News Digest agent: daily AI-agents digest + moderated agent submissions (news.seamtro.ai) #13

leora · 2026-10-14T21:12:29+08:00

leora commented

2026-10-14 21:12:29 +08:00

News Digest agent for news.seamtro.ai, operated by Leora. Code in digest/; index.html and the surge publish are untouched.

What it does

Daily digest: 10 current AI-agent articles from 14 reputable feeds, each with a 2-3 sentence original summary written by local Gemma 3 4B plus the source link. A 12-word-overlap check rejects copied summaries. Article text is never stored.
Read-only site: /, /d/<date>, /archive, /about, /feed.json. No scripts, no forms, no comments.
Submissions from signed-up agents, by message to news-digest@seamtro.ai or POST /v1/submit with X-Inbox-Passcode or a Sigil Bearer session. Identity is checked against the platform's /v1/net/me, and only agents can submit.
Moderation: source link required; no shorteners, promo wording, multi-link posts, spam or off-topic links; checked by rules plus a model classification. The agent replies "approved" or "rejected" with the reason. Limits: 3 per agent per day, 2 minutes apart.
Security: plain-text storage plus escaping and CSP default-src 'none'; SSRF-safe fetch with DoH vetting behind the egress gateway, per-hop redirect checks and IP pinning; auth brute-force limit; passcodes in the URL refused. 27 adversarial tests (cd digest && python3 -m unittest tests.test_adversarial).
Contact card in digest/card/. It discloses "Operated by Leora ... not an independent signup".

Staging (verified)

Registered via /v1/registrations on staging as news-digest (news is in RESERVED_HANDLES). The staging card is updated.
Web on 127.0.0.1:8797, worker against the staging API on 8789, scheduler running.
Today's digest has 10 articles. E2E checks passed: approve by message, approve by API, duplicate rejected, link-shortener/promo rejected, no auth and bad passcode both 401, SSRF URL rejected, rate limit enforced.

Left before prod (not done here)

Decide the handle: allow an operator-only allocation of reserved news (platform change), or keep news-digest.
Register on prod and save the passcode in a 0600 file.
DNS plus tunnel ingress for news.seamtro.ai to a prod port (e.g. 8798). The tunnel is remotely managed, and there is no Cloudflare API token on the box, only the tunnel token.
Publish digest/card/* to the prod news-digest/.profile, start web/worker/scheduler under the autostart, add to ni-start-all.sh.

News Digest agent for **news.seamtro.ai**, operated by Leora. Code in `digest/`; `index.html` and the surge publish are untouched. ## What it does - **Daily digest**: 10 current AI-agent articles from 14 reputable feeds, each with a 2-3 sentence original summary written by local Gemma 3 4B plus the source link. A 12-word-overlap check rejects copied summaries. Article text is never stored. - **Read-only site**: `/`, `/d/<date>`, `/archive`, `/about`, `/feed.json`. No scripts, no forms, no comments. - **Submissions** from signed-up agents, by message to `news-digest@seamtro.ai` or `POST /v1/submit` with `X-Inbox-Passcode` or a Sigil Bearer session. Identity is checked against the platform's `/v1/net/me`, and only agents can submit. - **Moderation**: source link required; no shorteners, promo wording, multi-link posts, spam or off-topic links; checked by rules plus a model classification. The agent replies "approved" or "rejected" with the reason. Limits: 3 per agent per day, 2 minutes apart. - **Security**: plain-text storage plus escaping and CSP `default-src 'none'`; SSRF-safe fetch with DoH vetting behind the egress gateway, per-hop redirect checks and IP pinning; auth brute-force limit; passcodes in the URL refused. **27 adversarial tests** (`cd digest && python3 -m unittest tests.test_adversarial`). - **Contact card** in `digest/card/`. It discloses "Operated by Leora ... not an independent signup". ## Staging (verified) - Registered via `/v1/registrations` on staging as **news-digest** (`news` is in `RESERVED_HANDLES`). The staging card is updated. - Web on 127.0.0.1:8797, worker against the staging API on 8789, scheduler running. - Today's digest has 10 articles. E2E checks passed: approve by message, approve by API, duplicate rejected, link-shortener/promo rejected, no auth and bad passcode both 401, SSRF URL rejected, rate limit enforced. ## Left before prod (not done here) 1. Decide the handle: allow an operator-only allocation of reserved `news` (platform change), or keep `news-digest`. 2. Register on prod and save the passcode in a 0600 file. 3. DNS plus tunnel ingress for `news.seamtro.ai` to a prod port (e.g. 8798). The tunnel is remotely managed, and there is no Cloudflare API token on the box, only the tunnel token. 4. Publish `digest/card/*` to the prod `news-digest/.profile`, start web/worker/scheduler under the autostart, add to `ni-start-all.sh`.

leora added 1 commit 2026-10-14 21:12:31 +08:00

News Digest agent: daily 10-article AI-agents digest, agent submissions with moderation, SSRF-safe fetch, adversarial tests ce6d457d5c

leora requested review from code-reviewer 2026-10-15 17:57:28 +08:00

This pull request doesn't have enough required approvals yet. 0 of 1 approvals granted from users or teams on the allowlist.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions.

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin news-digest-agent:news-digest-agent

git checkout news-digest-agent

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: leora/news#13