Why This Page Went Quiet
The pipeline that auto-published build-log entries to this page published things it never should have. I turned the page off rather than let it keep talking, then rebuilt the pipeline so it cannot happen again.
This page had a promotion pipeline: an agent summarized my private build logs into candidate posts, a redaction step scrubbed them, and they published here as live, indexable pages. It ran quietly and the page stayed fresh without me touching it. That was the appeal, and that was the flaw.
The promoter was auto-approving every candidate. The review queue I had built for exactly this purpose was being bypassed entirely, because the script set every entry to approved on arrival. Sixty-two entries reached the public feed without a single one ever passing a human eye. Among them were things that should never have been public: internal project names, personal material, operational details.
The redaction step did not catch them because token substitution is not a safety model. Swapping a named person for a placeholder does nothing about a topic that should not be public regardless of how well it is scrubbed. A redactor asks "is this string sensitive?" The right question is "should this subject exist on a public page at all?"
The same-day fix was blunt: gate the public page down to the hand-curated posts only and let the generated feed keep accumulating privately. The root-cause fix came days later. Candidates now land as pending, never approved, so the review queue is load-bearing instead of decorative. A topic-level denylist checks five categories against the entry's source project, not just its editable fields, so scrubbing tags cannot bypass it. The sync step re-checks the denylist at publish time as defense in depth. Thirteen test cases run in the build. And all sixty-two previously "approved" entries were reset to pending, because none of them had ever received real review.
Two lessons. First, an approval gate that a script can satisfy is not an approval gate. If the human step can be skipped, it eventually will be, and the failure will look like success the entire time. Second, if a public surface goes quiet for a while, that is sometimes the system working. The gap in this page's timeline between April and now is the gate doing its job while the pipeline behind it got rebuilt.
// The failure, in one line of the promoter:
status: 'approved' // set by a script, on arrival, every time
// The fix, in three layers:
status: 'pending' // humans approve; scripts never do
PUBLIC_SAFETY_DENYLIST // topic-level, checked against sourceProject
// (redaction scrubs strings; this blocks subjects)
sync: re-check at publish time, block + warn loudly
// And retroactively:
// 62 "approved" entries -> reset to pending. None were ever reviewed.