@anthusai/papyrus 2.0.0-next.5 → 2.0.0-next.51

package/components/reference-cyclotron-priming.tsx

@@ -1,12 +1,12 @@
 "use client";
 
-import { useState } from "react";
+import { useId, useRef, useState, type KeyboardEvent } from "react";
 import { primingStateText, type PrimingRequestView } from "../lib/relevance-status";
 
 export type PrimingFormInput = { url: string; label: string; explanation: string };
 
 /**
- * A compact "Add a reference" form for a pasted URL. The page is read in the
+ * The "Paste a URL" option of the Add a reference area. The page is read in the
  * background and the outcome is shown beside each added reference.
  */
 export function ReferenceCyclotronPriming({
@@ -23,6 +23,19 @@ export function ReferenceCyclotronPriming({
   const [explanation, setExplanation] = useState("");
   const [message, setMessage] = useState<string | null>(null);
 
+  const ratingLabelId = useId();
+  const buttons = useRef<Array<HTMLButtonElement | null>>([]);
+
+  function moveSelection(event: KeyboardEvent<HTMLButtonElement>, index: number) {
+    const forward = event.key === "ArrowRight" || event.key === "ArrowDown";
+    const backward = event.key === "ArrowLeft" || event.key === "ArrowUp";
+    if (!forward && !backward) return;
+    event.preventDefault();
+    const next = (index + (forward ? 1 : -1) + labels.length) % labels.length;
+    setLabel(labels[next]);
+    buttons.current[next]?.focus();
+  }
+
   async function submit() {
     setMessage("Adding…");
     try {
@@ -36,16 +49,16 @@ export function ReferenceCyclotronPriming({
   }
 
   return (
-    <section aria-label="Add a reference" className="space-y-2 text-sm" data-reference-cyclotron-priming>
+    <div className="space-y-2 text-sm" data-reference-cyclotron-priming>
       <form
-        className="flex flex-wrap items-end gap-3"
+        className="flex flex-col gap-3"
         onSubmit={(event) => {
           event.preventDefault();
           void submit();
         }}
       >
-        <label className="flex min-w-64 flex-1 flex-col gap-1">
-          <span className="text-xs text-muted-foreground">Add a reference by URL</span>
+        <label className="flex flex-col gap-1">
+          <span className="text-xs text-muted-foreground">Web page address</span>
           <input
             aria-label="Reference URL"
             onChange={(event) => setUrl(event.target.value)}
@@ -55,20 +68,46 @@ export function ReferenceCyclotronPriming({
             value={url}
           />
         </label>
+        <div className="flex flex-col gap-1">
+          <span className="text-xs text-muted-foreground" id={ratingLabelId}>Should Papyrus include or exclude pages like this?</span>
+          <div aria-labelledby={ratingLabelId} className="flex flex-wrap gap-2" role="radiogroup">
+            {labels.map((choice, index) => {
+              const checked = choice === label;
+              return (
+                <button
+                  aria-checked={checked}
+                  className={`min-w-32 flex-1 rounded border px-4 py-3 text-base font-semibold capitalize ${checked ? "border-foreground bg-foreground text-background" : "border-border bg-transparent"}`}
+                  data-rating-choice={choice}
+                  key={choice}
+                  onClick={() => setLabel(choice)}
+                  onKeyDown={(event) => moveSelection(event, index)}
+                  ref={(node) => { buttons.current[index] = node; }}
+                  role="radio"
+                  tabIndex={checked || (!labels.includes(label) && index === 0) ? 0 : -1}
+                  type="button"
+                >
+                  {choice}
+                </button>
+              );
+            })}
+          </div>
+        </div>
         <label className="flex flex-col gap-1">
-          <span className="text-xs text-muted-foreground">Include or exclude</span>
-          <select aria-label="Include or exclude" onChange={(event) => setLabel(event.target.value)} value={label}>
-            {labels.map((choice) => (
-              <option key={choice} value={choice}>{choice}</option>
-            ))}
-          </select>
-        </label>
-        <label className="flex min-w-48 flex-1 flex-col gap-1">
-          <span className="text-xs text-muted-foreground">Why (optional)</span>
-          <input aria-label="Reason" onChange={(event) => setExplanation(event.target.value)} type="text" value={explanation} />
+          <span className="text-sm font-medium">Why?</span>
+          <textarea
+            aria-label="Reason"
+            className="w-full"
+            onChange={(event) => setExplanation(event.target.value)}
+            placeholder="Why? A sentence or two helps Papyrus learn what you want."
+            rows={4}
+            value={explanation}
+          />
+          <span className="text-xs text-muted-foreground">Optional, but a short reason helps Papyrus learn what you want.</span>
         </label>
-        <button className="cyclotron-review-secondary" type="submit">Add reference</button>
-        {message ? <p className="basis-full text-xs" role="status">{message}</p> : null}
+        <div>
+          <button className="cyclotron-review-secondary" type="submit">Add reference</button>
+        </div>
+        {message ? <p className="text-xs" role="status">{message}</p> : null}
       </form>
       {requests.length ? (
         <ul aria-label="Added references" className="space-y-1 text-xs text-muted-foreground">
@@ -79,6 +118,6 @@ export function ReferenceCyclotronPriming({
           ))}
         </ul>
       ) : null}
-    </section>
+    </div>
   );
 }

package/components/reference-cyclotron-suggestion.tsx

@@ -60,7 +60,7 @@ export function ReferenceSuggestionBlock({
     <section aria-label="Suggestion" className="space-y-2 border-y border-foreground py-3" data-reference-suggestion={referenceLineageId}>
       <h3 className="text-xs font-semibold uppercase tracking-wide text-foreground">Suggestion</h3>
       <p className="text-sm text-foreground">
-        The cyclotron suggests <span className="font-semibold">{decision.label}</span> ({suggestionConfidenceWords(decision)}).
+        Papyrus suggests <span className="font-semibold">{decision.label}</span> ({suggestionConfidenceWords(decision)}).
       </p>
       <p className="text-xs text-foreground" data-reference-suggestion-notice>
         A suggestion never changes the status until an editor acts. This reference is {statusLabel.toLowerCase()}.

package/components/reference-priming.tsx

@@ -1,18 +1,22 @@
 "use client";
 
-import { useState } from "react";
 import { PrimingPanel, type PrimingPanelProps } from "cyclotron/components/priming-panel";
-import { Button } from "./ui/button";
 
-/** Papyrus supplies its transport/configuration; Cyclotron owns preview and labels. */
+/**
+ * The "Import a file" option of the Add a reference area. Papyrus supplies the
+ * transport and configuration; Cyclotron owns the preview and label controls.
+ * It is only rendered by `ReferenceAddEntry`, never as a section of its own.
+ */
 export function ReferencePriming(props: PrimingPanelProps) {
-  const [open, setOpen] = useState(false);
   return (
-    <section className="shrink-0 space-y-3" aria-label="Representative reference examples">
-      <Button aria-expanded={open} onClick={() => setOpen((value) => !value)} variant="outline">
-        {open ? "Hide example references" : "Add example references (optional)"}
-      </Button>
-      {open ? <div className="max-h-[55dvh] space-y-3 overflow-y-auto pr-1"><p className="text-sm text-muted-foreground">Corrections to extracted content: describe what needs fixing, then enter the corrected title and abstract or summary. The note is saved with your correction; it does not automatically regenerate the content. Choose Publish / Not publish separately. An explanation of that judgment is optional.</p><PrimingPanel {...props} renderItem={props.renderItem ?? ((item) => <div className="space-y-2"><p className="whitespace-pre-wrap text-sm">{String(item.values.abstract ?? item.values.text ?? "")}</p><p className="break-all text-xs text-muted-foreground">{String(item.values.source_uri ?? "")}</p></div>)} /></div> : null}
-    </section>
+    <PrimingPanel
+      {...props}
+      renderItem={props.renderItem ?? ((item) => (
+        <div className="space-y-2">
+          <p className="whitespace-pre-wrap text-sm">{String(item.values.abstract ?? item.values.text ?? "")}</p>
+          <p className="break-all text-xs text-muted-foreground">{String(item.values.source_uri ?? "")}</p>
+        </div>
+      ))}
+    />
   );
 }

package/components/reference-section-suggestion.tsx

@@ -40,7 +40,7 @@ export function SectionSuggestionBlock({
     <section aria-label="Suggested Section" className="space-y-2 border-y border-foreground py-3" data-reference-section-suggestion={referenceLineageId}>
       <h3 className="text-xs font-semibold uppercase tracking-wide text-foreground">Suggested Section</h3>
       <p className="text-sm text-foreground">
-        The cyclotron suggests <span className="font-semibold">{titleOf(sections, suggestion.sectionId)}</span>
+        Papyrus suggests <span className="font-semibold">{titleOf(sections, suggestion.sectionId)}</span>
         {suggestion.confidence !== null ? ` (${formatPercentage(suggestion.confidence)})` : ""}.
       </p>
       {others.length ? (

package/components/topic-steering-workspace.tsx

@@ -14,6 +14,9 @@ import type { ReactNode, RefObject } from "react";
 import { useCallback, useEffect, useId, useLayoutEffect, useMemo, useRef, useState, useTransition } from "react";
 import amplifyOutputs from "papyrus-amplify-outputs";
 import { EditorialChecksAdminPanel } from "./editorial-checks-admin-panel";
+import { MonitoringPanel } from "./monitoring-panel";
+import { ModerationPanel } from "./moderation-panel";
+import { NewsletterPanel } from "./newsletter-panel";
 import { SignupEntriesPanel } from "./signup-entries-panel";
 import { pluginSettings, type PluginOutputs } from "../lib/plugin-settings";
 import { generateClient } from "aws-amplify/data";
@@ -89,6 +92,7 @@ import { ReferenceSourcePreview } from "./reference-source-preview";
 import type { ReaderAuthSnapshot } from "./reader-auth-state";
 import { NewsDeskAccessGate } from "./newsroom-access-gate";
 import { NewsroomOpsOverview } from "./newsroom-ops-overview";
+import { NewsroomCurationBootstrap } from "./newsroom-curation-bootstrap";
 import { NewsroomReferencesView } from "./newsroom-references-view";
 import { NewsroomAssignmentsView } from "./newsroom-assignments-view";
 import { NewsroomTopicsView } from "./newsroom-topics-view";
@@ -247,7 +251,7 @@ type AssignmentAction = "claim" | "release" | "complete" | "cancel" | "reopen" |
 type ReportingPacketReviewDecision = "select" | "merge" | "brief" | "hold" | "kill";
 type AssignmentDeskViewMode = "queue" | "budget";
 type UserRoleAction = "grant" | "revoke";
-type AdministrationPanel = "users" | "policies" | "sections" | "procedures" | "delegations" | "signups" | "editorial-checks";
+type AdministrationPanel = "users" | "policies" | "sections" | "procedures" | "delegations" | "signups" | "newsletter" | "moderation" | "editorial-checks" | "monitoring";
 export type NewsDeskTab = "overview" | "desks" | "topics" | "concepts" | "references" | "messages" | "assignments" | "administration" | "search";
 type LexicalRuleScope = "publication" | "corpus" | "classifier" | "category";
 type AnalysisReindexMode = "online-update" | "classifier-retrain" | "scoped-topic-rebuild" | "entity-graph-rebuild" | "generated-analysis-rebuild";
@@ -879,7 +883,7 @@ function NewsDeskDashboard({
   const [mergeSelection, setMergeSelection] = useState<MergeSelection | null>(null);
   const [isPending, startTransition] = useTransition();
   const controlsDisabled = isPending || !canEdit;
-  const initialAdministrationPanel = normalizeAdministrationPanel(initialSelection.panel);
+  const initialAdministrationPanel = normalizeAdministrationPanel(initialSelection.panel, Boolean(dashboard.isDemo));
   const [administrationPanel, setAdministrationPanel] = useState<AdministrationPanel>(initialAdministrationPanel);
   const [doctrineDrafts, setDoctrineDrafts] = useState<DoctrineEditorState>(() => buildDoctrineEditorState(dashboard.doctrineRecords));
   const [loadedSections, setLoadedSections] = useState<Record<string, boolean>>({
@@ -1120,8 +1124,8 @@ function NewsDeskDashboard({
   }, [dashboard.procedureDefinitions, dashboard.procedureRuns, dashboard.procedureVersions]);
 
   useEffect(() => {
-    setAdministrationPanel(normalizeAdministrationPanel(initialSelection.panel));
-  }, [initialSelection.panel]);
+    setAdministrationPanel(normalizeAdministrationPanel(initialSelection.panel, Boolean(dashboard.isDemo)));
+  }, [initialSelection.panel, dashboard.isDemo]);
 
   useEffect(() => {
     if (activeTab !== "administration") return;
@@ -3115,6 +3119,7 @@ function NewsDeskDashboard({
           />
         ) : null}
         {activeTab === "references" ? (
+          <NewsroomCurationBootstrap enabled={!dashboard.isDemo}>
           <NewsroomReferencesView
             demo={Boolean(dashboard.isDemo)}
             disabled={controlsDisabled}
@@ -3152,6 +3157,7 @@ function NewsDeskDashboard({
             referenceAttachments={referenceAttachments}
             references={references}
           />
+          </NewsroomCurationBootstrap>
         ) : null}
         {activeTab === "messages" ? (
           <MessagesDeskView
@@ -4318,17 +4324,24 @@ function AdministrationDeskView({
                 <strong>Agent delegations</strong>
                 <span>Let an agent curate References for you</span>
               </Link>
-              {editorialChecksPluginEnabled() ? (
-                <Link
-                  href={administrationPanelHref("editorial-checks", isDemo)}
-                  data-news-desk-admin-nav="editorial-checks"
-                  data-active={administrationPanel === "editorial-checks" || undefined}
-                  onClick={() => onPanelChange("editorial-checks")}
-                >
-                  <strong>Editorial checks</strong>
-                  <span>Policies the article editor checks drafts against</span>
-                </Link>
-              ) : null}
+              <Link
+                href={administrationPanelHref("editorial-checks", isDemo)}
+                data-news-desk-admin-nav="editorial-checks"
+                data-active={administrationPanel === "editorial-checks" || undefined}
+                onClick={() => onPanelChange("editorial-checks")}
+              >
+                <strong>Editorial checks</strong>
+                <span>Policies the article editor checks drafts against</span>
+              </Link>
+              <Link
+                href={administrationPanelHref("monitoring", isDemo)}
+                data-news-desk-admin-nav="monitoring"
+                data-active={administrationPanel === "monitoring" || undefined}
+                onClick={() => onPanelChange("monitoring")}
+              >
+                <strong>Monitoring</strong>
+                <span>The automated research pipeline, read only</span>
+              </Link>
               {signupPluginEnabled() ? (
                 <Link
                   href={administrationPanelHref("signups", isDemo)}
@@ -4340,10 +4353,35 @@ function AdministrationDeskView({
                   <span>Addresses from the site&apos;s signup forms</span>
                 </Link>
               ) : null}
+              {newsletterPluginEnabled(isDemo) ? (
+                <Link
+                  href={administrationPanelHref("newsletter", isDemo)}
+                  data-news-desk-admin-nav="newsletter"
+                  data-active={administrationPanel === "newsletter" || undefined}
+                  onClick={() => onPanelChange("newsletter")}
+                >
+                  <strong>Newsletter</strong>
+                  <span>Subscribers, issues and delivery for the site&apos;s email</span>
+                </Link>
+              ) : null}
+              {readerPluginEnabled() ? (
+                <Link
+                  href={administrationPanelHref("moderation", isDemo)}
+                  data-news-desk-admin-nav="moderation"
+                  data-active={administrationPanel === "moderation" || undefined}
+                  onClick={() => onPanelChange("moderation")}
+                >
+                  <strong>Moderation</strong>
+                  <span>Reader submissions and comments</span>
+                </Link>
+              ) : null}
             </nav>}
             <div className="news-desk-settings-panel">
               {administrationPanel === "signups" ? <SignupEntriesPanel /> : null}
+              {administrationPanel === "newsletter" ? <NewsletterPanel isAdmin={canManageUsers} isDemo={isDemo} /> : null}
+              {administrationPanel === "moderation" ? <ModerationPanel /> : null}
               {administrationPanel === "editorial-checks" ? <EditorialChecksAdminPanel /> : null}
+              {administrationPanel === "monitoring" ? <MonitoringPanel isAdmin={canManageUsers} isDemo={isDemo} /> : null}
               {administrationPanel === "delegations" ? <AdministrationDelegationsPanel disabled={disabled} /> : null}
               {administrationPanel === "users" ? (
                 <AdministrationUsersPanel
@@ -12807,14 +12845,20 @@ function signupPluginEnabled(): boolean {
   return pluginSettings(amplifyOutputs as PluginOutputs, "signup") !== null;
 }
 
-function editorialChecksPluginEnabled(): boolean {
-  return pluginSettings(amplifyOutputs as PluginOutputs, "editorial-checks") !== null;
+/** The Newsletter panel exists when the site enabled the plugin; `?demo=1` shows it with fixture data so it can be seen and tested. */
+function newsletterPluginEnabled(demo = false): boolean {
+  return demo || pluginSettings(amplifyOutputs as PluginOutputs, "newsletter") !== null;
+}
+
+function readerPluginEnabled(): boolean {
+  return pluginSettings(amplifyOutputs as PluginOutputs, "reader-steering") !== null;
 }
 
-function normalizeAdministrationPanel(value: string | null | undefined): AdministrationPanel {
-  if (value === "policies" || value === "sections" || value === "procedures" || value === "delegations") return value;
+function normalizeAdministrationPanel(value: string | null | undefined, demo = false): AdministrationPanel {
+  if (value === "policies" || value === "sections" || value === "procedures" || value === "delegations" || value === "editorial-checks" || value === "monitoring") return value;
   if (value === "signups" && signupPluginEnabled()) return value;
-  if (value === "editorial-checks" && editorialChecksPluginEnabled()) return value;
+  if (value === "newsletter" && newsletterPluginEnabled(demo)) return value;
+  if (value === "moderation" && readerPluginEnabled()) return value;
   return "users";
 }
 

package/components/use-editorial-checks.ts

@@ -27,14 +27,16 @@ export function useEditorialChecks({
   section,
   itemId,
 }: {
-  /** null turns editorial checks off. */
+  /** null when there is no backend to check against (a preview). Whether a publication runs checks is its stored setting. */
   backend: EditorialChecksBackend | null;
   body: string | null;
   section: string;
   itemId: string | null;
 }) {
-  const enabled = backend !== null;
+  const available = backend !== null;
   const [settings, setSettings] = useState<EditorialSettings>(DEFAULT_EDITORIAL_SETTINGS);
+  const [settingsLoaded, setSettingsLoaded] = useState(false);
+  const enabled = available && settings.enabled;
   const [result, setResult] = useState<EditorialCheckResult | null>(null);
   const [checkedBody, setCheckedBody] = useState<string | null>(null);
   const [status, setStatus] = useState<CheckStatus>({ state: "idle" });
@@ -46,9 +48,9 @@ export function useEditorialChecks({
   const sequence = useRef(0);
 
   useEffect(() => {
-    if (!enabled) return;
-    backend?.loadSettings().then(({ settings: loaded }) => setSettings(loaded)).catch(() => undefined);
-  }, [backend, enabled]);
+    if (!available) return;
+    backend?.loadSettings().then(({ settings: loaded }) => setSettings(loaded)).catch(() => undefined).finally(() => setSettingsLoaded(true));
+  }, [available, backend]);
 
   useEffect(() => {
     if (!enabled || !itemId) return;
@@ -57,7 +59,7 @@ export function useEditorialChecks({
 
   const check = useCallback(async () => {
     const text = latestBody.current;
-    if (!backend || text === null || !text.trim()) return;
+    if (!backend || !enabled || text === null || !text.trim()) return;
     const run = ++sequence.current;
     setStatus({ state: "checking" });
     try {
@@ -73,13 +75,13 @@ export function useEditorialChecks({
     } catch (error) {
       if (run === sequence.current) setStatus({ state: "error", message: error instanceof Error ? error.message : "The check failed." });
     }
-  }, [backend, section]);
+  }, [backend, enabled, section]);
 
   useEffect(() => {
-    if (!enabled || !settings.checkWhileTyping || body === null || body === checkedBody) return;
+    if (!enabled || !settingsLoaded || !settings.checkWhileTyping || body === null || body === checkedBody) return;
     const timer = window.setTimeout(() => void check(), CHECK_PAUSE_MS);
     return () => window.clearTimeout(timer);
-  }, [body, check, checkedBody, enabled, settings.checkWhileTyping]);
+  }, [body, check, checkedBody, enabled, settings.checkWhileTyping, settingsLoaded]);
 
   const record = useCallback(
     (finding: EditorialFinding, decision: FeedbackDecision, reason: string | null = null) => {
@@ -105,7 +107,7 @@ export function useEditorialChecks({
     [backend, section],
   );
 
-  const current = result && checkedBody === body;
+  const current = enabled && result && checkedBody === body;
   return {
     enabled,
     settings,

package/infra/amplify-app-shell.js

@@ -1,10 +1,10 @@
 import { ArnFormat, CfnOutput, Duration, Fn, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as amplify from "aws-cdk-lib/aws-amplify";
-import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import { SecureStringParameter } from "./secure-string-parameter.js";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveSiteOrigin, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveProspectusSessionSealingParameterName, resolveReaderPollSecretParameterName, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -68,6 +68,9 @@ export class AmplifyAppShellStack extends Stack {
             if (!config.reader)
                 throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
             this.readerAppId = this.addReaderApp(config, config.reader);
+            if (config.autoDeploy) {
+                this.addGithubDeployRole(config, [{ appId: this.readerAppId, branch: config.reader.branchName ?? "main" }]);
+            }
             return;
         }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
@@ -89,33 +92,49 @@ export class AmplifyAppShellStack extends Stack {
         });
         const revalidateSecretParameterName = config.frontend === "pretext" ? resolveRevalidateSecretParameterName(config) : undefined;
         if (revalidateSecretParameterName) {
+            const revalidateSecret = new SecureStringParameter(this, "RevalidateSecretParameter", {
+                parameterName: revalidateSecretParameterName,
+                description: `Shared secret that authorizes publishes to call the /api/revalidate route of ${cmsAppName}`,
+            });
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "ReadRevalidateSecret",
                 actions: ["ssm:GetParameter"],
-                resources: [
-                    this.formatArn({ service: "ssm", resource: "parameter", resourceName: revalidateSecretParameterName.slice(1), arnFormat: ArnFormat.SLASH_RESOURCE_NAME }),
-                ],
+                resources: [revalidateSecret.parameterArn],
             }));
         }
         const prospectusAccountsApiStageArn = config.cms.prospectusAccountsApiStageArn;
-        const prospectusSessionSealingSecret = prospectusAccountsApiStageArn
-            ? new secretsmanager.Secret(this, "ProspectusSessionSealingSecret", {
+        const prospectusSessionSealing = prospectusAccountsApiStageArn
+            ? new SecureStringParameter(this, "ProspectusSessionSealingParameter", {
+                parameterName: resolveProspectusSessionSealingParameterName(config),
                 description: `Seals the Prospectus sign-in cookies of ${cmsAppName}; replacing it signs everyone out`,
-                generateSecretString: { passwordLength: 64, excludePunctuation: true },
             })
             : undefined;
-        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealingSecret
+        const prospectusEnvironment = prospectusAccountsApiStageArn && prospectusSessionSealing
             ? {
                 PAPYRUS_PROSPECTUS_ACCOUNTS_ENDPOINT: resolveProspectusAccountsEndpoint(prospectusAccountsApiStageArn),
-                PAPYRUS_PROSPECTUS_SESSION_SECRET_ARN: prospectusSessionSealingSecret.secretArn,
+                PAPYRUS_PROSPECTUS_SESSION_SECRET_PARAMETER: prospectusSessionSealing.parameterName,
                 PAPYRUS_PROSPECTUS_SITE_PRODUCT: `papyrus-${config.siteId}`,
             }
             : {};
-        if (prospectusSessionSealingSecret) {
+        if (prospectusSessionSealing) {
             computeRole.addToPolicy(new iam.PolicyStatement({
                 sid: "ReadProspectusSessionSealingSecret",
-                actions: ["secretsmanager:GetSecretValue"],
-                resources: [prospectusSessionSealingSecret.secretArn],
+                actions: ["ssm:GetParameter"],
+                resources: [prospectusSessionSealing.parameterArn],
+            }));
+        }
+        if (prospectusAccountsApiStageArn && config.cms.readerRetirementPoll) {
+            // Prospectus admits one caller per site, this compute role, so the scheduled snapshot run reaches the retired-subject
+            // route through the CMS route /api/reader/retired, which it authenticates with this secret.
+            const readerPollSecret = new SecureStringParameter(this, "ReaderPollSecretParameter", {
+                parameterName: resolveReaderPollSecretParameterName(config),
+                description: `Authorizes the scheduled reader snapshot run to call the retired-subject route of ${cmsAppName}`,
+            });
+            prospectusEnvironment.PAPYRUS_READER_POLL_SECRET_PARAMETER = readerPollSecret.parameterName;
+            computeRole.addToPolicy(new iam.PolicyStatement({
+                sid: "ReadReaderPollSecret",
+                actions: ["ssm:GetParameter"],
+                resources: [readerPollSecret.parameterArn],
             }));
         }
         if (prospectusAccountsApiStageArn) {
@@ -153,9 +172,15 @@ export class AmplifyAppShellStack extends Stack {
         const stagingOrigin = stagingDomainName
             ? `https://${stagingDomainName}/`
             : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain, "/"]);
+        // The compute adapter's request URL is https://localhost:3000, so the site names its own public origin.
+        // A site served by its own edge (cms.siteOrigin) has no Amplify domain, so the edge host is its origin.
+        const siteOrigin = resolveSiteOrigin(config);
+        const productionSiteOrigin = cmsHostName ? `https://${cmsHostName}` : siteOrigin ?? Fn.join("", ["https://main.", cmsApp.attrDefaultDomain]);
+        const stagingSiteOrigin = stagingDomainName ? `https://${stagingDomainName}` : Fn.join("", ["https://staging.", cmsApp.attrDefaultDomain]);
         const sharedRootDomain = config.cms.domainPrefix !== undefined;
         const defaultOriginsToAllow = [
             ...(config.cms.domainName ? [] : [productionOrigin]),
+            ...(siteOrigin ? [`${siteOrigin}/`] : []),
             ...(stagingEnabled && !stagingDomainName ? [stagingOrigin] : []),
         ];
         const oauthRedirectUrls = defaultOriginsToAllow.length === 0
@@ -165,7 +190,8 @@ export class AmplifyAppShellStack extends Stack {
             appId: cmsApp.attrAppId,
             branchName: "main",
             stage: "PRODUCTION",
-            enableAutoBuild: true,
+            // Auto-build off when GitHub Actions starts the job on merge (autoDeploy): nothing may double-build.
+            enableAutoBuild: !config.autoDeploy,
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
@@ -174,6 +200,7 @@ export class AmplifyAppShellStack extends Stack {
                 PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                 PAPYRUS_SITE_BRAND: config.brand,
                 SITE_ENV: "production",
+                PAPYRUS_SITE_ORIGIN: productionSiteOrigin,
                 PAPYRUS_CONTENT_SOURCE: "published",
                 ...(revalidateSecretParameterName ? { PAPYRUS_REVALIDATE_SECRET_PARAMETER: revalidateSecretParameterName } : {}),
                 ...prospectusEnvironment,
@@ -195,6 +222,7 @@ export class AmplifyAppShellStack extends Stack {
                     PAPYRUS_OAUTH_REDIRECT_URLS: oauthRedirectUrls,
                     PAPYRUS_SITE_BRAND: config.brand,
                     SITE_ENV: "staging",
+                    PAPYRUS_SITE_ORIGIN: stagingSiteOrigin,
                     ...stagingMode,
                     ...prospectusEnvironment,
                     NEXT_PUBLIC_PAPYRUS_STAGING_URL: stagingDomainName
@@ -247,6 +275,12 @@ export class AmplifyAppShellStack extends Stack {
         }
         const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
         this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
+        if (config.autoDeploy) {
+            this.addGithubDeployRole(config, [
+                { appId: cmsApp.attrAppId, branch: "main" },
+                ...(this.readerAppId && config.reader ? [{ appId: this.readerAppId, branch: config.reader.branchName ?? "main" }] : []),
+            ]);
+        }
         if (config.github) {
             this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
         }
@@ -294,6 +328,46 @@ export class AmplifyAppShellStack extends Stack {
             description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
         });
     }
+    /**
+     * The merge-to-main deploy role: assumable only by a GitHub Actions run on `main` of the site's own
+     * repository (OIDC, no keys), and able to do exactly one thing: start and read Amplify jobs on the
+     * production branch of the site's apps.
+     */
+    addGithubDeployRole(config, targets) {
+        const { owner, repo } = resolveGithubRepository(config);
+        const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubDeployOidcProvider", this.formatArn({
+            service: "iam",
+            region: "",
+            resource: "oidc-provider",
+            resourceName: GITHUB_OIDC_PROVIDER_HOST,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        }));
+        const deployRole = new iam.Role(this, "GithubDeployRole", {
+            roleName: `${config.siteId}-github-deploy`,
+            description: `Merge-to-main deploy for ${owner}/${repo}: GitHub OIDC on refs/heads/main only; amplify:StartJob and GetJob on the production branch of the site's apps only`,
+            maxSessionDuration: Duration.hours(1),
+            assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+                StringEquals: {
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com",
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: githubOidcSubjects(config, "main"),
+                },
+            }),
+        });
+        deployRole.addToPolicy(new iam.PolicyStatement({
+            sid: "StartAndReadProductionJobs",
+            actions: ["amplify:StartJob", "amplify:GetJob"],
+            resources: targets.map((target) => this.formatArn({
+                service: "amplify",
+                resource: "apps",
+                resourceName: `${target.appId}/branches/${target.branch}/jobs/*`,
+                arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+            })),
+        }));
+        new CfnOutput(this, "GithubDeployRoleArn", {
+            value: deployRole.roleArn,
+            description: `Role for the merge-to-main deploy workflow in ${owner}/${repo}`,
+        });
+    }
     addGithubCiRole(config, github, cmsAppId, amplifyAppIds) {
         const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
             service: "iam",
@@ -309,7 +383,7 @@ export class AmplifyAppShellStack extends Stack {
             assumedBy: new iam.OpenIdConnectPrincipal(provider, {
                 StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
                 StringLike: {
-                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map((branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`),
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.flatMap((branch) => githubOidcSubjects(config, branch)),
                 },
             }),
         });
@@ -361,7 +435,7 @@ export class AmplifyAppShellStack extends Stack {
             appId: readerApp.attrAppId,
             branchName: readerBranchName,
             stage: "PRODUCTION",
-            enableAutoBuild: true,
+            enableAutoBuild: !config.autoDeploy,
             environmentVariables: environmentVariables({
                 ...(reader.environment ?? {}),
                 PAPYRUS_SITE_BRAND: config.brand,