERN, "single DNS label"),
     redirects: parseRedirects(cmsRecord.redirects),
     stagingPreview: parseStagingPreview(cmsRecord.stagingPreview),
+    prospectusAccountsApiStageArn: optionalString(
+      cmsRecord.prospectusAccountsApiStageArn,
+      "cms.prospectusAccountsApiStageArn",
+      PROSPECTUS_ACCOUNTS_API_STAGE_ARN_PATTERN,
+      "arn:aws:execute-api:<region>:<account>:<api id>/api",
+    ),
   };
 
   const reservedWord = COGNITO_RESERVED_WORDS.find((word) => cms.cognitoDomainPrefix.includes(word));
@@ -296,7 +322,7 @@ function parseCms(value: unknown): CmsConfig {
   }
   for (const key of TEMPLATE_MANAGED_ENVIRONMENT_KEYS) {
     if (key in cms.environment) {
-      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix and the revalidation secret parameter is derived from siteId");
+      fail(`cms.environment.${key}`, "is managed by the template: Google sign-in is always on, the Cognito domain comes from cms.cognitoDomainPrefix, the revalidation secret parameter is derived from siteId and the Prospectus endpoint comes from cms.prospectusAccountsApiStageArn");
     }
   }
 

package/lib/approved-priming-proof-reports.ts

@@ -0,0 +1,6 @@
+/**
+ * Priming proof reports a publication owner approved for visitors, keyed by site brand id.
+ * A report reaches this map only through a reviewed commit of its
+ * `publications/priming-proofs/<brand id>.json` file; see docs/priming-proof.md.
+ */
+export const APPROVED_PRIMING_PROOF_REPORTS: Record<string, unknown> = {};

package/lib/category-repository.ts

@@ -494,6 +494,7 @@ export type AssignmentRecord = {
   createdAt: string;
   updatedAt: string;
   newsroomFeedKey?: string | null;
+  itemLineageId?: string | null;
   metadata?: unknown;
 };