Home / The five desks / Vaults & provenance: the desk

A desk

Vaults & provenance: the desk

For anyone who needs evidence they can open: encrypted vaults, keys, graphs and the publishing method.

22 articles on this desk, 36 more that touch it. Placed by rule from the subjects and topics of each article (articles/find.json); the editor can override a call, and says why.

Start here

Three pieces, in order, for a first visit to this desk.

  1. Git for things you cannot put on GitHub 2026-08-25 · 4 min · Explainer
    The shortest way in: git for the files you cannot put on GitHub, encrypted before they leave your machine.
  2. Seven vaults, one method 2026-08-19 · 4 min · Field report
    The method, from the first fortnight of August, where every rule exists because something went wrong first.
  3. Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema 2026-09-20 · 12 min · Explainer
    The other idea the site keeps returning to: graphs with no privileged level and no shared schema.
  4. The proof is two clicks behind the claim, what the homepage gets wrong, and the fix 2026-09-07 · 6 min · Analysis
    Why the vaults matter to a stranger: proof a reader can open, and what happens when it sits two clicks away.
  5. No server, by design: first I retired the database, now I am retiring the back end 2026-10-11 · 18 min · Field report
    Where the method stands now: no database, no back end, and servers that cannot read your data.

Series

Two or more articles that tell one story in order.

The homepage, diagnosed and rebuilt · 2 parts · 10 min

What the sgit.ai homepage got wrong, and the page after the fix, both from 7 September.

  1. The proof is two clicks behind the claim, what the homepage gets wrong, and the fix 2026-09-07 · 6 min · Analysis
    The diagnosis: the proof sits two clicks behind the claim.
  2. The proof moved up, the homepage after the rebuild, next to the before pictures 2026-09-07 · 4 min · Field report
    The rebuild, next to the before pictures.

Public keys for sgit · 2 parts · 34 min

A Request for Comments, then where the keys live a day later.

  1. RFC 0001: two ways to add public-key cryptography to sgit, and the questions we want you to answer 2026-10-09 · 18 min · RFC
    The proposal: two key pairs, sealed files, fourteen questions.
  2. Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next 2026-10-10 · 16 min · Explainer
    Key management as it stands at v0.20.0, and what comes next.

Every article on this desk

  1. From sending a file to sgit: eight months of SG/Send, told by its own briefs and commits, and how a file-sharing service became encrypted version control and vaults 2026-10-15 · 9 min · Analysis
    Eight months of SG/Send, checked against its own briefs and commits: how file sharing became sgit and vaults, the pace, and what the market said.
  2. Knowledge that maintains itself: semantic graphs for an organisation's policies and internal knowledge, briefing people and agents from the graph, and vaults to carry the brief 2026-10-14 · 8 min · Analysis
    Fractal semantic graphs for policies and internal knowledge: brief people and agents from the graph, maintain it in a loop, carry the brief in a vault.
  3. The minimum code below: container security from the top down, from the user story to the immutable line, measured on one real tool 2026-10-14 · 10 min · Analysis
    Container security from the top down: at every layer, keep only the code the layer above needs. Measured on one real tool, with its limits.
  4. sgit in a CI pipeline: encrypted, versioned data in and out of GitHub Actions, between its jobs, through write-only lanes, and a key for every job 2026-10-14 · 12 min · Analysis
    Encrypted, versioned vaults as the way data gets into, out of and between CI jobs, with a key per job and a sidecar when there is no server.
  5. The homepage is a vault: a fresh edition every morning, every past homepage one commit away, served from plain files, and a brief for the agent that builds it 2026-10-14 · 10 min · Analysis
    A new homepage edition every morning, each a signed commit in a vault, served from plain files: every past homepage one commit id away.
  6. Every link points back: 566 links between 105 articles, 15 that point forward, and why an article should know what came next and what corrected it 2026-10-13 · 8 min · Analysis
    551 of 566 links between articles point back in time. Why older articles should say what came next and what corrected them.
  7. Sixteen notes I did not want to lose: a request to send from any browser to my vault, why identity is still this hard, and how two more wires became a product line 2026-10-13 · 11 min · Analysis
    Sixteen notes stuck in a browser with no passkey led to a request: let any browser send to my vault, by link, text or QR code.
  8. The passkey opens the vault: a door per path, a master vault for every user, and no server of ours 2026-10-11 · 34 min · Analysis
    Tested: a passkey's PRF bytes compute a door that holds the master's key, and a different path to the same passkey gives different bytes, so a door per path.
  9. No server, by design: first I retired the database, now I am retiring the back end 2026-10-11 · 18 min · Field report
    First the database went, now the back end: the SGit Newsroom runs all its logic in the browser, on commodity servers that cannot read your data.
  10. Where the vault keys live: key management at sgit-ai v0.20.0, and what comes next 2026-10-10 · 16 min · Explainer
    Vault key management at sgit-ai v0.20.0: the one secret, where keys are kept, how they travel sealed on append lanes, and what comes next.
  11. RFC 0001: two ways to add public-key cryptography to sgit, and the questions we want you to answer 2026-10-09 · 18 min · RFC
    A Request for Comments: two key pairs so a reader cannot write, sealed files only named people can open, and fourteen questions for reviewers.
  12. A personal agent that keeps your secrets: the 2026 agents read through behaviour policy and encryption, and a privacy-first design on vaults, enclaves and the browser 2026-10-06 · 23 min · Analysis
    The 2026 personal agents read through behaviour policy and encryption, and a design on vaults, an attested enclave and the browser where no vendor holds a key.
  13. How much of this did I write? The numbers behind twenty articles in four weeks, and what the input actually was 2026-10-05 · 28 min · Field report
    Twenty articles in four weeks, measured from the session record: 63,000 words in, 85,000 out, no one-line prompts, and the real input is twenty years of writing.
  14. Memory is not a spectator sport: how a web of open sites, graphs and vaults became the memory for sessions like this one 2026-10-03 · 17 min · Analysis
    Agentic memory as context management: many published, fractal, provenance-carrying memories rather than one store, shown in the session that wrote the article.
  15. Sixteen thousand fetches, ten clicks, and a token bill nobody is sending: the case for paying publishers to be easy to read 2026-09-28 · 23 min · Analysis
    AI answer engines pay to read the web as HTML; a publisher who serves markdown, dates, hashes and a typed graph saves them tokens and should get a share.
  16. Fractal Semantic Graphs: everything connects to everything, and nobody has to share a schema 2026-09-20 · 12 min · Explainer
    A fractal semantic graph has no privileged level and no single schema: each world keeps its own vocabulary and connects to others through named edges.
  17. The proof moved up, the homepage after the rebuild, next to the before pictures 2026-09-07 · 4 min · Field report
    The rebuilt homepage puts four real vaults under one sentence, picks six by the job they do, and computes its numbers at build time from the site's own data.
  18. The proof is two clicks behind the claim, what the homepage gets wrong, and the fix 2026-09-07 · 6 min · Analysis
    The homepage leads with encryption, which cannot be seen, while twenty-five vaults a stranger can open in one click sit two clicks away in a table.
  19. Twenty sites in fifteen days, and what that did to the writing 2026-08-26 · 4 min · Field report
    One site became twenty repositories in fifteen days because each argument needed its own version history, and the index now starts from a question.
  20. Git for things you cannot put on GitHub 2026-08-25 · 4 min · Explainer
    sgit is git for files you cannot put on GitHub: encrypted before they leave your machine, versioned like git, stored where the server cannot read a byte.
  21. Seven vaults, one method 2026-08-19 · 4 min · Field report
    Publishing seven encrypted vaults in a fortnight produced a method, and every rule in it exists because something went wrong first.
  22. Green does not mean live 2026-08-17 · 3 min · Field report
    Two releases passed every check and never reached the site because the checks stopped at the git remote; a release now ends by asking the live site its version.

Also touching this desk

Placed on another desk first; this one second.

Subjects on this desk

The controlled vocabulary: each subject belongs to one desk.

Encryption and keys · 14 Provenance and evidence · 19 Fractal semantic graphs · 33 Vault design · 10 How sgit.ai publishes · 13 Privacy and sovereignty · 12

For an agent

The Vaults & provenance desk of newsroom.sgit.ai: For anyone who needs evidence they can open: encrypted vaults, keys, graphs and the publishing method. 22 articles placed here by rule, 2 series, three to start with. The data: https://newsroom.sgit.ai/articles/find.json (desks, vocabulary, series, formats and reading time for every article). Every desk: https://newsroom.sgit.ai/desks/index.html.