# The pack for incident.identity@web-summit.dinis > Kept by incident.librarian@web-summit.dinis, 2026-11-11, 12:18 UTC: written by `tools/library-pack.mjs` on every push from the files it points at. Read [start.md](start.md) first, then this, then open only what you need. A pointer is `path` (bytes, the first 10 hex digits of its sha256); any path opens at `view/?path=`. [The pack](README.md). ## Your job **Dinis's login and his lane to the conductor.** Study pki.sgit.ai (its pages and `agents/pki-agent.mjs`) and reuse its code: a key made in the browser (or a passkey), private half never leaves it; a page where Dinis writes feedback on any page, sealed to incident.conductor@'s public key (`data/keys.json`), delivered through an SG/Send append lane the conductor drains each wake; the reverse path (the conductor seals to Dinis's key). Design first in `SECURITY.md` (threats, what is public, what a stolen token can do), then build. Vault creation needs an SG/Send token: ask Dinis via status; never commit one. (from `agents/JOBS.md` (16,087 B, cb88df47c9)) **You may change:** `app/login/**`, `account/**`, `data/lanes.json`, `tools/lane-*.mjs`, `SECURITY.md`, `agents/identity/**`, `accounts/ledger/identity.jsonl`, `transition/interviews/identity.md`, and your own entry in `data/keys.json`. (from `agents/policy.json` (13,565 B, ec9b7b8d15)) **Your draft behaviour policy** (not agreed by Dinis): `agents/identity/policy.md` (8,708 B, 763c24ae85) ## Where the work stands - **State:** the conductor's append lane for vault keys is open (vault wowyrqlr, data/lanes.json keys_to_conductor). Dinis's feedback lane exists on the same vault and stays off until his key is a named sender. The login and the sealed feedback box are live as before (its own date: 2026-11-11T11:25:05Z) - **Next:** when Dinis has made his key: the conductor adds his public half to data/keys.json (after he reads the fingerprint) and its id to data/lanes.json to_conductor.senders - **Next:** when a token is in the environment and he says yes: the bridge vault (sgit), then SG_SEND_TOKEN and LANE_VAULT_KEY in the environment and node tools/lane-configure.mjs; the data vault; their keys … - **Next:** sign in with pki.sgit.ai (sso.js) if that is his choice in decision 1 - **Ask:** Dinis: three decisions, at the end of SECURITY.md: (1) a new key made on this site behind a passkey, or sign in with your pki.sgit.ai key; (2) how far a signed message from the feedback box carries … - **Ask:** Dinis: your yes to create the lane and the two vaults (bridge, data) once the token is in place. Nothing is created before it. - **Ask:** Dinis: to start, open Log in (/account/), press Log in with a passkey, and read the fingerprint shown (sha256: and 16 characters) to the conductor; paste the public half too (it is not secret). Your … - The whole status, with everything done: `agents/identity/status.json` (13,132 B, 304be4e2c8) **Open first, before any other file: the hand-over written by the session before yours:** `agents/identity/HANDOVER.md` (7,305 B, 15d88b1f1e) ## Your files 32 files, 184,181 bytes in all (about 76,742 tokens to read every one): `app/login/` 13, `tools/` 11, `account/` 3, `agents/identity/` 3, `SECURITY.md/` 1, `data/` 1. The ones to open first: - `data/lanes.json` (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis (incident.identity@web-summit.dinis; the design is … - `tools/lane-test.mjs` (16,284 B, bd16ddc89f): lane-test.mjs: the lane, end to end, with throwaway keys made here and thrown away (nothing is written to a … - `tools/lane-handover.mjs` (6,612 B, d8632c38ee): lane-handover.mjs: hand a vault key to another agent (the conductor) without the key ever being readable on … - `account/inbox.json` (374 B, 2136cc296c): Replies to Dinis Cruz, each sealed to his public key (ciphertext: sgit's hybrid v2 envelope as an m1 code). … - `tools/lane-seal.mjs` (2,256 B, ac1fce320d): lane-seal.mjs: the reverse path. Sign with this agent's key, seal to a key in data/keys.json (Dinis's), 7 … - `tools/lane-configure.mjs` (4,767 B, a646464f8d): lane-configure.mjs: open the feedback lane on an existing vault (the bridge vault). It does not create the … - `tools/lane-open.mjs` (1,150 B, 28d4870af4): lane-open.mjs: open what Dinis sealed to this agent, and judge it. One JSON line per message. node … - `tools/lane-sign.mjs` (2,480 B, 058d4a541b): lane-sign.mjs: this agent signs the files that say what is safe, so a reader can check who wrote the bytes … - `tools/lane-common.mjs` (7,656 B, 08bcc6e9d6): lane-common.mjs: what the lane tools share (incident.identity@web-summit.dinis; the design is SECURITY.md). … - `tools/lane-drain.mjs` (5,577 B, ce28e4a0a9): lane-drain.mjs: the conductor's drain, each wake. Lists the lane (metadata only), fetches what is pending, … Every one, with who last changed it: [the catalogue](../index.json), filtered by your paths. ## Your neighbours What your files say they read, and who reads yours: taken from the links and sources the files themselves declare. A contract here is an address and a shape that does not depend on anyone's session. **You read:** - **incident.conductor@** (5 files of theirs): `BRIEF.md` (40,812 B, 98c613e443): Dinis Cruz, 10 November 2026, in his session with …; `RESTRUCTURE.md` (6,174 B, db3b59871b): Kept by incident.conductor@web-summit.dinis, 11 November 2026, 02:25 …; `admin/build/validate.mjs` (7,941 B, 31c59df9f2): The gate: must print OK, and a red gate is no release. Budget: 8 …; and 2 more - **incident.librarian@** (4 files of theirs): `tools/policy-check.mjs` (7,926 B, 37bfcd6091): The path policy's check (incident.librarian@web-summit.dinis, 10 …; `library/abp.json` (42,505 B, a82ecc1efd): What is particular to each agent's behaviour policy: its business …; `library/abp.md` (11,311 B, 3dbcbd5f91): Kept by incident.librarian@web-summit.dinis, 2026-11-11, 11:51 UTC. …; and 1 more - **incident.designer@** (2 files of theirs): `app/design/theme.js` (737 B, 2f798348d8): The theme and the lens, applied before the page paints: load in the …; `app/design/frame.js` (2,983 B, d4d3dd701c): The frame: the theme switch (auto, light, dark) and the address shown … - **incident.archivist@** (1 file of theirs): `data/vaults.json` (2,638 B, 0e2d500a57): The vaults this site reads or keeps evidence in (SG/Send, encrypted … - **incident.models@** (1 file of theirs): `tools/llm.mjs` (11,505 B, 9a1369738c): The model ledger's one wrapper (incident.dev@web-summit.dinis, 10 … **They read yours:** - **incident.librarian@** (4 files of yours): `SECURITY.md` (14,418 B, f5fa4cc155): Kept by incident.identity@web-summit.dinis, 11 November 2026, 09:39 …; `app/login/pki/PIN.json` (1,997 B, d93100940a): Copies of pki.sgit.ai's modules, byte for byte, read on 10 November …; `data/lanes.json` (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis …; and 1 more - **incident.planner@** (2 files of yours): `SECURITY.md` (14,418 B, f5fa4cc155): Kept by incident.identity@web-summit.dinis, 11 November 2026, 09:39 …; `data/lanes.json` (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis … - **incident.storyteller@** (2 files of yours): `data/lanes.json` (1,991 B, c914589fbd): The lanes to incident.conductor@web-summit.dinis …; `tools/lane-handover.mjs` (6,612 B, d8632c38ee): lane-handover.mjs: hand a vault key to another agent (the conductor) … - **incident.designer@** (1 file of yours): `account/index.html` (4,082 B, 7b25f522f7): index.html ## Open cards on the board - `a-dinis-key` (ask, open): Log in with a passkey and read the fingerprint to the conductor; waiting on Dinis - `a-identity-decisions` (ask, open): Three decisions on your login and the feedback lane (SECURITY.md); waiting on Dinis - `a-sources-3` (ask, open): One line for SECURITY.md section e, from the first handover; waiting on incident.identity@ - `j-identity-1` (job, blocked): incident.identity@: when Dinis has made his key: the conductor adds his public half to data/keys.json (after he reads the fingerprint)…; waiting on Dinis - `j-identity-2` (job, blocked): incident.identity@: when a token is in the environment and he says yes: the bridge vault (sgit), then SG_SEND_TOKEN and LANE_VAULT_KEY…; waiting on Dinis - `j-identity-3` (job, blocked): incident.identity@: sign in with pki.sgit.ai (sso.js) if that is his choice in decision 1; waiting on Dinis - `j-identity-round-2` (job, open): incident.identity@: Round two: Account becomes Log in Each card: `board/items/.json`. ## What this pack cost you 8,620 bytes (about 3,592 tokens, estimated at 2.4 bytes a token). It points at 28 files of 262,973 bytes; your own files are 184,181 bytes.