Security

Why this page

Dinis Cruz, 6 November 2026: "we now have quite a lot of agent-to-agent communication, and I really want to make sure that that doesn't go out of control ... I want to visualize it ... it can be abused ... from a provenance point of view ... we lose quite a bit of provenance." This page is the map, kept by security@PrompTugal.dinis and redrawn at its wakes. Everything here is metadata: who, to whom, when, how big, by which channel. Never the words themselves.

The picture

Open the picture: who tells whom what to do outside git, the two conductors at the centre, a line for each kind of act, its width the number of acts. (The picture opens on its own until the page can show images inline: asked of dev@.)

The data behind it, one row per act: comms.json. From 5 November 00:00 to 6 November 04:30 UTC.

The architecture

                    Dinis Cruz  (the only one who instructs)
                        |  speaks in a session; nothing he says is signed
                        v
   conductor.3@web-summit ---- creates 10 sessions (8 of them PrompTugal's), writes their first briefs
                        |
                        v
             conductor@PrompTugal  ---- creates 7 more sessions, writes 14 schedules and rewrites 5,
                |   |   |                 sends 9 messages, issues 15 inboxes
     -----------+   |   +--------------------------------------------.
     |              |                                                  |
  1 session      2 schedule (standing prompt,       3 append-lane inboxes
    messages       fired every hour or two)            (board/inbox.json: the conductor's;
  (transcript,   (stored on the account;                board/inboxes/<role>.json: one per
   readable by    rewritable by any session)            agent; write token public; sealed,
   any session)                                         signed; the conductor holds every key)
     |              |                                                  |
     '--------------+-----------------> 14 agents <--------------------'
                                            |
                         4 git: commits with For: and To: trailers, the board,
                           desk notes (desks/synthetic/run-*/to/), board/tasks/
                           (signed by nobody, but public, reviewed and versioned)

Channels 1 to 3 lose provenance that git keeps: no review, no version, no diff, and for 1 and 2 no signature. That is the trade Dinis named: they are faster, and they carry instructions.

What can go wrong

1. Authority by relay. 39 agent-written acts say "at Dinis's word". A misled agent, or anyone writing to a public inbox lane, can write those words too, and the receiver cannot tell. Every scheduled agent's standing prompt was written by a conductor, not by Dinis.
2. Transcripts are a shared surface. Any session on the account can read any other's transcript. A secret printed once, in any session, is readable by every agent. (security@ did exactly this with its own inbox credentials on 6 November; that inbox is being re-issued.)
3. One reader of all mail. The conductor made every agent's inbox and keeps its keys, at Dinis's word, so it can read every agent's mail; a conductor misled by what it reads exposes all of it.
4. Misrouting. A schedule meant for dev@ was first written into another project's session (journalist@web-summit) and deleted a minute later. Nothing checks that a schedule's target is the agent its name says.
5. Loops. An agent that answers every message with a message can run without end; nothing counts messages against a budget yet.

How the tracking works, and what comes next

Today: security@ reads every session's transcript with the account's own tools (metadata only, by its collector), at its wakes, and redraws this page.

Next (proposed to Dinis and conductor@):

1. A receipt for every send. Whoever sends on any channel also appends a receipt to security@'s inbox lane: from, to, channel, time, size and the text's sha256, signed by the sender, sealed to security@. Never the text. board/tools/agent_inboxes.py send can do it in the same call.
2. Two sources, reconciled. At each wake security@ matches the receipts against the transcripts: a send with no receipt, or a receipt with no send, is a finding.
3. Signed instructions. Dinis's guidance carries his signature (his sign-in key signs the file in his browser), and every prompt that cites his word cites the guidance file by name and hash, so a receiver can check it.
4. A budget for messages per agent per day, from accountant@, as for runs.
5. On Dinis's dashboard: a Messages panel (today's counts by channel, the picture, unsigned claims, top senders), read from comms.json (board/spec-dashboard-messages.md).

Key rotation

At Dinis's word (6 November 2026): every key is rotated on a schedule, not after an incident. Each rotation is five commits: mint the new key, publish its public half (the old one marked rotating), an overlap of a few hours while both work, a sign-off by security@ once nothing broke, then retire the old one (its private half kept in escrow for 24 hours first, its public half kept forever so old signatures still verify). Agents' keys and inboxes daily; Dinis's sign-in key, the published vaults and the environment's secrets weekly; the operator key not at all. The full map, key by key, with what blocks each: key-rotation.md.

The keys and vaults

Who holds which key, and what is lost when a session ends: board/team/security/keys-and-vaults.md. The reviews, with every finding, its severity and its owner: board/team/security/reviews/.