Vaults and keys

Each outside reviewer's public vault, the keys that sign what goes in and out of it, and the few secrets, named, with who holds them.

Everything a reviewer, or anyone checking on one, needs to find: each reviewer's vault and its read key, the keys that sign, where the verdicts are, and what is private and who holds it. Scan a code, or copy the text under it: they are the same.

The reviewers' vaults

One vault per reviewer from outside the newsroom. Each is public on purpose: anyone can see what the reviewer was asked and what it wrote. So nothing private goes in, from either side; the reviewer is told so first, the security agent looks for it in everything the reviewer writes, and the desk will not publish it.

ChatGPT (OpenAI) openai-chatgpt

Vault gfzbzp41 on https://dev.send.sgraph.ai, since 2026-10-27. The reviewer's own key: sha256:dec7fa758ecb9eb1, pinned. Its queue: queue/openai-chatgpt.md.

Read it: the public read key

sgit clone sgit_public_read_f2c0cf1882142dd079228046fb534a0f27f2249205c895976111cf729544144a:gfzbzp41

Anyone can clone it read-only: every file and every version.

The keys that sign

A reviewer follows only what verifies against the review desk's key, taken from this page, never from its vault; and the desk takes only what the security agent's signed verdict cleared. Two agents, two keys: the one that checks cannot take, and the one that takes cannot clear. The links open on pki.sgit.ai, where anyone can compare a key or seal a message to it.

@newsroom.desk, the review desk sha256:fb35b723a2ae8b98

The text

https://pki.sgit.ai/send/#k1.MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA-7Nxj4cKjhu-1V3-IgI-rfn2pByapVyez5o-oEMa5IMlfTSMmmI8KJEAP7Igk_sfM4MoIsF_tTTByeOwICViCi6nAI-dXoz9HmenZ4oUb9OmCh4lBUEJx_5_L-wXga3-jmLZ9MDrMxic1SZXHNgTlEsHH5tswm1DzhyjN3AN1sHk0r51KZpMMAgcbYRydzAEJZegYdhKN_V1pnWTP-0AxIMJPzTtrlKOLWiKoL-Pd4dqk1lofnztus4i4HybZea6AMUN6SeFortWVyesA8ELAkT8faGyF2yT0uAEq8Z5tynzWbv12sU5SR25cSHuKgFrS7bbcUPrrwkLon8RvgxBI3WDKCnTAtA-K1LzjXMPjpNs5PB14RbMfGpzmpD9XPNcKTSGkGL0LgO-5D4gmKwIFRTfhWBPYzMTf7SIOHTHoGFf3qbQvZ9BrNPxp38YjVUhENkFqhGYp-mTt62H0tV48Ow5VCO3bxD8D70_lOxBAWJ2XspJEcyRgFCR_dCFepRYtrtF3vyKejf-t06iW6IldtKJYuxMLuWp9p-Dg25Arbxx2uyH_y5X0vANeI16tW9W8sL646joRv0_1YY5yQaZ3Z7mkZADSKPjU5D0JesH8h-6eZ9ppw9wn7QnXnuSJ9uFuID91dp6uIOkvaxukw24toEA8OlS39KZVh0UiUe7nGMCAwEAAQ.MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoUNtK8am-ZLn2kgbk1YYRjDC0MvgGLm13vsq5Xk2M3GRA0v7rUQsQd2mIswHd4wfFN6ZT6LKqJkMAINssCNlRg.QG5ld3Nyb29tLmRlc2ssIHRoZSByZXZpZXcgZGVzayBvZiBuZXdzcm9vbS5zZ2l0LmFp

signs the brief, the queue and the answers in every vault. The bundle (for sgit pki import), its register submission (an agent identity, operated by the editor's key sha256:db7f79fdd87e030a).

@newsroom.security, the security agent sha256:2f1a036313b78b1d

The text

https://pki.sgit.ai/send/#k1.MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA2xjKTNh1GWu18xebY9raz4J6B7sBMOm8pSnQX0O03Tby86In-5uQlSNlafBwcKPTeqYYG_4YOm_vuuPNxiKffm0VtT_kYm1Wkf8xJmQYh-e-PfkJL-OoERR4f1FnwZ_3OOdqUWSXPrvHzGAZQRNB4kHuOqllAcu-x4S_k4FflJ1CzKaoYRCktSo-xSEtOBnFIFJy_ZBIV5O1M1yXGDzTcdy4TqN_YprVxv-1NAHd6ODtYNpzgPGr6b3I8WDvckFGCyhZLGV3CBnTS_L1JtMlUX_Hyt_3yGhDxwImjeoEqHa7Moj6YIfO6C6YNVaeWoYrXX7NgjW7jc_8wOn0USV5lGv9OOunYLfAvvIN2wSqKwcEdcifelCTrJbaW3JRdmN4Z3T1-sNa7exoraghPopBx_ZVnzVuCGM4pdE6tHv6YyZgk2QmTii2GLJkQx7-7Lz5_9AYv9dg9dtmL51fWOJ_M37zaNlipctPiI_J8_ga82ywuU_d3GronwqK6FNDT--dloGLI5SPq9wAVH2q6NL2HRklFRQRa5eXlDIxAiEARfSTtJVyXn5xv-OtkSplfHlKU384oNsJ55Z7VmMcaVphQT_jsbzsqh_0PqDiT-j9GLmoiGFRFbsQInwBdjRumWwQh3ElR5zFI7sG9ojD2RzFacm--j_gyJiQRQ5oH_mCDFkCAwEAAQ.MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1wlcTyN6n1WEPIhW7N-pyzv2SKp0kTHnFazHBIsTQCcc2jmxvO0IO_7xYaVUmWBT0SV2H_n6A5zi-_5GRxZXig.QG5ld3Nyb29tLnNlY3VyaXR5LCB0aGUgc2VjdXJpdHkgYWdlbnQgb2YgbmV3c3Jvb20uc2dpdC5haQ

signs its verdict on every file in every vault. The bundle (for sgit pki import), its register submission (an agent identity, operated by the editor's key sha256:db7f79fdd87e030a).

The verdicts are on the repository's review-gate branch, one signed file per reviewer, once the first scheduled run has pushed one. Machine-readable: vaults.json.

Who does what

Each has a page with its role, its rules and the keys it may hold: @newsroom.reviews, @newsroom.security, @newsroom.vault, ChatGPT, and the rest of the team.

@newsroom.vault: Makes each reviewer's vault (review_vault.py create) and hands its vault key to the editor, sealed to the editor's pki.sgit.ai key.
@newsroom.security: On a schedule, before anything is taken: reads each vault with its public read key, checks every file (the layout, the signatures, secrets, private people, text addressed to the agents, records against the criteria) and signs a verdict with its own key (keys/newsroom-security.json), pushed to the repository's review-gate branch. It cannot write to a vault.
@newsroom.desk: On a schedule, after the security agent: takes into the repository only the files whose SHA-256 the signed verdict cleared, proposes the fixes for the editor, and writes the brief, the queue and the answers into each vault, signed with its own key (keys/newsroom-desk.json), so a reviewer follows only what the desk signed.
the reviewer: Holds its own vault's key and its own sgit pki key, kept between runs; signs every file it writes. Its key is pinned here (reviewer_key) once the editor has confirmed the fingerprint with it.

What is private, and where it is

Only the keys that write or sign. None of them is on this site or in the repository: each was sealed on pki.sgit.ai to the editor's key, and is kept in the environment of the agent that uses it.

Secret	What it does	Who holds it
A reviewer's vault key	writes to its vault	the reviewer, and the review desk (`REVIEW_VAULT_KEY__<ID>`)
An SG/Send access token	lets a write reach the vault server	the reviewer, and the review desk
A reviewer's own signing key	signs what it writes	the reviewer only, in its own environment
The review desk's private key	signs the brief, the queue and the answers	@newsroom.desk (`NEWSROOM_DESK_KEY`)
The security agent's private key	signs the verdicts	@newsroom.security (`NEWSROOM_SECURITY_KEY`)
The review lane's secret	lists and opens what was sent to the lane	the newsroom's lane run (`REVIEW_LANE_SECRET`)

The review lane

The review lane, for reviewers without a vault: vault jk20axc2, its messages sealed to sha256:61c7748dad522984; the public half is lane.json. Its send link is given to each reviewer, not published: anyone holding it can add to the lane (never read it), and a public one would invite noise.

Retired

Kept here so that nothing that was once published goes unexplained.

vault uni3mldz (2026-10-27): ChatGPT's first vault (v0.13.111). Its key was sealed to the editor as a link too long for a QR code, and the newsroom keeps no copy, so it was replaced the same evening by a vault whose sealed key fits one. It holds only the desk's first signed files; nobody was given its key.
key sha256:2fed42a3c24d6d20 (2026-10-27): The review desk's first key (v0.13.111), replaced with the vault above: never filed in the register, never used.
key sha256:e43d606266630bec (2026-10-27): The security agent's first key (v0.13.111), replaced with it: never filed in the register, never used.
vault cs4d0nzk (2026-10-27): The review lane's first vault (v0.13.103): the script stopped before it handed the lane's secret over, so nobody holds its keys. Empty, and unusable.

For an agent

Machine-readable: reviews/vaults.json (each reviewer's vault id and public read key, the roles, the retired vaults and keys) and reviews/keys/ (the review desk's and the security agent's public bundles, in the shape sgit pki export writes, and their pki.sgit.ai register submissions). A reviewer pins reviews/keys/newsroom-desk.json from this site and follows only vault files whose .sig verifies against it.