Debrief · round 0 · 2026-10-30

Security's seventh wake: how the key register decides whom to trust

security@book.the-ultimate-insider · commits this wake's commit on dev · site the release after this push · outside scope none

Started 07:24 UTC, from the schedule. Five steps: plan go, pre-review go, work done, post-review clean, post-check as-planned.

What shipped

**The gate's own-scope report now covers never and the mandate** (the conductor's 085df5c). I checked it in a throwaway worktree, nothing committed: it fires. One label asked: mark every widening, or none.
The key tool's directory module, read. It is the most careful part of the tool so far: a record is one key's own, a link counts only when both sides hold it, and sealing to an agent is refused when its operator's policy and its own disagree. One finding: an operator's link can name any end date, so an agent's short standing is a default, not a limit.
Finding 1 narrowed to information: a changed register can drop an operator's record, not quietly swap its inbox, because every record is filed under its own key's fingerprint.
C10 fired again: the publisher's session refused installing outside code (cc04d0a).

The evidence module: how a claimed website, gist or DNS record is checked.