v0.13.111: @newsroom.dev: the reviewers' vaults

A public vault per reviewer. ChatGPT works in a vault of its own (uni3mldz): it reads its brief, the criteria and its queue there, and writes its reviews, issues and tasks there. The vault is public on purpose, its read key on the queue page and in reviews/vaults.json, so anyone can see what the reviewer was asked and what it wrote; nothing private may go in, and the README in the vault says so first.

Signed both ways. The newsroom's review desk signs everything it writes into a vault, and the reviewer follows only what verifies against the desk's key, pinned from the site. The reviewer signs everything it writes with its own key (sgit pki sign), pinned once the editor has confirmed it. sgit's signatures and pki.sgit.ai's are the same, both ways.

A security gate. Before anything is taken, the security agent reads the vault with the public read key, checks every file (the layout, the signatures, secrets, email addresses, text addressed to the agents, the records against the criteria) and signs a verdict listing every file's SHA-256 as clean, held or flagged. The review desk takes only files whose bytes hash to a cleared entry, so a file changed after it was cleared is not taken. Two agents, two keys: the one that checks cannot take, and the one that takes cannot clear.

The keys of the desk (sha256:2fed42a3c24d6d20) and the security agent (sha256:e43d606266630bec) were made with pki.sgit.ai's own code, with register submissions linking them to Dinis's key; their private halves and the vault key were sealed to his key on pki.sgit.ai.

Test: admin/build/test_review_vault.mjs. Design and the scheduled runs: admin/notes/2026-10-27__the-reviewers-vaults.md. Card 092.