This week, the Academy read its own estate the way it reads everyone else's: as evidence. A security review covered the whole domain. The map's geometry was rebuilt from source. Detroit's transit app got a new front door. A second city went live. The record, at the size it actually is:

A new front door, and straighter lines

Live Transit Detroit opens with a question now — what do you want to do? Six tiles answer it: live map, plan a trip, ride along, all routes, near me, alerts. The location prompt that used to greet every visit is deleted, and "just the map" is still one tap away; the choice is remembered for the next visit.

Underneath, the map was rebuilt from the agencies' own published shape data. One downtown route had been rendering as a crumpled fold — a reader caught it in a screenshot — and it now draws as the single smooth loop the bus actually drives. The rebuild covers all 206 route paths across DDOT, SMART, and the QLINE, and every path now carries a public provenance record: which feed version, which source shape. If a line on the map is wrong, its paperwork sits next to the line.

Philadelphia is live — as a page

Philadelphia is the second city on the same engine: 178 SEPTA routes and 13,665 stops, live bus and rail vehicles in separate feed sections, at detroitautomationacademy.com/live-transit/philadelphia/. It is a working map, published when it existed. The agency has not been approached and nothing has been announced; we are not calling a page a launch.

Its data froze this morning, and the cause is worth printing: the collection workflow had run exactly twice in its life, both times by hand — its schedule never fired. The repair is a watchdog on the same pattern Detroit's feeds already use, checking the data's age every two minutes and dispatching the collector when it goes stale. Two consecutive watchdog-driven refreshes are verified in the record. The cadence it holds is five to eight minutes.

The audit turned inward

Eighty files that were never public material — internal charters, infrastructure documents, a customer-relationship codebase — moved out of the public repository into a new private one, byte for byte. The deploy workflow no longer copies files by pattern; data publishes from an explicit list, so the next internal file cannot become public by accident of its name.

One question deserved a documented answer. A hash of an owner token from September's console builds sits in the repository's public history. The October repair record proves the token was never rotated. It also proves the token is accepted nowhere: the page that checked it was deleted, the server that would have succeeded it was never deployed, and the token file is gone. It is burned, and it will never be reused. The history stays unrewritten — a rewrite cannot retract the copies that exist, and the hash unlocks nothing.

The week's noisiest failure was smaller. About six hundred failure emails traced to one unformatted Python file failing a formatting check on every commit — including the feed's own data commits, every few minutes. The file is formatted, the pipeline is green, and data commits no longer trigger the pipeline at all. Across the workflows, third-party actions are now pinned to exact commits, the secrets-bearing workflows run on Node 22, and the three places in the app code that took data-file values without escaping are fixed. A full audit of the rest found no exploitable sink. A security.txt — the standard address for reporting what we missed — is live.

One disclosure that did not apply

This year's disclosure batch included a pair of critical PHP flaws: unauthenticated remote code execution, scored 9.2, with a public exploit reported. The estate's exposure is zero, by construction — there is not one PHP file in its 1,032-file tree. Justin kicked PHP in college.

What is still open

Two items remain open, named rather than smoothed over. The domain's mail protections — a DMARC record, a tightened sender policy, certificate-authority restrictions — are written and waiting on a paste that only the account holder can make. And the host cannot serve security headers; closing that gap is a hosting decision, not a code change. Both are on the record, with owners.

The close

That is the week: a new front door, straighter lines, a second city, and an estate that keeps less of itself in public than it did on Monday. The Signal publishes on Fridays now — this is the first one.

Canonical record and full technical detail: the Academy's publish logs and program records, at detroitautomationacademy.com/signal/.

---

The Signal is the newsletter of Detroit Automation Academy — where Detroit builds what's next. If you know a young builder who should be in the room, send them our way.