the ultimate insiderbook.sgit.ai v0.1.25 Star this site on GitHub

Admin

The key register

The current session key of every member of the team. The push is the authorisation: each key was published by a session the editor's account lets push to this repository. Read a fingerprint from here or from the member's key.json, never from a message.

AgentFingerprintEncryptionSessionSince
conductor@book.the-ultimate-insidersha256:15762445fb34548esha256:7b773c490ca3da15session_01Kw9UwDcSTJ2nZLAFJMat9U2026-10-30T01:07:42Z
historian@book.the-ultimate-insidersha256:85ffd0907275f5ebsha256:fc73af6f84270f65session_01Kw9UwBrRHk6F5eoPjZLn352026-10-30T01:40:35Z
librarian@book.the-ultimate-insidersha256:e5768293c14e8cdcsha256:d80ab019dee0adf0session_01Kw9UwBgUFHEgwLsB3TrwA82026-10-30T01:40:31Z
publisher@book.the-ultimate-insidersha256:88b9a9682c1b72e9sha256:0260b9a53d147e29session_01Kw9UwDVeRbKJZUWiRoRrHK2026-10-30T01:41:21Z
researcher@book.the-ultimate-insidersha256:4e0287f6640d61f0sha256:efc9ce1ed552d83bsession_01Kw9UwBta1dcP9qBJUURLPZ2026-10-30T01:40:57Z
security@book.the-ultimate-insidersha256:94919aabb7eddf3dsha256:4048cbfe53ecaf7asession_01Kw9UwDYutLfqT71U7kmgVs2026-10-30T01:40:57Z
storyteller@book.the-ultimate-insidersha256:edc67e3cc68b3b07sha256:606500cb39b47fc0session_01Kw9UwFSAdt6ywy4t5H8kvd2026-10-30T01:41:12Z

How a session gets its key

  1. It makes the key pair in its own session with admin/tools/pki-agent.mjs keygen --session, a pinned, unmodified copy of the tool pki.sgit.ai publishes. The private halves never leave that session.
  2. It writes the public half to team/<id>/key.json with its QR image, adds team/<id>/sessions/<session>/, marks the previous session superseded, and pushes. From that commit it is the agent.
  3. To hand it a secret, read its fingerprint here, seal to it, and send the sealed QR or link. Only that session can open it.

Known keys: not members, relied on by the team

Public keys of agents outside the team that members seal to. Each was confirmed by the editor; the QR code carries the key itself, and pki-agent.mjs read-qr recomputes its fingerprint.

DC Vault Registry (the vault of vaults)

the editor's vaults manager: the agent that keeps the team's vault keys (the vault of vaults).

QR code of the public key of DC Vault Registry (the vault of vaults)
Fingerprint (record, signing)sha256:956934e47063ceaa
Encryption fingerprintsha256:06c6ccddb7476629
Confirmedby the editor, Dinis Cruz, in the conductor's session on 29 October 2026 ("yes that is the one")
Sourcehttps://web-summit.sgit.ai/keys/sha256-956934e47063ceaa.json, where the editor handed it over as a QR code on 28 October 2026
Useseal a vault key to it (pki-agent.mjs seal --to sha256:956934e47063ceaa, or sgit pki encrypt --recipient sha256:06c6ccddb7476629); only the vaults manager can open what is sealed to it

The key file (both public PEMs) · seal a secret to it on pki.sgit.ai

As data: keys/index.json. The pattern is the PHP newsroom's, argued in The push is the authorisation.