# N.T.O.I.D. — daily update checklist

One pass per active board, every day, in this order. Budget: 20–30 minutes per board. If a step
cannot be completed honestly, leave the board as it is and write the gap in `notes` — a stale
board with a dated stamp is better than a fresh board with a guessed line.

## 0. Before touching a file

- [ ] Work on a branch. Never commit to `main`; never deploy from this checklist (deploy is a separate, owner-approved step).
- [ ] Re-read the board's `notes` and the last `changelog` entry: those are yesterday's open gaps.
- [ ] Read [METHOD.md](METHOD.md) §1–§5 if you have not updated a board this week.

## 1. Re-check the recurring sources (Netherlands)

Every URL below answered HTTP 200 on 2026-11-08. If one is dead, do **not** replace it with a guess: note it in `notes` and find the new canonical page by navigating from the site root.

| Cadence | Source | URL | What you are looking for |
|---|---|---|---|
| daily | NCSC advisories (RSS) | https://advisories.ncsc.nl/rss/advisories | `[H/H]`-class advisories touching widely used Dutch infrastructure; a cluster of them in a day |
| daily | NCSC news (RSS) | https://feeds.ncsc.nl/nieuws.rss | incidents NCSC confirms, "in het nieuws" items |
| daily | NCTV news | https://www.nctv.nl/actueel | new threat assessments, DTN changes, campaign releases |
| daily | NOS searches | https://nos.nl/zoeken?q=sabotage · `hybride` · `drone` · `AIVD` · `Noordzee` · `chip` · `stroomnet` | confirmed incidents (canonical URLs, dated) |
| 2–3×/week | Defensie news | https://www.defensie.nl/nieuws | deployments, posture, exercises, budget |
| 2–3×/week | Rijksoverheid news | https://www.rijksoverheid.nl/actueel/nieuws | crisis-plan phases, emergency measures, Kamerbrieven |
| weekly | AIVD news | https://www.aivd.nl/actueel | public statements, annual report (April) |
| weekly | Denk Vooruit | https://www.denkvooruit.nl/ | changes to the household advice we quote |
| ~2×/year | NCTV DTN | https://www.nctv.nl/onderwerpen/d/dtn | terrorism level (1–5) |
| yearly (Nov) | NCTV CSBN | https://www.nctv.nl/onderwerpen/c/cybersecuritybeeld-nederland | next edition |

Social posts, forwarded screenshots and single-outlet headlines are **tips**: go and find the primary page. If none exists, the item is not on the board.

## 2. For each new item, decide

- [ ] **Kind:** `fact` (it happened, primary source) · `official-claim` (an authority says so; attribute it) · `analysis` (our reading; say so).
- [ ] **Attribution:** `open` until an authority names the actor. Never promote to `confirmed` on a journalist's or a politician's say-so.
- [ ] **Source:** `name`, `url` (https, fetched by you today, HTTP 200), `date` from the page's own metadata. Never hand-type a URL from memory. Never link a search result page as the source of a fact.
- [ ] **Does it change a level?** Only if the sources now meet a different row of the METHOD.md §1 table. A worrying headline is not a level change; an official statement or a confirmed incident may be.
- [ ] **Wording:** calm, newspaper, no adjectives the source did not use. Paraphrase Dutch in English; the link carries the original.

## 3. Edit the board (`data/<cc>.json`)

- [ ] `updated_at` → now, Europe/Amsterdam offset (`+01:00` winter, `+02:00` summer).
- [ ] For each indicator that moves: set `previous_level` to the old level, `level` to the new one, `last_change` to today, `moved_this_update: true`, rewrite `level_basis`. For indicators that do not move: `previous_level = level`, `moved_this_update: false`, leave `last_change`.
- [ ] `composite.previous_score` ← old `composite.score`; then run the validator and copy the computed score it reports into `composite.score`.
- [ ] `watch_level.previous` ← old level; set `level` to what the validator computes. If the validator says the level would change but no indicator moved (indicator added/removed/re-weighted), **hold** it: keep the old level, add `hold: {reason, computed_level}`. If the computed level is two or more steps away, move one step toward it and add `hold: {reason, computed_level}` for the rest (`level` is then one step from `previous`, not equal to it). Set `since` to today only when the level changes.
- [ ] Hazard band and story stage: every update, set `hazard_band.previous` ← old band and `story_stage.previous` ← old stage (same as `watch_level.previous`), so an unchanged label reads `previous == band`. Change a label only on a sourced event: then `since` ← today, rewrite `basis`, add the source. The validator refuses a label whose `previous` differs from its value with a `since` that is not today, and the page alerts only on that difference — so a stale `previous` would alert on every later update.
- [ ] `household.what_changed` — rewrite every update, even when the answer is "nothing moved; here is what we checked". `why_it_matters` and `prepare` change only when the preparedness authority's advice changes.
- [ ] Prepend a `changelog` entry (latest first) naming every indicator that moved and every hold.
- [ ] Drop anything from `notes` that is now sourced; add anything you could not source today.

## 4. Validate and build

```sh
python3 tools/validate.py data/*.json      # rc 0, no "error:" lines
python3 tools/build.py                     # writes dist/
for t in tests/test_*.py; do python3 "$t" || echo "FAIL $t"; done
```

- [ ] Open `dist/index.html` in a browser (file:// is fine). Read the board **as a reader would**: does the alert strip show exactly the indicators that moved, and nothing else? Does every source link open?
- [ ] Check the page at phone width.

## 5. Alert rules (what gets announced, METHOD.md §5)

Announce **only** when:

- an indicator `level` changed (say from what to what, and the source that moved it);
- the watch level changed (always with the indicators that moved it);
- the hazard band or story stage changed.

Never announce a composite change on its own. Never announce a hold as a change. Never use the words "imminent", "war", "attack" unless quoting an authority, in quotation marks, with the link.

## 6. Hygiene before commit

- [ ] `git diff` — only `data/`, `dist/` and (rarely) this file or METHOD.md changed.
- [ ] No credentials, IP addresses, server paths, internal hostnames or personal data anywhere (the validator refuses a board that carries any; `tests/test_hygiene.py` checks the rest of the repo).
- [ ] Commit message: `nl: <date> update — <indicators moved, or "no movement">`.
- [ ] Open a PR; a reviewer reads the diff against the linked sources before merge. Deploy is a separate owner-approved step.

## 7. Starting a template board (in this order: BE, DE, FR, UK, BALT, ES, RO)

- [ ] Find the country's public-preparedness authority page and the national cyber/terrorism coordinators' current assessments; fetch each URL.
- [ ] Write 8–12 indicators only in domains where a source exists. Leave the others absent.
- [ ] Set `status: active`, add `composite`, `watch_level`, `household`; remove the template `notes` line. First assessment: `previous_level: null`, `previous: null`, `previous_score: null`.
- [ ] Validator rc 0, then follow §4–§6.
- [ ] Regional board (`balt`): name the member state each bullet concerns in the bullet text; `country.members` stays `["EE","LV","LT"]`.