Report Desk
Publishing console Agent JSON

Publish a report

Use the publishing console yourself, or give an agent this page and the passcode through a private channel. The agent contract is exact, revision-safe, and contains no credential.

Open publishing console Open machine-readable contract

For people

  1. Open the console

    Go to /manage/. It redirects to the isolated admin origin.

  2. Enter the passcode

    The passcode stays in that page's memory and is sent only as bearer authorization for management requests.

  3. Select a complete package

    Choose a folder whose root contains index.html. Local HTML, CSS, JavaScript, images, and other assets are preserved.

  4. Publish and verify

    The console uploads the package, publishes the resulting revision, and gives the canonical /{report-id}/ address.

For agents

Send this prompt with the report package. Provide the passcode separately.

Publish the report package I provide to Report Desk.

1. Read and follow https://reportdesk.pages.dev/post/agent-publishing.json.
2. Inspect the management catalog before creating anything.
3. Ask me for the publishing passcode only when you are ready to send authenticated requests. Keep it only in memory or REPORTDESK_PASSCODE. Never print, log, commit, upload, or return it.
4. Default to creating new content. Do not overwrite, move, unpublish, or delete existing content unless I explicitly authorize the exact target.
5. Carry forward the revision returned by every successful mutation. On a revision conflict, stop and reconcile instead of forcing an overwrite.
6. Publish only after the package root contains index.html.
7. Verify the canonical report URL, local assets, interaction, and injected Report Desk search bar.
8. Return the canonical URL, final revision, uploaded file count, and verification outcome. Never include the passcode.

Publishing protocol

OrderRequestRevision rule
InspectGET /api/manage/catalogFind existing projects, IDs, and current revisions.
ProjectPUT /api/manage/projectsCreate only when absent; publish the parent project.
MetadataPUT /api/manage/reportsUse expectedRevision: 0 for creation; then read report.revision.
FilesPUT /api/manage/files?reportId=&path=&expectedRevision=Send raw bytes one file at a time; carry forward file.revision.
PublishPOST /api/manage/publishUse the final upload revision; publishing returns the next revision.
VerifyGET /{reportId}/Confirm the report and all local assets work.

Package and security rules

  • Every package requires a root index.html; each individual file is limited to 25 MiB.
  • Project IDs, report IDs, and optional legacy source paths are lowercase URL-safe slugs with no namespace collisions.
  • File paths are relative, use forward slashes, and cannot contain traversal or dot segments.
  • Every mutation drafts the report and advances its revision. Never guess a revision after a failed request.
  • On 409 revision_conflict, refresh the catalog and reconcile with the owner.
  • Direct agents use HTTPS bearer authorization. Browser JavaScript is accepted only from the isolated admin origin.
  • Never place the passcode in this page, the JSON contract, a report package, URL, source file, commit, log, screenshot, or completion message.
  • Deletion is outside the normal publishing workflow and requires explicit confirmation for the exact target.