{
 "about": "Which of our agents does what in the fringe repository's definitions of where agents run: each agent's altitude (A3) with the A2 loops, A1 LLM calls and A0 compute it runs, its runtime (R1-R5), model endpoints (M1-M4), I/O level (L0-L5), account and key. Every item labelled: fact (read from the agent's own files or ours), evidence (read elsewhere, or inferred from what it does: the reason given). The definitions are the fringe's; the mapping is the librarian's. At Dinis's word, ~22:00 UTC, 11 November (BRIEF.md item 3).",
 "by": "incident.librarian@web-summit.dinis",
 "updated": "2026-11-12T00:46Z",
 "made_by": "tools/library-altitudes.mjs",
 "definitions": {
  "section_3_unchanged_at": "3256d3cafa8200a9ff5b46443400732fc474e0e5 (2026-11-11T22:05:57Z, read 22:09Z)",
  "repo": "https://github.com/PrompTugal/PrompTugal__News__Fringe",
  "file": "docs/where-agents-run.md",
  "commit": "a8ee36eb8dc9ab580dc3a32c7ebb1d34f3c2f996",
  "committed": "2026-11-11T21:56:20Z",
  "status": "draft v0.2, for Dinis and Angelo to correct",
  "read": "2026-11-11T22:05Z"
 },
 "swarms": [
  {
   "id": "A4-incident",
   "what": "the incident team: incident.conductor@web-summit.dinis and the agents below, at Dinis Cruz's word",
   "control_plane": "incident.conductor@ (starts the sessions, sets each wake)",
   "label": "fact",
   "from": "CLAUDE.md, agents/JOBS.md"
  },
  {
   "id": "A4-newsroom",
   "what": "Vicky Wang's newsroom desks (PrompTugal)",
   "crossing": "we feed her desks material on her conductor's inbox or in commits addressed For: her agents; we read her public files and never write to them",
   "label": "fact",
   "from": "CLAUDE.md, \"Whose it is\""
  },
  {
   "id": "A4-fringe",
   "what": "the fringe swarm (conductor.fringe@PrompTugal.dinis), PrompTugal/PrompTugal__News__Fringe",
   "crossing": "its definitions are read here (this file); nothing of ours is written there",
   "label": "evidence",
   "from": "https://github.com/PrompTugal/PrompTugal__News__Fringe"
  }
 ],
 "grants": {
  "session": {
   "altitude": "A4",
   "label": "fact for the librarian's own session (read at 2026-11-12T00:46Z); evidence for the others (the same cloud environment, sessions started the same way)",
   "holds": [
    "push to dev (the session's git credentials; admin/tools/release.sh)",
    "the agent's private session key (~/.sg-send/keys, outside git)",
    "every vault key the agent made or was given (outside git)",
    "the environment's credentials: the OpenRouter key (under two names), a GitHub token, an SG/Send token and cloud-provider credentials (names read, never values)",
    "the right to message other sessions, start sessions and set scheduled wakes (the session-control tools of Claude Code in the cloud); changes to the environment with the owner's approval"
   ]
  },
  "ci": {
   "label": "fact",
   "from": ".github/workflows/deploy.yml (read per job)",
   "build_job": "build",
   "jobs": {
    "build": {
     "permissions": {
      "contents": "read"
     },
     "checkout": true,
     "keeps_token": false,
     "runs_repo_code": true,
     "altitude": "A0",
     "why": "A0: contents: read; checkout keeps no credential (persist-credentials: false)"
    },
    "deploy": {
     "permissions": {
      "pages": "write",
      "id-token": "write"
     },
     "checkout": false,
     "keeps_token": false,
     "runs_repo_code": false,
     "altitude": "A3",
     "why": "A3 in part: a durable write beyond the runner (pages, id-token), but no session control, no memory, no agent key; it runs no repository code"
    },
    "tag": {
     "permissions": {
      "contents": "write"
     },
     "checkout": false,
     "keeps_token": false,
     "runs_repo_code": false,
     "altitude": "A3",
     "why": "A3 in part: a durable write beyond the runner (contents), but no session control, no memory, no agent key; it runs no repository code"
    }
   },
   "secrets": "no agent key, no vault key, no model key (no secrets.* in the workflow)"
  }
 },
 "corrections_to_compute_md": [
  {
   "what": "CI was not at its own altitude at 22:11: one job held contents: write (kept in .git/config by checkout) while it ran the gate, the generators and npm's Chromium. Since fd90abcd (22:2x, incident.ci@'s patch) it is three jobs: build (contents: read, no token kept: A0, runs the repository's code), deploy (pages and id-token write, no repository code) and tag (contents write, no repository code). The build job's units no longer cross in CI; they still cross in every pushing session.",
   "label": "fact",
   "from": ".github/workflows/deploy.yml at fd90abcd; incident.ci@'s message, 22:23"
  },
  {
   "what": "The generators in admin/build/generators.json run in every pushing agent's session (release.sh runs the gate, which builds): every agent runs the other agents' generators under its own A4 grant. By count, the widest crossing.",
   "label": "fact",
   "from": "admin/tools/release.sh, admin/build/validate.mjs, admin/build/generators.json"
  },
  {
   "what": "graph, labs, studio, identity and weatherwatch use a headless browser on our own pages (local builds, our live site, our lanes), not on arbitrary web pages; the readers of outside pages in a browser are the researcher, meteorology (render: true) and the conductor.",
   "label": "fact",
   "from": "agents/<role>/status.json and README.md"
  },
  {
   "what": "The meteorologist, researcher and dev run on the Web-Summit repository's side: the grant there is that repository's push, not ours; their work arrives here under the conductor's commits.",
   "label": "fact",
   "from": "tools/sync-from-websummit.sh"
  },
  {
   "what": "An A2 now exists: tools/models-delegate.mjs, incident.models@'s delegation loop (commit 9fff5fb7).",
   "label": "fact",
   "from": "tools/models-delegate.mjs"
  },
  {
   "what": "In the librarian's session, 10 environment variables named as keys or tokens hold credentials (names read, never values), against 17 counted in the conductor's: the sessions may not hold the same set.",
   "label": "fact",
   "from": "the librarian's session, at 2026-11-12T00:46Z"
  }
 ],
 "totals": {
  "agents": 43,
  "units": 129,
  "crossing": 129,
  "places_not_crossing": 19,
  "by_mandate": {
   "A0": 117,
   "A1": 11,
   "A2": 1
  },
  "in_ci_and_every_session": 18,
  "io": {
   "L5": 25,
   "L4": 15,
   "L4, elsewhere": 3
  },
  "calls_models_through_llm_mjs": [
   "incident.models@web-summit.dinis",
   "incident.shadow@web-summit.dinis",
   "incident.perplexity@web-summit.dinis",
   "incident.flights@web-summit.dinis"
  ],
  "keyed": 40
 },
 "agents": [
  {
   "agent": "incident.conductor@web-summit.dinis",
   "role": "conductor",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/conductor/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none of its own named; it starts and wakes the other A3 sessions, which is the swarm's control plane (A4)",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/sync-from-websummit.sh",
      "mandate": "A0",
      "where": [
       {
        "at": "a background loop in its agent's session",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/sync-from-websummit.sh"
     },
     {
      "unit": "tools/timeline.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/timeline.mjs"
     },
     {
      "unit": "reads of IPMA's CAP feed and open data with curl, the bridge sync, site builds, PDF rendering in Chromium",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "MeteoAlarm XML, IPMA JSON, the Web-Summit repository's files",
       "a headless browser (Chromium)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/conductor/COMPUTE.md §1 (of itself)"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "285 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:42Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-conductor-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.designer@web-summit.dinis",
   "role": "designer",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/designer/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "152 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:14Z), pushed to dev behind the gate; its own files also speak of vaults, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-designer-dinis-10"
    ],
    "handed_over": 9,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.observability@web-summit.dinis",
   "role": "observability",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/observability/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/agents-commits.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-commits.mjs"
     },
     {
      "unit": "tools/agents-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-index.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/agents-ledger.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-ledger.mjs"
     },
     {
      "unit": "tools/agents-now.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-now.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/agents-pin.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-pin.mjs"
     },
     {
      "unit": "tools/agents-release.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-release.mjs"
     },
     {
      "unit": "tools/agents-sessions.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-sessions.mjs"
     },
     {
      "unit": "tools/agents-split.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-split.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/agents-views.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)",
       "our own services: dev.send.sgraph.ai",
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/agents-views.mjs"
     },
     {
      "unit": "tools/trace-check.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/trace-check.mjs"
     },
     {
      "unit": "tools/trace-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/trace-index.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/trace.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/trace.mjs"
     },
     {
      "unit": "Chromium checks of our live site",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "our live site, in a headless browser"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/observability/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "119 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:22Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-observability-dinis-12"
    ],
    "handed_over": 11,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.identity@web-summit.dinis",
   "role": "identity",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/identity/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/lane-common.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)",
       "our own services: sgit.ai",
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-common.mjs"
     },
     {
      "unit": "tools/lane-configure.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-configure.mjs"
     },
     {
      "unit": "tools/lane-drain.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: sgit.ai",
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-drain.mjs"
     },
     {
      "unit": "tools/lane-e2e.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens",
       "our own services: dev.send.sgraph.ai",
       "sealed messages from the public lanes, opened here (visitors' words or events)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-e2e.mjs"
     },
     {
      "unit": "tools/lane-frame.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-frame.mjs"
     },
     {
      "unit": "tools/lane-handover.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-handover.mjs"
     },
     {
      "unit": "tools/lane-keys.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-keys.mjs"
     },
     {
      "unit": "tools/lane-keystore.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-keystore.mjs"
     },
     {
      "unit": "tools/lane-open.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "sealed messages from the public lanes, opened here (visitors' words or events)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-open.mjs"
     },
     {
      "unit": "tools/lane-seal.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-seal.mjs"
     },
     {
      "unit": "tools/lane-sign.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-sign.mjs"
     },
     {
      "unit": "tools/lane-test.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: sgit.ai",
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/lane-test.mjs"
     },
     {
      "unit": "tools/lane-e2e.mjs in Chromium with a virtual passkey",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "our own lane pages; the public lane's sealed messages"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/identity/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "45 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:21Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-identity-dinis-3"
    ],
    "handed_over": 2,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.weatherwatch@web-summit.dinis",
   "role": "weatherwatch",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/weatherwatch/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "Playwright renders of our front page and of a warning's text, each wake",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "our front page; the warning page it renders, in a headless browser"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/weatherwatch/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "75 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:40Z), pushed to dev behind the gate; its own files also speak of vaults, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-weatherwatch-dinis-6"
    ],
    "handed_over": 4,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.media@web-summit.dinis",
   "role": "media",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/media/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "52 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:39Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-media-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.librarian@web-summit.dinis",
   "role": "librarian",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/librarian/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/library-abp.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: web-summit.sgit.ai",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-abp.mjs"
     },
     {
      "unit": "tools/library-altitudes.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens",
       "outside hosts: github.com",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-altitudes.mjs"
     },
     {
      "unit": "tools/library-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-index.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/library-news.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-news.mjs"
     },
     {
      "unit": "tools/library-pack.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: web-summit.sgit.ai",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-pack.mjs"
     },
     {
      "unit": "tools/library-reading.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-reading.mjs"
     },
     {
      "unit": "tools/library-releases.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-releases.mjs"
     },
     {
      "unit": "tools/library-view.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/library-view.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/policy-check.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/policy-check.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "152 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:47Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-librarian-dinis-15"
    ],
    "handed_over": 14,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.graph@web-summit.dinis",
   "role": "graph",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/graph/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/graph-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/graph-build.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/graph-places.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: api.ipma.pt"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/graph-places.mjs"
     },
     {
      "unit": "headless browser tests of our own pages (local builds)",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "our own pages only"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/graph/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "52 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:59Z), pushed to dev behind the gate; its own files also speak of lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-graph-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.meteorologist@web-summit.dinis",
   "role": "meteorologist",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/meteorologist/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "a read every 5 minutes between its wakes",
      "mandate": "A0",
      "where": [
       {
        "at": "its session, on the Web-Summit repository's side (bridged)",
        "grant": "session (on the Web-Summit side: push to that repository, not this one)",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "the feeds it reads (COMPUTE.md: the CAP feed, METAR and TAF; its status says only \"reads every 5 min\")"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/meteorologist/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4, elsewhere",
    "label": "evidence",
    "why": "its session pushes to SGit-AI__Website__Web-Summit (team/incidents/); the conductor copies its data and status here with tools/sync-from-websummit.sh, so here its work arrives under the conductor's commits"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "started before this repository, on the Web-Summit incident; the account is not stated in its files"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to SGit-AI__Website__Web-Summit (bridged), not here",
    "see": "grants.session"
   },
   "key": {
    "active": [],
    "label": "fact",
    "why": "no key in data/keys.json (its session cannot push here)"
   }
  },
  {
   "agent": "incident.researcher@web-summit.dinis",
   "role": "researcher",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/researcher/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "headless browser reads of outside pages (the Diário da República's, for one)",
      "mandate": "A0",
      "where": [
       {
        "at": "its session, on the Web-Summit repository's side (bridged)",
        "grant": "session (on the Web-Summit side: push to that repository, not this one)",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "outside pages and their scripts, in a headless browser"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/researcher/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4, elsewhere",
    "label": "evidence",
    "why": "its session pushes to SGit-AI__Website__Web-Summit (team/incidents/); the conductor copies its data and status here with tools/sync-from-websummit.sh, so here its work arrives under the conductor's commits"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "started before this repository, on the Web-Summit incident; the account is not stated in its files"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to SGit-AI__Website__Web-Summit (bridged), not here",
    "see": "grants.session"
   },
   "key": {
    "active": [],
    "label": "fact",
    "why": "no key in data/keys.json (its session cannot push here)"
   }
  },
  {
   "agent": "incident.dev@web-summit.dinis",
   "role": "dev",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/dev/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/websummit-poll.sh",
      "mandate": "A0",
      "where": [
       {
        "at": "a background loop in its agent's session",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/websummit-poll.sh"
     },
     {
      "unit": "tools/websummit.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: websummit.com, public.api.bsky.app, bsky.app"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/websummit.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4, elsewhere",
    "label": "evidence",
    "why": "its session pushes to SGit-AI__Website__Web-Summit (team/incidents/); the conductor copies its data and status here with tools/sync-from-websummit.sh, so here its work arrives under the conductor's commits"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "started before this repository, on the Web-Summit incident; the account is not stated in its files"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to SGit-AI__Website__Web-Summit (bridged), not here",
    "see": "grants.session"
   },
   "key": {
    "active": [],
    "label": "fact",
    "why": "no key in data/keys.json (its session cannot push here)"
   }
  },
  {
   "agent": "incident.studio@web-summit.dinis",
   "role": "studio",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/studio/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "headless Chromium tests of our own pages before each push",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "our own pages only"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/studio/README.md, status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "26 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T03:55Z), pushed to dev behind the gate; its own files also speak of lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-studio-dinis-2"
    ],
    "handed_over": 1,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.wikipedia@web-summit.dinis",
   "role": "wikipedia",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/wikipedia/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/wikipedia-claims.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/wikipedia-claims.mjs"
     },
     {
      "unit": "tools/wikipedia-lib.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/wikipedia-lib.mjs"
     },
     {
      "unit": "tools/wikipedia-read.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/wikipedia-read.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "29 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:56Z), pushed to dev behind the gate; its own files also speak of vaults, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-wikipedia-dinis-3"
    ],
    "handed_over": 2,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.weather@web-summit.dinis",
   "role": "weather",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/weather/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/weather-check.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: www.ipma.pt, prociv.gov.pt",
       "our own services: promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/weather-check.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "65 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:30Z), pushed to dev behind the gate; its own files also speak of lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-weather-dinis-5"
    ],
    "handed_over": 4,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.ipma@web-summit.dinis",
   "role": "ipma",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/ipma/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/ipma-pages.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ipma-pages.mjs"
     },
     {
      "unit": "tools/ipma-read.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: api.ipma.pt"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ipma-read.mjs"
     },
     {
      "unit": "tools/ipma-round.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ipma-round.mjs"
     },
     {
      "unit": "tools/ipma-views.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ipma-views.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "39 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:52Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-ipma-dinis-3"
    ],
    "handed_over": 2,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.sources@web-summit.dinis",
   "role": "sources",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/sources/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/source-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/source-index.mjs"
     },
     {
      "unit": "tools/source-meteoalarm-models.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/source-meteoalarm-models.mjs"
     },
     {
      "unit": "tools/source-meteoalarm.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: feeds.meteoalarm.org, www.meteoalarm.org",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/source-meteoalarm.mjs"
     },
     {
      "unit": "tools/source-pages.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/source-pages.mjs, admin/build/generators.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "39 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:25Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-sources-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.archivist@web-summit.dinis",
   "role": "archivist",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/archivist/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/capture-pages.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/capture-pages.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/capture-records.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/capture-records.mjs"
     },
     {
      "unit": "tools/capture.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens",
       "the network (hosts given at run time or from data files)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/capture.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "42 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:25Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-archivist-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.entities@web-summit.dinis",
   "role": "entities",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/entities/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/entities-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/entities-build.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/entities-check.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/entities-check.mjs"
     },
     {
      "unit": "tools/entities-lib.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/entities-lib.mjs"
     },
     {
      "unit": "tools/entities-link.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/entities-link.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/entities-make.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/entities-make.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "58 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:38Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-entities-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.labs@web-summit.dinis",
   "role": "labs",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/labs/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/labs-check.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/labs-check.mjs"
     },
     {
      "unit": "Playwright screenshots of our own lab pages (a scratch script)",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "our own pages only"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/labs/status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "16 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T12:14Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-labs-dinis-3"
    ],
    "handed_over": 2,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.board@web-summit.dinis",
   "role": "board",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/board/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/board-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/board-build.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/board-item.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/board-item.mjs"
     },
     {
      "unit": "tools/board-sync.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/board-sync.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "47 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:34Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-board-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.social@web-summit.dinis",
   "role": "social",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/social/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/social-accounts.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/social-accounts.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/social-mastodon.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/social-mastodon.mjs"
     },
     {
      "unit": "tools/social-page.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/social-page.mjs"
     },
     {
      "unit": "tools/social-read.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: bsky.app, api.bsky.app"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/social-read.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "30 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:51Z), pushed to dev behind the gate; its own files also speak of vaults, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-social-dinis-3"
    ],
    "handed_over": 2,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.meteorology@web-summit.dinis",
   "role": "meteorology",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/meteorology/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/meteorology-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/meteorology-build.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/meteorology-read.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/meteorology-read.mjs"
     },
     {
      "unit": "tools/meteorology-render.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/meteorology-render.mjs"
     },
     {
      "unit": "headless reads of the pages marked render: true (tools/meteorology-render.mjs)",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "outside pages and their scripts, in a headless browser"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/meteorology/README.md"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "22 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:07Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-meteorology-dinis-2"
    ],
    "handed_over": 1,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.stories@web-summit.dinis",
   "role": "stories",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/stories/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/stories-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/stories-build.mjs, admin/build/generators.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "76 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:58Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-stories-dinis-10"
    ],
    "handed_over": 9,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.models@web-summit.dinis",
   "role": "models",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/models/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "unit": "tools/models-delegate.mjs",
      "mandate": "A2",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-delegate.mjs"
     }
    ],
    "A1_calls": [
     {
      "what": "tools/llm.mjs calls (OpenRouter, M2): the evals",
      "share_usd_a_day": 6,
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session, through tools/llm.mjs",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "models/budgets.json"
     },
     {
      "what": "tools/llm.mjs itself: the one wrapper every A1 call of the team goes through (ledger line, daily cap)",
      "label": "fact",
      "from": "tools/llm.mjs (owned by incident.models@ and incident.dev@ in agents/policy.json)"
     },
     {
      "unit": "tools/models-ask.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-ask.mjs"
     },
     {
      "unit": "tools/models-report.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-report.mjs"
     },
     {
      "unit": "tools/models-run.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-run.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/models-calls.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-calls.mjs"
     },
     {
      "unit": "tools/models-delegated.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-delegated.mjs"
     },
     {
      "unit": "tools/models-items.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-items.mjs"
     },
     {
      "unit": "tools/models-measure-match.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-measure-match.mjs"
     },
     {
      "unit": "tools/models-press-decisions.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-press-decisions.mjs"
     },
     {
      "unit": "tools/models-prompts.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/models-prompts.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    },
    {
     "id": "M2",
     "label": "fact",
     "why": "OpenRouter through tools/llm.mjs"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "34 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:37Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-models-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.shadow@web-summit.dinis",
   "role": "shadow",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/shadow/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "tools/llm.mjs calls (OpenRouter, M2): shadow reporting",
      "share_usd_a_day": 1,
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session, through tools/llm.mjs",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "models/budgets.json"
     },
     {
      "unit": "tools/shadow-ask.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/shadow-ask.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/shadow-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: newsroom.sgit.ai",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/shadow-index.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    },
    {
     "id": "M2",
     "label": "fact",
     "why": "OpenRouter through tools/llm.mjs"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "23 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T21:07Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-shadow-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.ci@web-summit.dinis",
   "role": "ci",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/ci/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/ci-read.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: api.github.com, github.com"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ci-read.mjs"
     },
     {
      "unit": "tools/ci-release-record.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ci-release-record.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "45 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:20Z), pushed to dev behind the gate; its own files also speak of lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-ci-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.perplexity@web-summit.dinis",
   "role": "perplexity",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/perplexity/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "tools/llm.mjs calls (OpenRouter, M2): research through an answer engine with search",
      "share_usd_a_day": 4,
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session, through tools/llm.mjs",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "models/budgets.json"
     },
     {
      "unit": "tools/perplexity-ask.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/perplexity-ask.mjs"
     },
     {
      "unit": "tools/perplexity-status.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/perplexity-status.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/perplexity-check.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/perplexity-check.mjs"
     },
     {
      "unit": "tools/perplexity-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/perplexity-index.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    },
    {
     "id": "M2",
     "label": "fact",
     "why": "OpenRouter through tools/llm.mjs"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "14 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T17:52Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-perplexity-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.accountant@web-summit.dinis",
   "role": "accountant",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/accountant/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/accounts-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: web-summit.sgit.ai",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/accounts-build.mjs"
     },
     {
      "unit": "tools/accounts-measure.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/accounts-measure.mjs"
     },
     {
      "unit": "tools/accounts-round.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/accounts-round.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "36 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:43Z), pushed to dev behind the gate; its own files also speak of vaults, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-accountant-dinis-4"
    ],
    "handed_over": 3,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.reporter@web-summit.dinis",
   "role": "reporter",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/reporter/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/reporter-fill.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/reporter-fill.mjs"
     },
     {
      "unit": "tools/reporter-numbers.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/reporter-numbers.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "63 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:12Z), pushed to dev behind the gate; its own files also speak of vaults, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-reporter-dinis-8"
    ],
    "handed_over": 7,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.journalist@web-summit.dinis",
   "role": "journalist",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/journalist/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/journal-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/journal-build.mjs, admin/build/generators.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "75 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:14Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-journalist-dinis-8"
    ],
    "handed_over": 7,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.envoy@web-summit.dinis",
   "role": "envoy",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/envoy/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "11 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T12:24Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-envoy-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.synthetic@web-summit.dinis",
   "role": "synthetic",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/synthetic/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "12 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T12:29Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-synthetic-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.storyteller@web-summit.dinis",
   "role": "storyteller",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/storyteller/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "16 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T10:40Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-storyteller-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.motion@web-summit.dinis",
   "role": "motion",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/motion/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/flows-build.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flows-build.mjs, admin/build/generators.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "8 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T11:48Z), pushed to dev behind the gate; its own files also speak of lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-motion-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.broadcast@web-summit.dinis",
   "role": "broadcast",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/broadcast/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/broadcast-coast.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/broadcast-coast.mjs"
     },
     {
      "unit": "tools/broadcast-field.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: api.open-meteo.com, open-meteo.com",
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/broadcast-field.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "9 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T22:30Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-broadcast-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.transport@web-summit.dinis",
   "role": "transport",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/transport/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/transport-gloss.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/transport-gloss.mjs"
     },
     {
      "unit": "tools/transport-gtfs.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/transport-gtfs.mjs"
     },
     {
      "unit": "tools/transport-read.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens",
       "outside hosts: crt.sectigo.com, opensky-network.org, api.carrismetropolitana.pt, www.carrismetropolitana.pt, broker.fiware.urbanplatform.portodigital.pt, www.stcp.pt and 11 more",
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/transport-read.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "80 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:44Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-transport-dinis-6"
    ],
    "handed_over": 5,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.planner@web-summit.dinis",
   "role": "planner",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/planner/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "7 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T11:49Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-planner-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.datascience@web-summit.dinis",
   "role": "datascience",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/datascience/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/ds-ensemble.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: ensemble-api.open-meteo.com"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ds-ensemble.mjs"
     },
     {
      "unit": "tools/ds-exposure.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: api.ipma.pt"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ds-exposure.mjs"
     },
     {
      "unit": "tools/ds-tides.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: marine-api.open-meteo.com, www.hidrografico.pt"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/ds-tides.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "16 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T23:58Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-datascience-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.brief@web-summit.dinis",
   "role": "brief",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/brief/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/brief-make.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "our own services: storm-charles.promptugal.news"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/brief-make.mjs"
     },
     {
      "unit": "tools/brief-pdf.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "CI (GitHub Actions), the build job",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       },
       {
        "at": "its agent's session when it tests it",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "a headless browser (Chromium): runs the scripts of the pages it opens"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/brief-pdf.mjs, .github/workflows/deploy.yml"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "25 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T21:06Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-brief-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.desk@web-summit.dinis",
   "role": "desk",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/desk/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/desk-drain.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the network (hosts given at run time or from data files)",
       "our own services: storm-charles.promptugal.news, dev.send.sgraph.ai",
       "sealed messages from the public lanes, opened here (visitors' words or events)",
       "vault contents"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/desk-drain.mjs"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "19 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:09Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-desk-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.sherpa@web-summit.dinis",
   "role": "sherpa",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/sherpa/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "18 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-11T12:43Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-sherpa-dinis"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.flights@web-summit.dinis",
   "role": "flights",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/flights/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "tools/llm.mjs calls (OpenRouter, M2): an hourly summary of the flight data",
      "share_usd_a_day": 1,
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session, through tools/llm.mjs",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "models/budgets.json"
     },
     {
      "unit": "tools/flights-summary.mjs",
      "mandate": "A1",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "model answers (untrusted text), and prompts built from collected material"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-summary.mjs"
     }
    ],
    "A0_compute": [
     {
      "unit": "tools/flights-common.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "outside hosts: opensky-network.org, adsb.lol, opendatacommons.org, open-meteo.com, creativecommons.org"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-common.mjs"
     },
     {
      "unit": "tools/flights-crosswind.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-crosswind.mjs"
     },
     {
      "unit": "tools/flights-index.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-index.mjs"
     },
     {
      "unit": "tools/flights-map.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "the session of every agent that pushes: admin/tools/release.sh runs the gate, which runs the build and its generators",
        "grant": "session (the pushing agent's)",
        "altitude": "A4",
        "crosses": true
       },
       {
        "at": "CI (GitHub Actions), the build job, every push",
        "grant": "ci.jobs.build",
        "altitude": "A0",
        "crosses": false
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-map.mjs, admin/build/generators.json"
     },
     {
      "unit": "tools/flights-poll.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-poll.mjs"
     },
     {
      "unit": "tools/flights-wind.mjs",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session (by hand or on its wake)",
        "grant": "session",
        "altitude": "A4",
        "crosses": true
       }
      ],
      "untrusted": [
       "the repository's files only (some written from web reads: untrusted at one remove)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "tools/flights-wind.mjs"
     },
     {
      "unit": "an OpenSky poller every 10 minutes (anonymous /states/all) and Open-Meteo reads",
      "mandate": "A0",
      "where": [
       {
        "at": "its agent's session",
        "grant": "session",
        "altitude": "A4"
       }
      ],
      "untrusted": [
       "outside hosts: OpenSky's API, Open-Meteo's API (JSON)"
      ],
      "grant_altitude": "A4",
      "crosses": true,
      "label": "fact",
      "from": "agents/flights/README.md, status.json"
     }
    ]
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    },
    {
     "id": "M2",
     "label": "fact",
     "why": "OpenRouter through tools/llm.mjs"
    }
   ],
   "io": {
    "level": "L5",
    "label": "evidence",
    "why": "30 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:06Z), pushed to dev behind the gate; its own files also speak of vaults and lanes, read as L5 (git, vaults, lanes, wakes)"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "its own files speak of vaults (evidence that it holds vault keys)",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-flights-dinis-3"
    ],
    "handed_over": 2,
    "label": "fact",
    "from": "data/keys.json"
   }
  },
  {
   "agent": "incident.aws@web-summit.dinis",
   "role": "aws",
   "altitude": {
    "value": "A3",
    "label": "fact",
    "why": "a loop with an environment: memory (agents/aws/status.json), a wake, a reach beyond its sandbox (fringe §3)"
   },
   "inside": {
    "A2_loops": [
     {
      "what": "none named in its files; a sub-agent its session starts would be an A2 loop, and none is recorded in git",
      "label": "evidence"
     }
    ],
    "A1_calls": [
     {
      "what": "no tools/llm.mjs call: its only model calls are its own session's (M1)",
      "label": "evidence",
      "from": "models/budgets.json has no share for it; no tool it owns imports tools/llm.mjs"
     }
    ],
    "A0_compute": []
   },
   "runtime": {
    "value": "R1",
    "label": "evidence",
    "why": "Claude Code in the cloud: every session the conductor starts is a cloud session (session_... ids in the status files); the agent's own files do not name the runtime"
   },
   "endpoints": [
    {
     "id": "M1",
     "label": "evidence",
     "why": "its own session's model (not named here: CLAUDE.md)"
    }
   ],
   "io": {
    "level": "L4",
    "label": "fact",
    "why": "5 commits here by it (its Agent: trailer or its name in the subject) (the latest 2026-11-12T00:24Z), pushed to dev behind the gate"
   },
   "account": {
    "value": "Dinis Cruz's Claude account, through the conductor",
    "label": "evidence",
    "why": "the conductor starts each session from Dinis's; no agent file states the account"
   },
   "session_grant": {
    "altitude": "A4",
    "vault_keys": "none named in its files",
    "push": "to dev here",
    "see": "grants.session"
   },
   "key": {
    "active": [
     "incident-aws-dinis-1"
    ],
    "handed_over": 0,
    "label": "fact",
    "from": "data/keys.json"
   }
  }
 ]
}