Release review of the front page and the short forms

Findings

This is the release gate under D-0005 for three pieces: the front page (README.md above the horizontal rule, lines 1 to 30) and the two short forms in articles/short/. The pieces go out if the review finds nothing that must be fixed. The reviewer read AGENTS.md in full, then each piece once straight through as a newcomer would, then again against the piece rules in AGENTS.md and the Piece form in LH F05. Every factual sentence in the three pieces was traced to the released article it rests on, at version 1.0, and, for the map and the next question, to registers/instruments.md, the export manifests, harbour/samples/, studies/LH003/sources.md, the LH002 ticket and the LH002 section of LH F04. Nothing was fetched: the pieces claim nothing that the articles and records do not already carry, so no claim needed a source read, and the articles' own claims were checked against their sources by notes/R-0002.md on the same day. The verdict is that all three pieces can be released. Everything found is a should-fix, most of it a word or a clause, or a note; the one item of substance is what the short forms' colophons should carry at release.

The front page, sentence by sentence, against the xz article and the records:

The map, row by row:

The next question, line 28, against the LH002 ticket and LH F04's LH002 section:

The short forms, sentence by sentence, against the articles:

The front page

1. Should fix. README.md line 5. "In March 2024 an engineer noticed" dates the noticing, which the article does not. The article dates the disclosure, 29 March, and places the symptoms "over the previous few weeks" (line 11); Freund's post, as R-0002 read it, says "over the last weeks". Debian's unstable branch took the compromised release on 26 February, so the earliest possible slow login is in the last days of February, and the noticing very probably fell in March, but the piece does not say so and the rule for a front page is that it says nothing the article does not. One word does it: "In March 2024 an engineer reported that logging in to his machines had been taking about half a second too long, and that he had followed the delay to a backdoor", or keep "noticed" and drop the month to "In early 2024".

2. Note. README.md lines 15 and 22. "Our agents" arrives before the reader is told there are any. The front page keeps "What Lighthouse is" below the rule, by design, so a newcomer meets "the machine our agents work on" at line 15 with nothing to attach it to; line 21 then supplies it, "the open-source tool that hands our tasks to AI agents", and line 22 repeats "our agents". The trip is small and the explanation is six lines away. "The machine our AI agents work on" at line 15 would remove it.

3. Note. README.md line 28. "Its record will appear in the studies folder" is the machinery showing through. A newcomer can follow it, and a repository's front page may reasonably say where a thing will land; but "the studies folder" sits close to the "the study" that AGENTS.md keeps out of a piece's prose. "We will publish what we find, whether the answer turns out to be a pattern or ..." would say the same without the folder. Leave it if the driver prefers the pointer.

4. Note. README.md line 28. "Followed the same way" could be read as "through the same records". The xz propagation was traced through distribution advisories, a security list and a timeline; LH002 will read forge events, archived source history and package dependency graphs (S5, S10 and S11), and the case record beneath the xz piece says those very sources would not have caught the xz propagation (LH004, seventh Finding). "The same way" means "afterwards, through public records", and the sentence says so; the reading that it means the same records is possible but not the natural one. No change needed; a clause such as "through public records of a different kind" would close it.

5. Note. The map is right and complete as far as the record goes. Every cell in the four rows traces to the article, the instrument register, the export manifests, the sample files or the sources table, as the second table above shows. "That is the whole map" holds: the only other observation in the repository, LH000's two host readings by hand on 25 September 2026, falls under the fourth row's subject and predates its instrument. "What lies outside it we have not observed, which is not the same as saying nothing is there" is the charter's "A dark region is not an empty one", in plain words.

6. Note. Layout and the piece rules on the front page. The order is the one the task asks for: one piece (a summary, its figure and a link, not the whole text; a reader who lands cold can read the summary, click through and meet Lighthouse for the first time in the article's colophon), then the map, then the next question, then a date line, then the rule. The H1 "Lighthouse" precedes the piece, as a site's name does; the first prose sentence is the thing itself. No document number, ticket or study id appears in the prose; the one id, LH002, sits inside a link target. The page speaks as "we", in British spellings, with no em or en dash (observation, by code-point search). The illustration is drawn and captioned in one line, reused unchanged from the article. No Draft label was carried while the pieces awaited this review; moot at release.

7. Note. Below the rule, "What Lighthouse is" now agrees with the charter and D-0005. Line 36 says the watch "is kept largely by AI agents within a small, stated budget, and it reviews and releases its own work; people set the direction and read what interests them": the charter's own words in its third paragraph, and D-0005's direction. "Proposed" is gone, as it is from the charter's first sentence. Line 38 says the documents "define the practice, including how a piece is reviewed and released; they do not grant access to any system or commit spending", which is the charter's "These documents define the intended practice. They do not grant access to any system or create a spending commitment", with the old "or authorise a publication" rightly dropped. The glossary's Autopilot and Keeper entries were already aligned at f7d2de6. The one thing line 36 leaves unsaid, which the charter and D-0005 both say in the same breath, is that three decisions stay with a person; a clause would complete the agreement: "people set the direction, read what interests them, and keep the few decisions that need a person". Not a disagreement; an omission.

The short forms

8. Should fix, at release. articles/short/the-xz-backdoor.md line 15 and articles/short/what-we-can-see.md line 15. The shortened colophon should say who cut the piece, name this review, and carry the short form's own version and corrections; and each short form needs a release note in registers/releases.md. The colophons now give the source rung ("Cut from ... version 1.0, released 26 September 2026"), an author line and the Lighthouse line, which is the shortening the task asked for and satisfies the handbook's rule that each rung points down to the one above. Three things are still expected of a released piece. First, "Written by Claude Opus 5.5" is true of the article but reads as the short form's author, and the review could not find who did the cutting (the E-0006 dispatch record is in harbour/.session/, which this review does not read, and the last export predates the task). Second, AGENTS.md's colophon carries the review and the version and corrections, and the charter's correction commitment wants a version on any publication that may later be corrected. Third, the handbook says the release note names the reviews the piece passed, and registers/releases.md has one note per released piece. A form that fits, about twenty-five words longer and outside the body count: "Cut from title, version 1.0, released 26 September 2026, by <who cut it>; the article was written by Claude Opus 5.5, an AI model made by Anthropic. Reviewed for release by a Claude Fable 5.1 agent (release review). Short form version 1.0, 26 September 2026. Corrections: none. Lighthouse is ..." R-0002's finding 14 treated the same items as part of the release act for the articles, and the driver made them in the release commit; the same can be done here without a further review.

9. Should fix. articles/short/the-xz-backdoor.md line 7. "It had been public" loses its noun across the byline. The opening ends "a backdoor, a hidden way in"; the byline follows; the body then opens "It had been public for nearly five weeks". Read aloud, the pronoun has to reach back over the byline, and a reader who paused at the date line reaches for "It" and finds "Lighthouse". "The backdoor had been public for nearly five weeks" costs one word.

10. Should fix. articles/short/what-we-can-see.md line 7. "A broker, which publishes how much each model is used" drops the edge the article keeps. The article says OpenRouter "publishes rankings of how many tokens each model has processed" and, in the same paragraph, that the figures "cover only requests that pass through OpenRouter" (line 15). The short form's clause can be read as the broker publishing each model's usage in general, which is the exact misreading the piece exists to prevent. "Which publishes how much each model is used through it" restores the edge in two words.

11. Note. articles/short/the-xz-backdoor.md line 7. "The program that checks passwords for remote logins" is the article's "keys and passwords" shortened. Freund's trace, as the case record has it, was a key login. "Checks keys and passwords" keeps the article's wording at the cost of two words.

12. Note. articles/short/what-we-can-see.md line 11. "A week of changes to one family of software packages" drops the article's "the public projects in". The sources see only public projects, and the sentence before it has already said each count comes with its limits stated, so the loss is small. "A week of changes to the public projects in one family of software packages" restores it if the words can be found; see the next finding for the room.

13. Note. Word counts. Counted by whitespace-separated tokens with Python, body meaning the paragraphs between the byline and the rule: the xz short form has 193 body words in four paragraphs (title 18, byline 4 words and a middle dot, colophon 67); the survey short form has 195 (title 16, byline the same, colophon 65). Both are under two hundred on that reading; if the byline were counted as body, the survey form would sit at 199 or 200 depending on whether the dot is a word, so it has no room at all under the strictest count and five words under the natural one (derived measurement). Findings 10 and 12 add two and four words; finding 9 adds one to the xz form. If the driver takes finding 12, a word must come out elsewhere in the survey form, for example "Several organisations publish figures that look like pieces of the answer" to "Several organisations publish figures that look like parts of one".

14. Note. The short forms meet the rest of the piece rules. Each has the article's title, an opening on the thing itself (a man and a delay; a question), a discreet date and byline in the same form as the articles, one idea the reader could say back (evidence available is not evidence recognised; the figures will not add), no internal reference in the prose, "we" as the voice, British spellings, no em or en dash, and a colophon that points down to the article with the article's version and release date. Neither has an illustration; the ticket does not ask for one in a short form and the articles' figures are one link away. The survey short form does not mention the Anthropic Economic Index, so the interest the article's colophon discloses does not arise in it.

All three pieces

15. Note. The class of claim that needs a person. Nothing in the three pieces says that harm is happening now, names a system as compromised today, or would need a person under LH F01. The front page and the xz short form tell a past case in the past tense, disclosed by the project itself and carrying a public CVE; "We cannot say how many quieter cases have passed unseen" and "What lies outside it we have not observed, which is not the same as saying nothing is there" are stated unknowns, not claims. The survey short form says the figures will not add and that an overlap is unmeasured. Nothing is irreversible outside the repository.

16. Note, outside the pieces under review. articles/what-we-can-see.md line 65. The released survey article's colophon cites "Lighthouse's survey of seventeen public sources on AI activity, version 0.3" and, in the same paragraph, the sources table at "version 0.4"; studies/LH003/LH003.md is at version 0.4 and registers/releases.md records the evidence version as 0.4. A stale number in a released piece, for the driver to carry into a correction record under LH F05's form when the article is next touched; it does not bear on the short form, whose colophon cites only the article's version.

Verdict

• README.md, the front page above the rule: release. Finding 1 is a one-word should-fix the driver can take in the release commit; findings 2 to 7 are notes. Every sentence traces to the xz article or to the records, the map is complete as far as the record goes, and the next question is the LH002 ticket's own.
• articles/short/the-xz-backdoor.md: release. Findings 8 and 9 should go in the release commit; finding 11 is a note. Every sentence traces to the article at version 1.0, and it reads cleanly aloud apart from the pronoun in finding 9.
• articles/short/what-we-can-see.md: release. Findings 8 and 10 should go in the release commit; findings 12 and 13 are notes. Every sentence traces to the article at version 1.0; the one-job passage carries it as it carries the article.
• Below the rule, "What Lighthouse is" agrees with the charter and D-0005 (finding 7).
• Nothing in the three pieces falls into the class of claim LH F01 reserves for a person (finding 15).

What the review could not check

• Who cut the short forms, and on which model. The E-0006 dispatch record lives in harbour/.session/, which this review does not read, and the last export (2026-09-26T09:33:51Z) predates E-0005 and E-0006. The driver knows and can put it in the colophon (finding 8).
• No public page was fetched. The pieces make no claim the articles do not, so the check stops at the articles, whose claims R-0002 checked against eight sources on the same day; the Economic Index, deps.dev, OSV.dev, NVD, Red Hat and Fedora pages rest, as before, on the records and R-0001.
• The timeline SVG was not rendered; it is byte-for-byte the file R-0002 measured, and this review relies on that measurement. The README's rendering of the LH002 anchor link was derived by GitHub's heading rule, not tested in a browser.
• Reading aloud was a silent read for rhythm, twice through each piece. No audio was produced.
• Word counts are whitespace tokens; a different counter would move each figure by a word or two, and finding 13 says where the margin is.
• The review's own cost is not measured here; the driver posts it from the transcript.