v1.10.0 — Working Groups page and milestone-aware roadmap

The headline this cycle is a dedicated Working Groups page: each of the four groups gets its own section with an objective, its leadership, and a live membership grid drawn straight from the COST directory, and the Action's Memorandum-of-Understanding titles are adopted across the whole site. The public roadmap learns to read its own GitHub milestones, showing a progress bar on every in-flight release and marking the next one as in progress on its own. Around those two sit a wave of conference run-up for the European Security Conference and the usual directory and data housekeeping.

A home for the Working Groups

/working-groups.html (with hand-translated FR and DE) gives each Working Group an anchored section: the objective from the MoU, a row of focus areas, the lead and co-lead, and an expandable grid of every member with their country, all rendering at runtime from data/wg.json. That file is a new fourth surface the weekly cost.eu sync writes, so a leadership or membership change on the COST directory now flows through to the page, the home-page cards, the About leadership, and the directory filter with no hand-edit. The MoU titles (Building the Network, Transfer of Knowledge, Fostering the Next Generation of Scholars, and Inclusion, Representativeness & Ethics) replace the old working placeholders everywhere. Events and Working Groups cross-link both ways: the page lists the events a group runs, and each home-page Events card shows the groups its event serves.

A milestone-aware roadmap

The public roadmap now reads the repository's own GitHub milestones. Each in-flight card shows a progress bar of issues closed over total, refreshed automatically whenever an issue or milestone changes, and the next incoming release marks itself as in progress with a softly blinking dot. The Under-watch section gained a count of what sits parked there. The milestone discipline that has always driven release planning behind the scenes finally has a visible public payoff.

Conference run-up

With the European Security Conference approaching, the live ESSC programme and the FAQ both got attention. The programme now lists non-presenting co-authors alongside the speakers, carries a last-synced cue so a panelist who just edited Indico understands why the page is a day behind, and offers a one-click download of the official PDF (the browser print-to-PDF path had a chain of Chrome-specific truncation bugs, all now fixed). A new At a NetSec conference FAQ section, with matching signposts on the contact form and the programme page, answers the recurring questions about correcting your details, printing the programme, chairing a panel, and requesting a visa letter.

Directory and plumbing

The weekly member-spotlight engine and its home-page block both landed dormant, waking once ten members are eligible. Directory keywords now fold American spellings to British English so a submitted Defense reads as Defence, the Working-Group filter follows a leadership change on cost.eu on its own, and a long-standing imprecision in where anchor links land under the floating header is fixed.

Index of changes

Added

• Related events on the Working Groups page. An event in data/events.json can now carry a workingGroups array, and the Working Groups page renders a compact Related events card for each event tagged with that group. The NetSec Early-Career Scholars Summer School is tagged WG2, WG3, and WG4, and the European Security Conference is tagged across all four groups, so each event appears under the groups it serves with no duplication in the data. assets/js/working-groups.js fetches events.json alongside the WG data and fails soft if it is absent (the leadership and member render is unaffected). Cards localise the title, date, and event type EN/FR/DE, and a group with no tagged events shows nothing. While here, a .prose-page a underline that was bleeding onto the member and leadership cards was scoped out, so those cards read as tiles.
• Working-Group pills on the home Events cards. The reverse of that Related events block: each card in the home Events section now shows a small colour-coded pill for every Working Group the event serves, read from the same workingGroups tag, each linking to that group's section on the Working Groups page. So the Events ↔ Working Group relationship reads both ways (the Summer School shows WG2 / WG3 / WG4, the European Security Conference all four). Rendered by assets/js/home-events.js, EN/FR/DE, and an untagged event shows no pills.
• Milestone progress bars on the public roadmap. Each in-flight card on /roadmap.html (+ FR + DE) now shows a progress bar fed by its GitHub milestone, the closed-over-total issue count as a percentage (for example 29% · 2 of 7 tasks done). scripts/sync-roadmap-progress.py writes data/roadmap-progress.json and a roadmap-progress.yml workflow refreshes it on every issue and milestone change (auto-PR, like the cost.eu and Indico syncs), so closing an issue moves the bar with no manual edit. assets/js/roadmap-progress.js renders the bar onto the card carrying the matching data-milestone, the fill follows the card's status colour, and the page fails soft when the JSON is absent. Shipped cards keep just their Shipped pill. The same renderer also marks the next incoming release (the first still-planned version card) as In progress automatically, with a slow-blinking status dot, so whichever release is next-up reads as active with no per-release edit (the static markup stays planned, so the release tooling is unaffected). The Under watch section heading also shows a small count of the items parked there. Localised EN/FR/DE and covered by scripts/test-roadmap-progress.py. This gives the milestone discipline of rule §10 a visible public payoff.
• Dedicated Working Groups page (/working-groups.html + FR + DE). Each of the four Working Groups gets its own anchored section with its objective (lifted from the Memorandum of Understanding), a row of focus areas each carrying a line icon, its lead and co-lead, and an expandable grid of every member. The page opens with an overall stats strip (people across the four groups, countries represented, and the group count), computed client-side from data/wg.json so it tracks the weekly sync. Every member card shows the member's country (a directory bio adds a photo and a link to their card). Leadership and membership render at runtime from data/wg.json, so a change on cost.eu flows through with no hand-edit, and the page fails soft to a static fallback. The global nav Working Groups link now points here instead of the home-page overview section, the four home-page Working Group tiles link through to their section, and the page joins the sitemap (XML, the visual /sitemap.html, all three locales). Closes #378.
• Working Groups data layer (data/wg.json), synced from cost.eu. The data half of #378. scripts/sync-cost.py writes a fourth surface: a per-WG dataset giving each of the four groups its lead and co-lead (read from each bio's wg_leadership) and every member of the group (name and country from cost.eu's Membership table, plus a directory slug for those who also have a bio). WG titles and the colour palette are config in the script, the file regenerates every weekly sync and is never hand-edited, so a leadership or membership change on cost.eu flows straight through. Covered by a new case in scripts/test-sync-cost.py.
• ESSC programme now lists non-presenting co-authors alongside speakers. Indico keeps presenters and co-authors in separate lists, and the live programme grid on /essc-2026.html (+ FR + DE) used to show only presenters, so multi-author papers under-listed their co-authors versus the printed programme. scripts/sync-indico.py now emits a full author byline per contribution (a people array with a speaker flag), and the renderer prints every author, marking presenters with a small microphone icon, shown only on papers that actually mix speakers and co-authors, so single-author talks stay clean. The microphone carries a localised Speaker / Intervenant·e / Vortragende·r label for assistive tech, and member-card links still resolve for co-authors who are NetSec members.
• FAQ now answers the recurring conference-participation questions. A new evergreen At a NetSec conference section on /faq.html (+ FR + DE) covers correcting your name, affiliation, or paper title on the programme; finding and printing the programme as a PDF; whether chairs can reorganise their own panel; and requesting a visa letter of invitation. The edit-my-details answer reflects how Indico actually works (it stores a per-event snapshot, so changing your personal profile does not update the programme; the paper title is self-editable on your contribution, while name and affiliation come to us or are fixed on the contribution's author entry). Recurring panelist requests can now self-serve or arrive complete and correctly addressed. docs/admin-guide.md gains the matching organiser-side setup (granting chairs session-coordinator rights each edition, and the document-generation route for invitation letters). First step of #332.
• Self-service signposting on the contact form, the ESSC page, and the glossary. The home-page contact form (EN + FR + DE) gains a short pre-submit signpost pointing the recurring conference questions (correcting your details, the printable programme, visa letters) at the new FAQ section, plus an optional topic dropdown so enquiries arrive categorised for triage (the existing Formspree handler captures it with no code change). The ESSC programme page carries a matching Speakers & chairs practical block linking through to the FAQ, and the glossary gains an Indico entry so the platform has a referent. Continues #332.
• Last-synced cue on the ESSC programme. The live grid now shows a localised Programme updated <date>; refreshed from Indico daily, overnight line under the heading, read from indico.json's syncedAt. It heads off the "I edited Indico, why is the site still wrong?" email by making the once-daily sync lag visible: a panelist who just edited sees the page is dated before their change and knows to check the next morning. Date formats per locale (EN/FR/DE). Closes the on-page cue from #332; docs/admin-guide.md records that invitation letters use Indico document generation (signatory to confirm).
• Directory join card now deep-links the FAQ. The Join the network card on /people.html (+ FR + DE) points newcomers at the FAQ's how to join and how to update your details later answers, closing the one signposting gap a user-path simulation found: the network-candidate journey previously only reached the FAQ via the global nav, with no contextual link at the point of joining.
• Weekly member spotlight, rotation engine (dormant for now). Groundwork for a home-page block that showcases one network member each week (issue #341). scripts/rotate-spotlight.py picks the week's member from data/bios.json using a balanced-rotation score: an early-career boost and a professor de-prioritisation inferred from the public job title, an Inclusiveness Target Country boost from country_code, and a Working-Group-balance boost, with recently-featured members held out and a pinned override for manual picks. Gender is deliberately not scored; the maintainer corrects any imbalance via the override. It stays dormant until at least 10 members are eligible (a member needs a photo and a written bio; the count is 4 today), so nothing renders yet. A weekly spotlight-rotate.yml workflow opens an auto-PR like the other syncs. Covered by scripts/test-spotlight.py.
• Member spotlight documented as an inclusiveness feature. The press kit (/press-kit.html + FR + DE) gains a short talking point framing the weekly spotlight as a concrete inclusiveness measure for early-career investigators, and the stakeholder documentation pack source (docs/pdf/documentation.html) gains user-facing and operator-facing feature-inventory entries with the same ECI framing. The built PDF refreshes at the v1.11.0 release per the usual cadence.
• Weekly member spotlight, home-page block. The renderer half of #341. assets/js/home-spotlight.js reads data/spotlight.json + data/bios.json and renders the featured member into a new section on the home page (EN/FR/DE), reusing the member-card visual language: photo or initials, name, role, country flag, Working-Group badges, research-interest chips, a clamped bio, and a View full profile link that deep-links the directory card. The block stays hidden while the spotlight is dormant (under 10 eligible) and self-heals if the featured member becomes ineligible, so it renders nothing today. docs/admin-guide.md documents the pinned manual override.
• Download the ESSC programme as a PDF. The programme page (/essc-2026.html + FR + DE) gains a Download programme (PDF) button above the day shortcuts, linking the official, tailored conference programme supplied by the EISS organisers (committed at assets/programme/eiss-2026-programme.pdf). It exists because Chrome's interactive Save as PDF truncates the long programme mid-document (a Chrome print-fragmentation defect, reproducible in the print preview itself; Safari prints the page fine). The button is localised EN/FR/DE and is hidden when the page itself is printed. The FAQ's Where do I find a printable or PDF version? answer now points at the download and records the Chrome limitation.

Changed

• Working Group names now follow the Memorandum of Understanding everywhere. The four groups are named Building the Network, Transfer of Knowledge, Fostering the Next Generation of Scholars, and Inclusion, Representativeness & Ethics, the authoritative titles from the MoU, replacing the earlier working placeholders (Management & Coordination and so on). Corrected on the home-page cards, the About leadership cards, the glossary, and the new Working Groups page, across all three locales. The home cards also pick up MoU-aligned descriptions and a network icon for WG1.
• FAQ conference questions regrouped by who's asking. In the At a NetSec conference section (EN + FR + DE), the I'm chairing a panel question now sits directly after I'm speaking at a NetSec conference, so the two participant-role questions are adjacent, with the general logistics (printable programme, visa letter) after them. Content unchanged, order only.
• ESSC self-edit guidance now links straight into Indico. A second live test confirmed a plain speaker (with an Indico account) can edit their own contribution, so the FAQ edit-my-details answer (EN + FR + DE) now leads with the self-edit route, deep-links My Contributions (event/22/contributions/mine), and spells out the small-pencil path for changing a name or affiliation. The chairing-a-panel answer deep-links My Sessions (event/22/sessions/mine). docs/admin-guide.md records the event/<id>/{contributions,sessions}/mine link format and that it is per-edition. Follows #332.
• ESSC self-service guidance now matches how Indico actually behaves. A permission test on the live event settled the open question: once a paper is accepted the Call for Abstracts pencil greys out (the abstract is locked), but a panel chair granted modification rights can edit every talk in their session (title, speakers, and author affiliations), verified by logging in as a chair. The FAQ edit-my-details and chairing-a-panel answers (EN + FR + DE) now lead with the chair route, explain the greyed-pencil as expected, and frame author self-edit (via My Contributions) as a conditional convenience. docs/admin-guide.md records the exact organiser settings (bulk Grant modification rights to all session conveners, plus optional submitter Edit (basic) + submission rights) and the two limits (locked abstract, account-less authors). Settles the Indico-permission prerequisite of #332.
• FAQ copy edit: voice-rule sweep across all three locales, a removed entry, and a clearer photo-update answer. The prose semicolons on /faq.html were rewritten as full stops or commas per the voice rules, and the same sweep now covers faq.fr.html and faq.de.html, where semicolons are uncommon too. The Why is the site so minimalist? entry was removed. The How do I update my bio, photo, or affiliation later? answer now explains that changing your photo uses the same Google Form as everything else (there is no separate headshot form), and reassures members that resubmitting keeps their existing data and only needs the required fields.
• Directory join card trimmed. The No form configured yet? Get in touch line was removed from the Join the network card on /people.html (+ FR + DE). The FAQ deep-link line stays.
• Roadmap promotion now derives shipped cards from CHANGELOG.md and relocates them by ship date. scripts/promote-roadmap.py (run by scripts/release.sh) used to flip only the status pill, date, and notes link, leaving the planned card's hand-authored <h3> + <p> describing planned scope rather than what shipped, and leaving the card in its original quarter even when the release crossed a quarter boundary. It now overwrites the title + body from the released CHANGELOG section's heading and lede, and moves the card into the QN / TN timeline matching the ship date. FR + DE card bodies get the EN copy plus a [à traduire] / [zu übersetzen] marker so check-i18n-drift.py flags them for a hand translation. The old git-blame staleness warning (which fired only after the wrong body had already shipped) is removed. Closes #233.
• Directory keyword normalisation now folds American spellings to British English. data/keyword-aliases.json gains a spelling section (a word-level US-to-British map) and scripts/sync-bios.py applies it during the keyword word-walk, so a submitted Defense renders as Defence on the member card and in the Research interests filter, with compounds like Cyber defense normalising too. Our first external directory submitter (Mr Felix Kösterke) had entered Defense; this folds the display form without rewriting his raw submission. The map covers common security and political-science cases (offence, behaviour, organisation, securitisation, modelling, neighbourhood, and similar); program is left alone since it is valid British English in the computing sense.

Fixed

• Working Groups page visual polish. The Working-Group tag in each section header was carrying a phantom 8px bottom margin and the heading a .prose-page h2 top margin, which knocked the tag out of vertical alignment with the title and left a large gap above each heading; both are now reset so the tag sits centred on the heading and the sections read tighter. The four jump-nav pills at the top lost their stray underline (the .prose-page a tie-break again) and gained a proper interactive treatment: a heavier label, a lift on hover, and a border that picks up that group's colour. Across all three locales.
• Header-anchor links now land precisely under the floating nav. The nav is position: fixed and its height shifts with the beta ribbon and the What's-New / event banner, so the old static scroll-padding-top left section headings tucked under it (the symptom: clicking Events in the header sometimes overshot the Events section, the more so once the home page's events and spotlight blocks rendered in after load). assets/js/site.js now measures the real header bottom and keeps scroll-padding-top in step (watching the ribbon/banner CSS vars), which governs native #hash landings and cross-page links. It also intercepts header and jump-nav links that resolve to the current page and scrolls to them in-page, so on the home page a index.html#events link no longer triggers a reload + native jump. The .wg-section scroll-margin that double-counted with the new offset was removed, and the in-page scroll honours prefers-reduced-motion.
• Directory WG filter now follows a leadership change on cost.eu. The per-bio wg_leadership object in data/bios.json (which the /people.html Working Group filter reads to place a lead or co-lead under their group) was hand-seeded and never reconciled by any sync. When a WG lead or co-lead changed on cost.eu, apply_leadership() in scripts/sync-cost.py updated only the flat roles array on the new holder and left wg_leadership pointing at the previous one, so the directory would have shown the wrong co-lead under that group until someone hand-edited the file. apply_leadership() now derives wg_leadership from each member's reconciled leadership roles every run, so a change propagates to the new holder and clears from the old one with no manual edit. Idempotent on the current data (no spurious rewrites) and covered by a new case in scripts/test-sync-cost.py.
• Printing the ESSC programme now shows every panel and drops the abstracts. Saving /essc-2026.html (+ FR + DE) to PDF used to print inconsistently: each session's paper line-up sits in a collapsed <details>, and the print engine only kept open the panels a reader had expanded on screen, so most sessions printed as a bare N contributions line. A beforeprint hook now opens every contributions panel before the print dialog renders and restores the on-screen state afterwards, so the printed programme always carries the full line-up of session, chairs, paper titles, and speakers. The full abstracts are now hidden on paper (a printed programme is a line-up, not a book of abstracts), and the trailing Indico URL that the print stylesheet appended after every session and paper title is suppressed on the programme, removing the per-card page breaks the long URLs were forcing.
• Printed ESSC programme no longer truncates mid-document. With every panel force-opened, a session could exceed a page, and Chrome's print engine cannot fragment a tall CSS-grid (or flex) item across a page boundary: it silently dropped every page after the first overflowing row, stopping the PDF at the start of Day 2. The print layout now flows the programme rows as ordinary block boxes instead of grid, lets a long session break between contributions (each paper stays intact), and stacks parallel sessions vertically (each already shows its room badge). A headless print-to-PDF of the live Indico data now renders the whole programme end to end rather than halting partway.
• Printed ESSC programme footer no longer truncates the document at all. Even after the block-flow fix, the interactive Save as PDF still stopped mid-page (the PDF ended at Page 7 of 13 with the rest of Day 2 missing), while headless print-to-PDF rendered the whole thing, which hid the fault from the automated check. The cause was the counter(pages) total in the running footer (Page N of M): resolving M forces the print engine into a second, whole-document layout pass, and Chrome's interactive print truncates long programmes during that pass. The footer now shows the page number without the total (Page N) in all three locales, removing the second pass. The block-flow pagination and the per-paper unbreakable units stay; a redundant break-after: avoid chain on the session header was also dropped to keep the constraint set minimal.