method candidate goes to: this-edition V villager
Where the keys live: a password manager for the keys a person holds, a registry vault for the keys agents make
Once agents create vaults several times a day, keeping the keys by hand stops working. The keys a person holds go in a password manager, which is and will stay the preferred home; everything the agents create goes to a registry, a private vault run by its own isolated Claude session with no other access, the vault of vaults, so a key is never lost and never has to live in a browser tab or a chat. Remembering keys under aliases on one machine is a convenience, not a management system. The weakest step is giving a key to another agent, because the agent platforms have no secrets per session.
Decided by. Nobody yet: a candidate for Dinis to read, comment on and decide (keep, rewrite, merge, cut, article first, later, not doing it).
Note. State at sgit-ai v0.20.0, 10 October 2026. The gap, quoted from the platform's docs: on Claude Code on the web an environment variable is one 'any command Claude runs can read' and 'Anyone who uses the environment can read the values'; a network secret keeps the key outside the VM but is per environment and cannot help with a vault key, because decryption happens inside the session; Codex removes its secrets before the agent phase starts. So a key for another agent travels in the prompt (a transcript), in an environment variable (every session reads it), or not at all, with the agent making its own vault and sending the key back on a lane, the pattern used most. The four tracks next: password manager integrations (an open call published, not followed up yet), secrets.sgit.ai (a keyring unlocked by a passkey's PRF output, a 128-bit recovery code shown once, at v0.1.13 the design and a lab shipped and the app proposed), PKI (RFC 0001), and decryption out of band (an idea, not a design).
Where it comes from
- Where the vault keys live Where the vault keys are kept today; The weakest step: giving a key to an agent; What comes next (newsroom)
What it answers in the 2018 book
- none named
Where it goes
Chapter Privacy by design: SG/Send, sgit, and the value of constraints, part Build it without a server (drafting); topic Security for the agent era: least code, supply chain, secrets, learning to hack.
Other ideas proposed for the same chapter: Git for things you cannot put on GitHub: what an encrypted vault is, One string is address, authorisation and key; the read key derived from it is safe to publish, An app in a vault runs against the vault without ever being handed a key, Encryption on the client moves the problem from the data to the keys, and the sovereignty line to whoever holds them, Append lanes: one POST from anywhere, readable only by the vault's owner, Nobody buys it for the encryption: the features came from the constraint, Client-side encryption reduces the exposure under GDPR; it does not take you out of it.
Node idea:a-password-manager-and-a-registry in graph.json; see it in the graph. Source: admin/content/graph/ideas.json.