@anthusai/papyrus 2.0.0-next.74 → 2.0.0-next.76

package/amplify/data/resource.js

@@ -1152,6 +1152,8 @@ const schema = a.schema({
         error: a.json(),
         attempt: a.integer(),
         newsroomFeedKey: a.string(),
+        usage: a.json(),
+        costUsd: a.float(),
     })
         .secondaryIndexes((index) => [
         index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1182,6 +1184,54 @@ const schema = a.schema({
         allow.group("editor").to(["read", "create", "update"]),
         allow.group(adminGroup).to(authoringOperations),
     ]),
+    /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+    ReviewRequest: a
+        .model({
+        id: a.id().required(),
+        subject: a.json().required(),
+        mode: a.string().required(),
+        reason: a.string().required(),
+        ask: a.string(),
+        raisedBy: a.string().required(),
+        raisedAt: a.datetime().required(),
+        deadline: a.datetime(),
+        state: a.string().required(),
+        answer: a.json(),
+        links: a.json(),
+        history: a.json(),
+        appliedIn: a.json(),
+        updatedAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.group("editor").to(["read", "create", "update"]),
+        allow.group(adminGroup).to(authoringOperations),
+    ]),
+    /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+    ReviewReadMark: a
+        .model({
+        id: a.id().required(),
+        requestId: a.string().required(),
+        userKey: a.string().required(),
+        readAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+    ]),
+    /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+    ReviewRecipientRule: a
+        .model({
+        id: a.id().required(),
+        scope: a.string().required(),
+        key: a.string(),
+        roles: a.string().array(),
+        emails: a.string().array(),
+        updatedBy: a.string(),
+        updatedAt: a.datetime().required(),
+    })
+        .authorization((allow) => [
+        allow.group("editor").to(["read"]),
+        allow.group(adminGroup).to(authoringOperations),
+    ]),
     NewsroomSection: a
         .model({
         id: a.id().required(),

package/amplify/data/resource.ts

@@ -1247,6 +1247,8 @@ const schema = a.schema({
       error: a.json(),
       attempt: a.integer(),
       newsroomFeedKey: a.string(),
+      usage: a.json(),
+      costUsd: a.float(),
     })
     .secondaryIndexes((index) => [
       index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1279,6 +1281,57 @@ const schema = a.schema({
       allow.group(adminGroup).to(authoringOperations),
     ]),
 
+  /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+  ReviewRequest: a
+    .model({
+      id: a.id().required(),
+      subject: a.json().required(),
+      mode: a.string().required(),
+      reason: a.string().required(),
+      ask: a.string(),
+      raisedBy: a.string().required(),
+      raisedAt: a.datetime().required(),
+      deadline: a.datetime(),
+      state: a.string().required(),
+      answer: a.json(),
+      links: a.json(),
+      history: a.json(),
+      appliedIn: a.json(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
+  /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+  ReviewReadMark: a
+    .model({
+      id: a.id().required(),
+      requestId: a.string().required(),
+      userKey: a.string().required(),
+      readAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+    ]),
+
+  /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+  ReviewRecipientRule: a
+    .model({
+      id: a.id().required(),
+      scope: a.string().required(),
+      key: a.string(),
+      roles: a.string().array(),
+      emails: a.string().array(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
   NewsroomSection: a
     .model({
       id: a.id().required(),

package/amplify/data/schema.js

@@ -1072,6 +1072,8 @@ function buildBaseDefinitions(includeEditions) {
             error: a.json(),
             attempt: a.integer(),
             newsroomFeedKey: a.string(),
+            usage: a.json(),
+            costUsd: a.float(),
         })
             .secondaryIndexes((index) => [
             index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1102,6 +1104,51 @@ function buildBaseDefinitions(includeEditions) {
             allow.group("editor").to(["read", "create", "update"]),
             allow.group(adminGroup).to(authoringOperations),
         ]),
+        /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+        ReviewRequest: modelWithoutSubscriptions({
+            id: a.id().required(),
+            subject: a.json().required(),
+            mode: a.string().required(),
+            reason: a.string().required(),
+            ask: a.string(),
+            raisedBy: a.string().required(),
+            raisedAt: a.datetime().required(),
+            deadline: a.datetime(),
+            state: a.string().required(),
+            answer: a.json(),
+            links: a.json(),
+            history: a.json(),
+            appliedIn: a.json(),
+            updatedAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.group("editor").to(["read", "create", "update"]),
+            allow.group(adminGroup).to(authoringOperations),
+        ]),
+        /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+        ReviewReadMark: modelWithoutSubscriptions({
+            id: a.id().required(),
+            requestId: a.string().required(),
+            userKey: a.string().required(),
+            readAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+        ]),
+        /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+        ReviewRecipientRule: modelWithoutSubscriptions({
+            id: a.id().required(),
+            scope: a.string().required(),
+            key: a.string(),
+            roles: a.string().array(),
+            emails: a.string().array(),
+            updatedBy: a.string(),
+            updatedAt: a.datetime().required(),
+        })
+            .authorization((allow) => [
+            allow.group("editor").to(["read"]),
+            allow.group(adminGroup).to(authoringOperations),
+        ]),
         NewsroomSection: modelWithoutSubscriptions({
             id: a.id().required(),
             tenantId: a.string(),

package/amplify/data/schema.ts

@@ -1165,6 +1165,8 @@ const definitions = {
       error: a.json(),
       attempt: a.integer(),
       newsroomFeedKey: a.string(),
+      usage: a.json(),
+      costUsd: a.float(),
     })
     .secondaryIndexes((index) => [
       index("procedureId").sortKeys(["requestedAt"]).queryField("listProcedureRunsByProcedureAndRequestedAt"),
@@ -1197,6 +1199,54 @@ const definitions = {
       allow.group(adminGroup).to(authoringOperations),
     ]),
 
+  /** A human review point raised by a step on any item (PPY-ab6a50). Review is not a story state. */
+  ReviewRequest: modelWithoutSubscriptions({
+      id: a.id().required(),
+      subject: a.json().required(),
+      mode: a.string().required(),
+      reason: a.string().required(),
+      ask: a.string(),
+      raisedBy: a.string().required(),
+      raisedAt: a.datetime().required(),
+      deadline: a.datetime(),
+      state: a.string().required(),
+      answer: a.json(),
+      links: a.json(),
+      history: a.json(),
+      appliedIn: a.json(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read", "create", "update"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
+  /** One user's read mark on one review request; id is "<userKey>#<requestId>". */
+  ReviewReadMark: modelWithoutSubscriptions({
+      id: a.id().required(),
+      requestId: a.string().required(),
+      userKey: a.string().required(),
+      readAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.groups(["editor", adminGroup]).to(["read", "create", "update"]),
+    ]),
+
+  /** Who is told about review requests: scope default, mode or automation. Changed by data, not code. */
+  ReviewRecipientRule: modelWithoutSubscriptions({
+      id: a.id().required(),
+      scope: a.string().required(),
+      key: a.string(),
+      roles: a.string().array(),
+      emails: a.string().array(),
+      updatedBy: a.string(),
+      updatedAt: a.datetime().required(),
+    })
+    .authorization((allow) => [
+      allow.group("editor").to(["read"]),
+      allow.group(adminGroup).to(authoringOperations),
+    ]),
+
   NewsroomSection: modelWithoutSubscriptions({
       id: a.id().required(),
       tenantId: a.string(),

package/amplify/functions/automation-view/handler.py

@@ -1,4 +1,4 @@
-"""The automation-view function: `automationOverview` for editors and admins, read-only."""
+"""The automation-view function: `automationOverview` (editors, admins and operator IAM roles, read only) and `runAutomation` (editors and admins)."""
 
 from __future__ import annotations
 
@@ -7,5 +7,11 @@ from typing import Any
 from papyrus_content.automation_view import handle
 
 
-def handler(event: dict[str, Any], _context: Any = None) -> dict[str, Any]:
-    return handle(event)
+def _account(context: Any) -> str | None:
+    arn = getattr(context, "invoked_function_arn", None)
+    parts = str(arn or "").split(":")
+    return parts[4] if len(parts) > 4 and parts[4] else None
+
+
+def handler(event: dict[str, Any], context: Any = None) -> dict[str, Any]:
+    return handle(event, account_id=_account(context))

package/amplify/functions/automation-view/schema.js

@@ -3,8 +3,11 @@ import { automationView } from "./resource.js";
 const editors = ["editor", "admin"];
 /**
  * Core to every site's data API. The Automation page reads the automation records, the monitoring
- * trigger rows they link to, and the procedure runs through this one query. AppSync admits editors
- * and admins only; the function checks the groups again.
+ * trigger rows they link to, and the procedure runs through `automationOverview`, and starts a run
+ * through `runAutomation`. Both admit editors and admins. AppSync also lets an IAM principal call the
+ * query when its own policy allows the field (every operation in this schema accepts IAM callers for
+ * the functions that call it); the function reads only for an IAM principal of its own account and refuses
+ * every IAM caller on `runAutomation`.
  */
 export const automationViewSchemaDefinitions = {
     automationOverview: a
@@ -13,4 +16,10 @@ export const automationViewSchemaDefinitions = {
         .returns(a.json())
         .authorization((allow) => [allow.groups(editors)])
         .handler(a.handler.function(automationView)),
+    runAutomation: a
+        .mutation()
+        .arguments({ automationId: a.string().required(), input: a.json() })
+        .returns(a.json())
+        .authorization((allow) => [allow.groups(editors)])
+        .handler(a.handler.function(automationView)),
 };

package/amplify/functions/automation-view/schema.ts

@@ -5,8 +5,11 @@ const editors = ["editor", "admin"];
 
 /**
  * Core to every site's data API. The Automation page reads the automation records, the monitoring
- * trigger rows they link to, and the procedure runs through this one query. AppSync admits editors
- * and admins only; the function checks the groups again.
+ * trigger rows they link to, and the procedure runs through `automationOverview`, and starts a run
+ * through `runAutomation`. Both admit editors and admins. AppSync also lets an IAM principal call the
+ * query when its own policy allows the field (every operation in this schema accepts IAM callers for
+ * the functions that call it); the function reads only for an IAM principal of its own account and refuses
+ * every IAM caller on `runAutomation`.
  */
 export const automationViewSchemaDefinitions = {
   automationOverview: a
@@ -15,4 +18,10 @@ export const automationViewSchemaDefinitions = {
     .returns(a.json())
     .authorization((allow) => [allow.groups(editors)])
     .handler(a.handler.function(automationView)),
+  runAutomation: a
+    .mutation()
+    .arguments({ automationId: a.string().required(), input: a.json() })
+    .returns(a.json())
+    .authorization((allow) => [allow.groups(editors)])
+    .handler(a.handler.function(automationView)),
 };

package/amplify/functions/automation-view/wire.js

@@ -1,11 +1,23 @@
 import { Stack } from "aws-cdk-lib";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { MONITORING_TABLE_PARAMETER, MONITORING_VIEW_TABLE_ACTIONS, monitoringViewParameterArn, monitoringViewTableArns, } from "../monitoring-view/wire.js";
-/** The two reads the function makes of its own site's API with its own role. It writes nothing. */
-export const AUTOMATION_VIEW_FUNCTION_FIELDS = ["Query/fields/listAutomations", "Query/fields/getProcedureRun"];
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+    "Query/fields/getAutomation",
+    "Query/fields/getNewsroomProcedureDefinition",
+    "Query/fields/getProcedureRun",
+    "Query/fields/listAutomations",
+    "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
 /**
- * Environment and least-privilege IAM for the automation-view function: two fields of the site's own API,
- * and the same read-only grant on the monitoring table that the Monitoring page has. A site outside the
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
  * monitoring account finds no parameter and the page lists its records without runs.
  */
 export function wireAutomationView(backend) {
@@ -13,6 +25,7 @@ export function wireAutomationView(backend) {
     const stack = Stack.of(lambda);
     lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl);
     lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+    lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
     const apiId = backend.data.resources.graphqlApi.apiId;
     lambda.addToRolePolicy(new PolicyStatement({
         effect: Effect.ALLOW,
@@ -29,4 +42,15 @@ export function wireAutomationView(backend) {
         actions: MONITORING_VIEW_TABLE_ACTIONS,
         resources: monitoringViewTableArns(stack.region, stack.account),
     }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+        resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+        conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }));
+    lambda.addToRolePolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ["lambda:InvokeFunction"],
+        resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }));
 }

package/amplify/functions/automation-view/wire.ts

@@ -8,12 +8,26 @@ import {
   monitoringViewTableArns,
 } from "../monitoring-view/wire";
 
-/** The two reads the function makes of its own site's API with its own role. It writes nothing. */
-export const AUTOMATION_VIEW_FUNCTION_FIELDS = ["Query/fields/listAutomations", "Query/fields/getProcedureRun"];
+/** The reads the function makes of its own site's API with its own role. It writes nothing there. */
+export const AUTOMATION_VIEW_FUNCTION_FIELDS = [
+  "Query/fields/getAutomation",
+  "Query/fields/getNewsroomProcedureDefinition",
+  "Query/fields/getProcedureRun",
+  "Query/fields/listAutomations",
+  "Query/fields/listProcedureRunsByProcedureAndRequestedAt",
+];
+
+/** The procedure runner stack's function (infra/procedures/papyrus-procedure-runner.yaml); Run now starts it asynchronously. */
+export const PROCEDURE_RUNNER_FUNCTION_NAME = "papyrus-procedure-runner";
+
+/** Run now writes one row of its own to the monitoring table, in a monitor's partition (`MONITOR#<id>`), and nothing else. */
+export const AUTOMATION_RUN_NOW_TABLE_ACTIONS = ["dynamodb:PutItem"];
+export const AUTOMATION_RUN_NOW_LEADING_KEYS = ["MONITOR#*"];
 
 /**
- * Environment and least-privilege IAM for the automation-view function: two fields of the site's own API,
- * and the same read-only grant on the monitoring table that the Monitoring page has. A site outside the
+ * Environment and least-privilege IAM for the automation-view function: a few read fields of the site's own API,
+ * the same read-only grant on the monitoring table that the Monitoring page has, one PutItem for Run now's row,
+ * and permission to start the procedure runner. A site outside the
  * monitoring account finds no parameter and the page lists its records without runs.
  */
 export function wireAutomationView(backend: any): void {
@@ -21,6 +35,7 @@ export function wireAutomationView(backend: any): void {
   const stack = Stack.of(lambda);
   lambda.addEnvironment("PAPYRUS_GRAPHQL_ENDPOINT", backend.data.resources.cfnResources.cfnGraphqlApi.attrGraphQlUrl as string);
   lambda.addEnvironment("PAPYRUS_MONITORING_TABLE_PARAMETER", MONITORING_TABLE_PARAMETER);
+  lambda.addEnvironment("PROCEDURE_RUNNER_FUNCTION", PROCEDURE_RUNNER_FUNCTION_NAME);
   const apiId = backend.data.resources.graphqlApi.apiId as string;
   lambda.addToRolePolicy(
     new PolicyStatement({
@@ -43,4 +58,19 @@ export function wireAutomationView(backend: any): void {
       resources: monitoringViewTableArns(stack.region, stack.account),
     }),
   );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: AUTOMATION_RUN_NOW_TABLE_ACTIONS,
+      resources: monitoringViewTableArns(stack.region, stack.account).slice(0, 1),
+      conditions: { "ForAllValues:StringLike": { "dynamodb:LeadingKeys": AUTOMATION_RUN_NOW_LEADING_KEYS } },
+    }),
+  );
+  lambda.addToRolePolicy(
+    new PolicyStatement({
+      effect: Effect.ALLOW,
+      actions: ["lambda:InvokeFunction"],
+      resources: [`arn:aws:lambda:${stack.region}:${stack.account}:function:${PROCEDURE_RUNNER_FUNCTION_NAME}`],
+    }),
+  );
 }

package/amplify/plugins/reader-steering/config.js

@@ -7,7 +7,7 @@ export const AI_MODEL_NAME = /^[a-z0-9][a-z0-9.-]{0,63}$/;
 export const SUBMISSION_KIND_NAME = /^[a-z][a-z0-9-]{0,23}$/;
 export const SUBJECT_TYPES = ["item", "submission", "story", "proposal", "concept"];
 export const COMPUTE_ROLE_ARN = /^arn:aws:iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/;
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects", "proposals"]);
 function object(raw, label, known) {
     if (raw === undefined)
         return {};
@@ -117,6 +117,7 @@ export function resolveReaderSteeringConfig(request) {
     if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => SUBJECT_TYPES.includes(type))) {
         throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
     }
+    const proposals = object(raw.proposals, "proposals", ["publish"]);
     const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
     const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
     const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -173,6 +174,7 @@ export function resolveReaderSteeringConfig(request) {
             maximumLength: integer(comments.maximumLength, "comments.maximumLength", 2000, 1, 10000),
             maximumLinks: integer(comments.maximumLinks, "comments.maximumLinks", 3, 0, 50),
         },
+        proposals: { publish: flag(proposals.publish, "proposals.publish") },
         retirementPoll,
         ...(hypeGap ? { hypeGap } : {}),
         ...(raw.reservedConcurrency === undefined ? {} : { reservedConcurrency: integer(raw.reservedConcurrency, "reservedConcurrency", 1, 1, 1000) }),

package/amplify/plugins/reader-steering/config.ts

@@ -98,6 +98,14 @@ export type ReaderSteeringConfig = {
     /** Most links (http, https or www) in a comment. */
     maximumLinks: number;
   };
+  proposals: {
+    /**
+     * Publish every proposal, in every state (drafts included), as public `_data/proposals/` files in each snapshot run.
+     * Off by default: proposals stay private records until a site opts in. Turning it off stops further updates; it does not
+     * delete files already published.
+     */
+    publish: boolean;
+  };
   /**
    * The hype gap is `mean(plus dimensions) - mean(minus dimensions)`, computed for reader means and for editor scores.
    * Absent means no hype gap is published. The site names the dimensions in each group.
@@ -115,7 +123,7 @@ export type ReaderSteeringConfig = {
   retirementPoll: boolean;
 };
 
-const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects"]);
+const KNOWN_KEYS = new Set(["name", "computeRoleArn", "dimensions", "limits", "reservedHandles", "karma", "ranking", "snapshot", "retirementPoll", "reservedConcurrency", "hypeGap", "submissions", "comments", "moderation", "subjects", "proposals"]);
 
 function object(raw: unknown, label: string, known: string[]): Record<string, unknown> {
   if (raw === undefined) return {};
@@ -217,6 +225,7 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
   if (!Array.isArray(subjectTypes) || subjectTypes.length === 0 || !subjectTypes.every((type) => (SUBJECT_TYPES as readonly unknown[]).includes(type))) {
     throw new Error(`reader-steering plugin subjects.types must be a non-empty list of: ${SUBJECT_TYPES.join(", ")}`);
   }
+  const proposals = object(raw.proposals, "proposals", ["publish"]);
   const kinds = names(submissions.kinds, "submissions.kinds", SUBMISSION_KIND_NAME);
   const comments = object(raw.comments, "comments", ["perHour", "editWindowMinutes", "maximumLength", "maximumLinks"]);
   const hypeGap = resolveHypeGap(raw.hypeGap, dimensions);
@@ -273,6 +282,7 @@ export function resolveReaderSteeringConfig(request: PluginRequest): ReaderSteer
       maximumLength: integer(comments.maximumLength, "comments.maximumLength", 2000, 1, 10000),
       maximumLinks: integer(comments.maximumLinks, "comments.maximumLinks", 3, 0, 50),
     },
+    proposals: { publish: flag(proposals.publish, "proposals.publish") },
     retirementPoll,
     ...(hypeGap ? { hypeGap } : {}),
     ...(raw.reservedConcurrency === undefined ? {} : { reservedConcurrency: integer(raw.reservedConcurrency, "reservedConcurrency", 1, 1, 1000) }),

package/amplify/plugins/reader-steering/papyrus.plugin.js

@@ -159,6 +159,8 @@ export const readerSteeringPlugin = {
         lambda.addEnvironment("PAPYRUS_READER_SNAPSHOT_FUNCTION_ARN", contentActions.functionArn);
         lambda.addEnvironment("PAPYRUS_READER_SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
         contentActions.addEnvironment("PAPYRUS_READER_SNAPSHOT_SETTINGS", JSON.stringify(readerSnapshotSettings(config)));
+        // Proposals are private unless the site opts in (docs/reader-steering.md, Proposals); the snapshot reads this flag.
+        contentActions.addEnvironment("PAPYRUS_READER_PUBLISH_PROPOSALS", config.proposals.publish ? "true" : "false");
         if (config.moderation.ai)
             wireAiModeration(lambda, contentActions, schedulerRole, config.moderation.ai.apiKeyParameter);
         lambda.addPermission("InvokeFromCmsCompute", {

package/amplify/plugins/reader-steering/papyrus.plugin.ts

@@ -182,6 +182,8 @@ export const readerSteeringPlugin: PapyrusPlugin<ReaderSteeringConfig, { readerA
     lambda.addEnvironment("PAPYRUS_READER_SNAPSHOT_FUNCTION_ARN", contentActions.functionArn);
     lambda.addEnvironment("PAPYRUS_READER_SCHEDULER_ROLE_ARN", schedulerRole.roleArn);
     contentActions.addEnvironment("PAPYRUS_READER_SNAPSHOT_SETTINGS", JSON.stringify(readerSnapshotSettings(config)));
+    // Proposals are private unless the site opts in (docs/reader-steering.md, Proposals); the snapshot reads this flag.
+    contentActions.addEnvironment("PAPYRUS_READER_PUBLISH_PROPOSALS", config.proposals.publish ? "true" : "false");
 
     if (config.moderation.ai) wireAiModeration(lambda, contentActions, schedulerRole, config.moderation.ai.apiKeyParameter);
 

package/components/automation-panel.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useState } from "react";
-import { loadAutomationOverview } from "../lib/automation-client";
+import { loadAutomationOverview, runAutomationNow } from "../lib/automation-client";
 import { FIXTURE_AUTOMATION_OVERVIEW } from "../lib/automation-fixture";
 import type { AutomationResult } from "../lib/automation-overview";
 import { AutomationView } from "./automation-view";
@@ -35,5 +35,15 @@ export function AutomationPanel({ isDemo }: { isDemo: boolean }) {
     };
   }, [isDemo]);
 
-  return <AutomationView result={result} selectedId={selectedId} onSelect={setSelectedId} demo={isDemo} />;
+  const runNow = isDemo ? undefined : async (automationId: string, input: Record<string, unknown> | null) => {
+    const outcome = await runAutomationNow(automationId, input);
+    try {
+      setResult(await loadAutomationOverview());   // show the new run without waiting for the minute
+    } catch {
+      /* the next refresh will */
+    }
+    return outcome;
+  };
+
+  return <AutomationView result={result} selectedId={selectedId} onSelect={setSelectedId} demo={isDemo} onRunNow={runNow} />;
 }

package/components/automation-run-now.tsx

@@ -0,0 +1,97 @@
+"use client";
+
+import { useState } from "react";
+import {
+  atATimeText,
+  inputTemplateText,
+  parseRunInput,
+  runNowMessage,
+  type AutomationRecord,
+  type RunNowResult,
+} from "../lib/automation-overview";
+
+export type RunNowPhase = "idle" | "confirming" | "running" | "done";
+
+/**
+ * "Run now": a button, then a confirm step that says what will start and, when the record's input names
+ * placeholders for an item, asks for the input of this run. Starting costs money (the procedure calls a model),
+ * so nothing starts on the first click. `initialPhase` and `initialMessage` exist so every step renders from a test.
+ */
+export function RunNowControl({
+  record,
+  demo = false,
+  onRun,
+  initialPhase = "idle",
+  initialMessage = null,
+}: {
+  record: Pick<AutomationRecord, "id" | "title" | "procedureKey" | "runNow" | "limits">;
+  demo?: boolean;
+  onRun?: (automationId: string, input: Record<string, unknown> | null) => Promise<RunNowResult>;
+  initialPhase?: RunNowPhase;
+  initialMessage?: string | null;
+}) {
+  const [phase, setPhase] = useState<RunNowPhase>(initialPhase);
+  const [message, setMessage] = useState<string | null>(initialMessage);
+  const [text, setText] = useState(record.runNow.needsInput ? inputTemplateText(record.runNow.inputNames) : "");
+  const [problem, setProblem] = useState<string | null>(null);
+
+  if (!record.runNow.available) {
+    return (
+      <p className="news-desk-delegation-note" data-automation-run-now-unavailable>
+        Run now is not available: {record.runNow.reason === "disabled" ? "the automation is disabled. Enable it first." : (record.runNow.reason ?? "not supported")}.
+      </p>
+    );
+  }
+
+  async function confirm() {
+    const parsed = parseRunInput(text);
+    if (!parsed.ok) {
+      setProblem(parsed.message);
+      return;
+    }
+    if (record.runNow.needsInput && parsed.value === null) {
+      setProblem("This automation's input names an item, so give the input for this run.");
+      return;
+    }
+    setProblem(null);
+    setPhase("running");
+    try {
+      const result = onRun ? await onRun(record.id, parsed.value) : ({ state: "unavailable" } as RunNowResult);
+      setMessage(runNowMessage(result));
+    } catch {
+      setMessage(runNowMessage({ state: "unavailable" }));
+    }
+    setPhase("done");
+  }
+
+  return (
+    <div data-automation-run-now={record.id} data-run-now-phase={phase}>
+      {phase === "idle" || phase === "done" ? (
+        <button type="button" data-automation-run-now-start onClick={() => { setMessage(null); setPhase("confirming"); }}>
+          Run now
+        </button>
+      ) : null}
+      {phase === "confirming" || phase === "running" ? (
+        <div role="group" aria-label={`Confirm Run now for ${record.title}`} data-automation-run-now-confirm>
+          <p>
+            Run <strong>{record.procedureKey}</strong> now? It calls a model, which costs money, and it counts against the
+            limit ({atATimeText(record.limits)}). The run is linked to this automation.
+          </p>
+          {demo ? <p className="news-desk-delegation-note">This is the demo, so nothing will start.</p> : null}
+          <label>
+            Input for this run{record.runNow.needsInput ? " (required)" : " (optional; blank uses the record's input)"}
+            <textarea rows={4} value={text} onChange={(event) => setText(event.target.value)} disabled={phase === "running"} data-automation-run-now-input />
+          </label>
+          {problem ? <p role="alert" data-automation-run-now-problem>{problem}</p> : null}
+          <button type="button" onClick={() => void confirm()} disabled={phase === "running" || demo} data-automation-run-now-confirm-button>
+            {phase === "running" ? "Starting…" : "Confirm: start the run"}
+          </button>{" "}
+          <button type="button" onClick={() => { setPhase("idle"); setProblem(null); }} disabled={phase === "running"} data-automation-run-now-cancel>
+            Cancel
+          </button>
+        </div>
+      ) : null}
+      {message ? <p role="status" data-automation-run-now-message>{message}</p> : null}
+    </div>
+  );
+}