The pack for incident.identity@web-summit.dinis

Kept by incident.librarian@web-summit.dinis, 2026-11-11, 12:12 UTC: written by tools/library-pack.mjs on every push from the files it points at. Read start.md first, then this, then open only what you need. A pointer is path (bytes, the first 10 hex digits of its sha256); any path opens at view/?path=<path>. The pack.

Your job

Dinis's login and his lane to the conductor. Study pki.sgit.ai (its pages and agents/pki-agent.mjs) and reuse its code: a key made in the browser (or a passkey), private half never leaves it; a page where Dinis writes feedback on any page, sealed to incident.conductor@'s public key (data/keys.json), delivered through an SG/Send append lane the conductor drains each wake; the reverse path (the conductor seals to Dinis's key). Design first in SECURITY.md (threats, what is public, what a stolen token can do), then build. Vault creation needs an SG/Send token: ask Dinis via status; never commit one. (from agents/JOBS.md (16,087 B, cb88df47c9))

You may change: app/login/**, account/**, data/lanes.json, tools/lane-*.mjs, SECURITY.md, agents/identity/**, accounts/ledger/identity.jsonl, transition/interviews/identity.md, and your own entry in data/keys.json. (from agents/policy.json (13,565 B, ec9b7b8d15))

Your draft behaviour policy (not agreed by Dinis): agents/identity/policy.md (8,708 B, 763c24ae85)

Where the work stands

State: the conductor's append lane for vault keys is open (vault wowyrqlr, data/lanes.json keys_to_conductor). Dinis's feedback lane exists on the same vault and stays off until his key is a named sender. The login and the sealed feedback box are live as before (its own date: 2026-11-11T11:25:05Z)
Next: when Dinis has made his key: the conductor adds his public half to data/keys.json (after he reads the fingerprint) and its id to data/lanes.json to_conductor.senders
Next: when a token is in the environment and he says yes: the bridge vault (sgit), then SG_SEND_TOKEN and LANE_VAULT_KEY in the environment and node tools/lane-configure.mjs; the data vault; their keys …
Next: sign in with pki.sgit.ai (sso.js) if that is his choice in decision 1
Ask: Dinis: three decisions, at the end of SECURITY.md: (1) a new key made on this site behind a passkey, or sign in with your pki.sgit.ai key; (2) how far a signed message from the feedback box carries …
Ask: Dinis: your yes to create the lane and the two vaults (bridge, data) once the token is in place. Nothing is created before it.
Ask: Dinis: to start, open Log in (/account/), press Log in with a passkey, and read the fingerprint shown (sha256: and 16 characters) to the conductor; paste the public half too (it is not secret). Your …
The whole status, with everything done: agents/identity/status.json (13,132 B, 304be4e2c8)

Open first, before any other file: the hand-over written by the session before yours: agents/identity/HANDOVER.md (7,305 B, 15d88b1f1e)

Your files

32 files, 184,181 bytes in all (about 76,742 tokens to read every one): app/login/ 13, tools/ 11, account/ 3, agents/identity/ 3, SECURITY.md/ 1, data/ 1. The ones to open first:

data/lanes.json (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis (incident.identity@web-summit.dinis; the design is …
tools/lane-test.mjs (16,284 B, bd16ddc89f): lane-test.mjs: the lane, end to end, with throwaway keys made here and thrown away (nothing is written to a …
tools/lane-handover.mjs (6,612 B, d8632c38ee): lane-handover.mjs: hand a vault key to another agent (the conductor) without the key ever being readable on …
account/inbox.json (374 B, 2136cc296c): Replies to Dinis Cruz, each sealed to his public key (ciphertext: sgit's hybrid v2 envelope as an m1 code). …
tools/lane-seal.mjs (2,256 B, ac1fce320d): lane-seal.mjs: the reverse path. Sign with this agent's key, seal to a key in data/keys.json (Dinis's), 7 …
tools/lane-configure.mjs (4,767 B, a646464f8d): lane-configure.mjs: open the feedback lane on an existing vault (the bridge vault). It does not create the …
tools/lane-open.mjs (1,150 B, 28d4870af4): lane-open.mjs: open what Dinis sealed to this agent, and judge it. One JSON line per message. node …
tools/lane-sign.mjs (2,480 B, 058d4a541b): lane-sign.mjs: this agent signs the files that say what is safe, so a reader can check who wrote the bytes …
tools/lane-common.mjs (7,656 B, 08bcc6e9d6): lane-common.mjs: what the lane tools share (incident.identity@web-summit.dinis; the design is SECURITY.md). …
tools/lane-drain.mjs (5,577 B, ce28e4a0a9): lane-drain.mjs: the conductor's drain, each wake. Lists the lane (metadata only), fetches what is pending, …

Every one, with who last changed it: the catalogue, filtered by your paths.

Your neighbours

What your files say they read, and who reads yours: taken from the links and sources the files themselves declare. A contract here is an address and a shape that does not depend on anyone's session.

You read:

incident.conductor@ (5 files of theirs): BRIEF.md (40,812 B, 98c613e443): Dinis Cruz, 10 November 2026, in his session with …; RESTRUCTURE.md (6,174 B, db3b59871b): Kept by incident.conductor@web-summit.dinis, 11 November 2026, 02:25 …; admin/build/validate.mjs (7,941 B, 31c59df9f2): The gate: must print OK, and a red gate is no release. Budget: 8 …; and 2 more
incident.librarian@ (4 files of theirs): tools/policy-check.mjs (7,926 B, 37bfcd6091): The path policy's check (incident.librarian@web-summit.dinis, 10 …; library/abp.json (42,505 B, a82ecc1efd): What is particular to each agent's behaviour policy: its business …; library/abp.md (11,311 B, 3dbcbd5f91): Kept by incident.librarian@web-summit.dinis, 2026-11-11, 11:51 UTC. …; and 1 more
incident.designer@ (2 files of theirs): app/design/theme.js (737 B, 2f798348d8): The theme and the lens, applied before the page paints: load in the …; app/design/frame.js (2,983 B, d4d3dd701c): The frame: the theme switch (auto, light, dark) and the address shown …
incident.archivist@ (1 file of theirs): data/vaults.json (2,638 B, 0e2d500a57): The vaults this site reads or keeps evidence in (SG/Send, encrypted …
incident.models@ (1 file of theirs): tools/llm.mjs (11,505 B, 9a1369738c): The model ledger's one wrapper (incident.dev@web-summit.dinis, 10 …

They read yours:

incident.librarian@ (4 files of yours): SECURITY.md (14,418 B, f5fa4cc155): Kept by incident.identity@web-summit.dinis, 11 November 2026, 09:39 …; app/login/pki/PIN.json (1,997 B, d93100940a): Copies of pki.sgit.ai's modules, byte for byte, read on 10 November …; data/lanes.json (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis …; and 1 more
incident.planner@ (2 files of yours): SECURITY.md (14,418 B, f5fa4cc155): Kept by incident.identity@web-summit.dinis, 11 November 2026, 09:39 …; data/lanes.json (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis …
incident.storyteller@ (2 files of yours): data/lanes.json (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis …; tools/lane-handover.mjs (6,612 B, d8632c38ee): lane-handover.mjs: hand a vault key to another agent (the conductor) …
incident.designer@ (1 file of yours): account/index.html (4,082 B, 7b25f522f7): index.html

Open cards on the board

a-dinis-key (ask, open): Log in with a passkey and read the fingerprint to the conductor; waiting on Dinis
a-identity-decisions (ask, open): Three decisions on your login and the feedback lane (SECURITY.md); waiting on Dinis
a-sources-3 (ask, open): One line for SECURITY.md section e, from the first handover; waiting on incident.identity@
j-identity-1 (job, blocked): incident.identity@: when Dinis has made his key: the conductor adds his public half to data/keys.json (after he reads the fingerprint)…; waiting on Dinis
j-identity-2 (job, blocked): incident.identity@: when a token is in the environment and he says yes: the bridge vault (sgit), then SG_SEND_TOKEN and LANE_VAULT_KEY…; waiting on Dinis
j-identity-3 (job, blocked): incident.identity@: sign in with pki.sgit.ai (sso.js) if that is his choice in decision 1; waiting on Dinis
j-identity-round-2 (job, open): incident.identity@: Round two: Account becomes Log in

Each card: board/items/<id>.json.

What this pack cost you

8,620 bytes (about 3,592 tokens, estimated at 2.4 bytes a token). It points at 28 files of 262,973 bytes; your own files are 184,181 bytes.