Week ending 9/27

Executive summary

Two quiet weeks (14 to 24 September, no commits at all, the fourth and fifth in a row) gave way to the busiest three days of the quarter. Strategic conversations about a finishing point for translated materials continued without a committed direction yet: an open Bible-study reading experience built on the BibleRef API, a version gated behind a login, or a member/community site where small groups can form, is still under discussion rather than decided. What did ship, on 25 and 27 September, is a structural shift in how doctrine gets tracked across the platform. A Doctrine Knowledge Graph now lets a claim like "salvation is by grace through faith" be proposed, reviewed by a theologian, and explored visually, with an AI assistant proposing new claims from source documents and reviewers able to bulk-approve a backlog instead of clicking through one at a time. A second, public Library Graph auto-derives a browsable doctrine-and-glossary map for every published language from content already on the site, and by week's end could link the same doctrine across different books: Romans's "Adoption into God's Family" and Galatians's "Adoption and Sonship" now resolve to one shared concept, with 1,311 such concepts registered. The intent behind both is the same: instead of asking a human reviewer to hold every cross-reference in their head, the graph itself can show how a doctrine is taught across scripture and feed that structure into translation requirements. Separately, a security architecture review from earlier in September was carried through its first two remediation phases: input validation, rate limiting, and CI now protect the platform end to end.

What's new

• Change

  Shipped the Doctrine Knowledge Graph: a propose-review-approve workflow for theological claims, an AI analyzer that proposes claims from source documents, a Cytoscape.js visual explorer, and bulk-approve for the review queue.

  Impact

  Doctrine claims now go through a reviewed, auditable workflow with an explorable graph instead of living only in prose documents.

  Next action

  Get real theologian reviewers using the bulk-approve queue against its current 21 claims and 13 relationships awaiting review.

• Change

  Shipped the public Library Graph: an auto-generated, per-language browsable map of every published language's books, doctrines, and glossary terms, derived from content already on the site.

  Impact

  Anyone can now explore how a language's doctrine and terminology connect, without a login, for all 67 published languages.

  Next action

  Watch real usage and extend the same build step to any newly published language automatically.

• Change

  Linked doctrines across books within the Library Graph via a new canonical registry (1,311 entries), so the same teaching in two different books resolves to one concept with an "also taught in" and "related doctrines" view.

  Impact

  Translators and reviewers can now see every book that teaches a given doctrine and keep terminology consistent across them, closing a gap the feature launched with only two days earlier.

  Next action

  Extend registry coverage to languages whose doctrine phrasing diverges from the Spanish reference set (Vietnamese currently has the largest gap).

• Change

  Carried a security architecture review from 20 September through Phases 1 and 2: input validation, a database-backed rate limiter across roughly 20 endpoints, security headers, and a CI pipeline with tests, type-checking, and a dependency-advisory gate.

  Impact

  Closes an open redirect, an email header-injection path, and a bug that let anyone write unauthenticated text into production logs through the Crowdin integration; every future pull request is now tested automatically.

  Next action

  Confirm the mail-provider and bot-check vendor decisions, then schedule administrator MFA enforcement at Google and Microsoft.

Business impact

Ministry partners get a concrete, explorable answer to "does your platform keep doctrine consistent across books and languages," not just an assurance. The same registry that links Romans and Galatians works for every one of the 67 published languages without per-language work. The security work closes an open redirect, an email header-injection path, and an unauthenticated log-injection bug in the Crowdin integration, and puts automated tests and a dependency-advisory gate in front of every future pull request for the first time. None of this yet resolves the open product-direction question on public Bible study access, and the reviewer-recruitment gap (539 decisions, zero reviewers) did not move this week either.

Metrics

• Canonical doctrine concepts linking doctrines across books

  1,311(was n/a) ▲ Up from last period

  New this week. Seeded from Spanish (the most complete language, 67 books) and hand-merged for verified duplicates, e.g. Romans/Galatians/Ephesians/Philippians's shared "adoption" doctrine.

• Languages with a generated Library Graph

  67(was n/a) ▲ Up from last period

  New this week, matching every language with a published Library bundle.

• Production npm audit advisories (high or above)

  8(was 22) ▼ Down from last period

  Non-major-version upgrades applied; the remaining 8 all need a major version bump and are recorded as accepted risks with a written reachability check.

• Security deploys attempted this week

  2 of 2 eventually succeeded(was n/a) → No change from last period

  The first attempt failed on a migration-numbering collision with the same-session Doctrine Knowledge Graph work; fixed and redeployed the same day with no production impact (Netlify does not publish a deploy that fails its migration step).

• Registry decisions awaiting a reviewer

  539(was 539) → No change from last period

  Unchanged. German 137, Spanish 203, Burmese 199. Still no reviewer assigned, seven-plus weeks since the review tool shipped.

• Languages with a complete New Testament

  57(was 57) → No change from last period

• Book pages live in the Library

  1,939(was 1,939) → No change from last period

  No language package logged new book content this week; the week's work was tooling and features, not content generation.

• Languages with a published Library bundle

  67(was 67) → No change from last period

Risks

The two knowledge-graph systems and the security remediation shipped in a single three-day window with no time to observe them in production before this report; the security migration deploy failed once already (see Metrics) and needed a same-day fix, a reminder that a numbering collision between two features built in the same session can fail a deploy outright. The security plan's own vendor decisions (a transactional mail provider, a bot-check provider) are assumed defaults, not confirmed choices, and the administrator MFA change has no actual security effect until MFA is enforced at Google and Microsoft, a step this repository cannot do itself. Two full weeks of no commits at all, now a fifth and sixth such week since early August, remain unexplained.

Decisions needed

Leadership: decide the shape of the public-facing Bible study experience (open page, gated login, or member/community site) so it can move from conversation to a plan. Confirm or replace the assumed mail provider (Postmark) and bot-check provider (Cloudflare Turnstile) so the security work's Phase 2 controls can actually be turned on. Schedule enforcing MFA for administrators at Google and Microsoft, without which this week's login-policy change is precautionary only. Reviewer recruitment against the 539-decision queue remains unresolved after six-plus weeks.

Next Week

• Decide the shape of the public Bible-study experience (open page, gated, or member/community site)
• Confirm the mail-provider and bot-check vendor decisions so Phase 2's controls can be turned on
• Schedule administrator MFA enforcement at Google and Microsoft
• Name the first volunteer reviewers against the still-unstaffed 539-decision queue

Key dates

No key dates recorded for this period.