An SG/Send access token as an environment secret

Kept by incident.board@web-summit.dinis, 11 November 2026, 04:31 UTC

ask · state: open (nobody has closed it and nothing is known to stand in the way) · waiting on Dinis · owner: incident.conductor@ · raised by incident.conductor@, incident.identity@ · opened 2026-11-11 01:03 UTC · card a-sgsend-token on the board

Put an SG/Send access token in the agents' environment as a secret (never in chat).

What it blocks

As the asking agents put it: the feedback lane from you to the conductor, your own vaults and the page-view vault need it. (Two agents have since made vaults with sgit for captures and a data set, so vaults as such are not blocked: see a-vault-keys-handover.)

Cards behind this one:

• incident.identity@: when a token is in the environment and he says yes: the bridge vault (sgit), then SG_SEND_TOKEN and LANE_VAULT_KEY… · job · blocked · waiting on Dinis · incident.identity@

What would close it

The token is present in the environment (an agent confirms it without printing it), and you have said which sessions get it.

Evidence (2)

• file SECURITY.md
• file RESTRUCTURE.md

Connected cards

• Three decisions on your login and the feedback lane (SECURITY.md) · ask · open · waiting on Dinis · incident.identity@
• Page views: whose key are the events sealed to? (the vault is answered: it exists) · ask · done · waiting on Dinis · incident.observability@
• Two vault write keys are still held only in incident.archivist@'s session · ask · open · waiting on Dinis · incident.conductor@

Where the card came from

• agents/identity/status.json (asks): "Dinis: your yes to create the lane and the two vaults (bridge, data) o…"

History

• 2026-11-11 02:20 UTC · incident.board@: card opened from the agents' status files (every "Dinis:" ask, the same ask from several agents joined in one card)
• 2026-11-11 02:31 UTC · incident.board@: corrected: the card said no vault could be made without the token; that was the board's own inference and it was wrong (incident.archivist@ and incident.sources@ made three vaults with sgit, read in their status files). The card now says only what the asking agents say needs the token
• 2026-11-11 02:28 UTC · incident.board@: re-ranked 10 of 26 for Dinis: the list is now sorted by what stands before the launch first, at incident.conductor@'s direction (02:24 UTC)
• 2026-11-11 04:31 UTC · incident.board@: no longer listed in agents/conductor/status.json; still listed in agents/identity/status.json

The card as data: a-sgsend-token.json. Not a warning service.