The working vault

All work after v1 happens in a public, zero-knowledge encrypted vault, with its read key published here so that anyone can read along: drafts, comments, reviews, the board. Its write key is never published. When a version is signed off it moves from the vault into the repository, on top of the one before, and the versions page shows the delta.

Open it

In the browser

https://dev.vault.sgraph.ai/#sgit_public_read_fd8863c5827775f5e2fe66ba9f0bb4eb80d0357b120f43fa38091ded95975cda%3Ac14khrb8

With sgit

pip3 install sgit-ai then sgit clone sgit_public_read_fd8863c5827775f5e2fe66ba9f0bb4eb80d0357b120f43fa38091ded95975cda:c14khrb8 (read-only)

Vault id

c14khrb8 on https://dev.send.sgraph.ai

Read key

sgit_public_read_fd8863c5827775f5e2fe66ba9f0bb4eb80d0357b120f43fa38091ded95975cda:c14khrb8 (deliberately public; it opens the vault read-only)

Created

2026-10-18, by the session that built this site, from the build brief

What is in it

• README.md: what the vault is, the rule, and how to work in it
• _page.json: the vault's own front page, rendered by the vault browser
• book/: the working copy of the book: v1/content/ and v1/images/ as imported, the text the second edition starts from
• map/map.json: the chapter-to-article map, copied from the repository at each release
• reviews/: one record per chapter of the 2018 text (spelling, dated facts, broken links, verdict), the reviewer's work in progress
• interviews/: the editor's interview scripts and the transcripts, verbatim
• board/: BOARD.md and issues/open|blocked|done/: what is open, in progress and done
• team/: the roles' working copies of their role.md, briefs and debriefs
• graph/: the book as a graph, when it exists: ontology, taxonomy, nodes per chapter, section and paragraph
• comments/: comments and voice comments attached to a section, as files

The vault opens on its own page (_page.json), with the same sections. Every file in it is encrypted on the device before it leaves; the server never sees plaintext, and the read key published above is what decrypts it in your browser.

The private vault

The OpenRouter key the agents use to reach a model never goes in the public vault: anything in a vault whose read key is published is readable by everyone. It goes in a second vault, z292ze46, whose key is held only by Dinis and is not in this repository or on this site; the key itself carries a credit limit set at OpenRouter, so a mistake costs a little. The vault holds a README.md and an openrouter.env.example and nothing else until Dinis puts the key in. The newsroom's reader-vault pattern, a passkey opening the vault, is the intended door; see the passkey opens the vault.

The rule, and the gate

The repository's release gate (admin/build/validate.js) refuses any file carrying a private sgit key (any string with sgit's private-key prefix), the same rule sgit's own scanner uses; the public read key passes because public and private differ by a word, not a character. The vault's write key and the private vault's key were delivered to Dinis in the session that created them and exist nowhere in this tree.