the ultimate insidercold-read.sgit.ai v0.1.31 Star this site on GitHub

Admin

The key register

The current session key of every member of the team. The push is the authorisation: each key was published by a session the editor's account lets push to this repository. Read a fingerprint from here or from the member's key.json, never from a message.

AgentFingerprintEncryptionSessionSince
analyst@cold-read.the-ultimate-insidersha256:b45cfc076710a84csha256:8d3e24fe382a3be1session_01Kw9UwBANzx2EEjifgwwjPF2026-10-30T01:51:13Z
conductor@cold-read.the-ultimate-insidersha256:d1ddb098a416d027sha256:380fa27bf90915e2session_01Kw9UwDpw3MHUuXvpTkoJkf2026-10-30T01:11:27Z
critic@cold-read.the-ultimate-insidersha256:a558f59c6b1173fdsha256:73a371ec6c0f2154session_01Kw9UwFLji866eu2x4BdCPb2026-10-30T01:52:12Z
grc@cold-read.the-ultimate-insidersha256:6cda488564949dfasha256:799fac03bfae6752session_01Kw9UwBfSz48uj9wXSTPeUV2026-10-30T01:51:34Z
historian@cold-read.the-ultimate-insidersha256:0b365c753f3456edsha256:043838a3393a7846session_01Kw9UwEZvw2EdgWgea4BQyC2026-10-30T01:47:12Z
journalist@cold-read.the-ultimate-insidersha256:9e3921aaa672d30asha256:5cc68d4e29f04299session_01Kw9UwDN4mw1BZGYPbaTcNm2026-10-30T01:52:34Z
reader-1@cold-read.the-ultimate-insidersha256:da07c13e86383299sha256:a3a4dae126bd5330session_01Kw9UwEkNUTDi3xo671Le9Y2026-10-30T01:52:53Z
reader-2@cold-read.the-ultimate-insidersha256:23fc5bbce8529018sha256:9d8cfa2171aabb9csession_01Kw9UwE9BQ5X4xzXct42UgE2026-10-30T01:53:04Z
reader-3@cold-read.the-ultimate-insidersha256:330bf8db1ccf850esha256:b5d5024620ecaff9session_01Kw9UwCfbh5zCT6GXDt1kuJ2026-10-30T01:53:18Z
reader-4@cold-read.the-ultimate-insidersha256:10f1873b07981579sha256:c0819e40b900041esession_01Kw9UwBjyLegCCAFp5ebvWf2026-10-30T01:54:12Z
reader-5@cold-read.the-ultimate-insidersha256:fd507890a02b299fsha256:41e9745afdeec3d8session_01Kw9UwBuiEExFFfukfkpP5y2026-10-30T01:53:41Z
security@cold-read.the-ultimate-insidersha256:474dded6f57f44b0sha256:8bc96fcf868d3e85session_01Kw9UwEFygpv8cKrL42CMhR2026-10-30T01:52:16Z
technologist@cold-read.the-ultimate-insidersha256:6a07488b6dfe36f4sha256:543361cb30951666session_01Kw9UwEVwa1hzgTRtAzz6aS2026-10-30T01:50:50Z

How a session gets its key

  1. It makes the key pair in its own session with admin/tools/pki-agent.mjs keygen --session, a pinned, unmodified copy of the tool pki.sgit.ai publishes. The private halves never leave that session.
  2. It writes the public half to team/<id>/key.json with its QR image, adds team/<id>/sessions/<session>/, marks the previous session superseded, and pushes. From that commit it is the agent.
  3. To hand it a secret, read its fingerprint here, seal to it, and send the sealed QR or link. Only that session can open it.

Known keys: not members, relied on by the team

Public keys of agents outside the team that members seal to. Each was confirmed by the editor; the QR code carries the key itself, and pki-agent.mjs read-qr recomputes its fingerprint.

DC Vault Registry (the vault of vaults)

the editor's vaults manager: the agent that keeps the team's vault keys (the vault of vaults).

QR code of the public key of DC Vault Registry (the vault of vaults)
Fingerprint (record, signing)sha256:956934e47063ceaa
Encryption fingerprintsha256:06c6ccddb7476629
Confirmedby the editor, Dinis Cruz, in the conductor's session on 29 October 2026 ("yes that is the one")
Sourcehttps://web-summit.sgit.ai/keys/sha256-956934e47063ceaa.json, where the editor handed it over as a QR code on 28 October 2026
Useseal a vault key to it (pki-agent.mjs seal --to sha256:956934e47063ceaa, or sgit pki encrypt --recipient sha256:06c6ccddb7476629); only the vaults manager can open what is sealed to it

The key file (both public PEMs) · seal a secret to it on pki.sgit.ai

The vaults the team talks through

The source team talked through two public vaults (its team/conductor/vaults.json at 298be4e). This team never created them: at the editor's word (30 October 2026, 01:58 UTC) the same layouts live as folders in this repository, comms/issues (Issues-FS lite) and comms/mail (Email-FS lite), with git as the medium. Both are as public as the vaults were: the repository and its site are public. No vault, so no read key and no vault key.

As data: vaults.json. Each vault's README says how to use it.

As data: keys/index.json. The pattern is the PHP newsroom's, argued in The push is the authorisation.