pki.sgit.ai / book

A Key Means Nothing Alone

Identity, mandate, and the exposure nobody accepted. What pki.sgit.ai built between site v0.1.25 and v0.1.32, why the concepts underneath it are shaped the way they are, how it composes with RiskMandate.ai, and — as an equal partner to all of that — what none of it proves.

17 chapters in five parts 35,466 words 14 figures, each taken at the tag its caption names 65 verified quotations 48 claims drawn by the writer
📄 The PDF Reads start to finish offline, with no link followed 🃏 The reference card One page, written to be pasted into an agent session 🤖 llms.txt The book's front door, carrying the positions a summary must not drop {} book.json Every chapter with the SHA-256 of its markdown; every figure with its digest
Before anything else. The register this book describes is built; the trustworthy register is not — ten of its eleven records are fixtures whose private keys are published on purpose, so every signature verifies and proves nothing, and the root is a fixture too. The enforcement is real and the authority is not, and they are independent halves. Every grant is a floor, not a census. Two environments, one agent, one mandate. This is a participant's account, published by the project that builds the layer it argues for. A reader who finishes believing the register is trustworthy has read a book that failed. The front matter states all eight positions →

Contents

Front matter
00A Key Means Nothing Alone1,540w
Part one — Why there is nothing to inherit
011 · A key means nothing alone1,693w022 · The flood, and the four rules it produced1,528w033 · The bootstrap trap1,978w
Part two — The vocabulary, and why each word is load-bearing
044 · Grant is not mandate1,768w055 · The delta1,677w066 · Boundary, setting, expectation1,727w077 · Reality before the risk register1,470w
Part three — What was built
088 · The register3,088w099 · A grant is discovered, not authored2,314w1010 · A push refused by something that is not the agent2,068w1111 · The building blocks1,913w
Part four — How it composes
1212 · The library and the instance2,536w1313 · Two paths1,787w1414 · Eight releases in forty hours2,114w
Part five — Honesty, and a first step
1515 · Where this estate disagrees with itself, and what it does not say2,938w1616 · What ships, what is argued2,944w1717 · Your first mandate, tomorrow1,923w
Appendix
18Appendix A · The harness2,901w
End matter
19Colophon · What was cut, what is open, and what this book got wrong2,135w20Reference card1,189w

What this estate states, and what this book concluded

Every load-bearing claim about what this estate means is marked, and the marking is a sentence rather than a sigil. 65 passages are quoted verbatim from the estate, each with a source that is discovered rather than asserted and re-read out of that source on every build — a quote not found where it claims to be fails the build. 48 claims are the writing session's own reasoning, shown in the reader's view rather than in a note. Do not treat the drawn claims as this estate's positions. Every quotation and its source: quotes.json.

The figures, and the two gates

A figure captioned as the past but photographed today is a reconstruction — and a reconstruction wearing a caption is a claim of authority nobody granted, in a book whose whole subject is claims of authority nobody granted. So every figure was taken from the version its caption names: a git worktree at the tag, a one-shot server on a port used once and never again, a headless browser killed in a block that runs whether the capture succeeded or failed. Each carries the page, the tag, and the SHA-256 of that page's bytes at that tag.

Two gates, because there are two different claims. A figure of a past version is re-derivable — re-running the harness at that tag reproduces the digest, and it never goes stale because the tag does not move. A figure of the site as it stands is fresh — the digest must match the live page, and the build fails when it stops matching, which it will on the next release. That is correct and it is inconvenient.

FigureTagGateWhat to notice
f01-bench-two-columnscurrentfreshThe two columns are the same width. The limits are not a footnote to the claims — they are set beside them, at equal weight, and the generator refuses to build an entry whose right-hand column is empty.
f02a-registry-at-v0.1.26v0.1.26re-derivableThe register on the day it shipped. Compare the status language with the panel below: this page already says the root is a fixture.
f02b-registry-nowcurrentfreshThe same page four days later. What changed is not the architecture but the number of places the page admits something — the corrections accumulated faster than the features.
f03-six-answerscurrentfreshFour of the six answers are NO, and they are NO for four different reasons — revoked, expired, never accepted, identity revoked. A verifier that collapses those into one failure state is wrong on three of them.
f04-identity-rawcurrentfreshRead `private_key_published` before you read the signature. And note `publication_intent: deliberate` — a secret is defined by expectation, not by content, so the intention is recorded at issue, because afterwards a deliberate publication and a leak look identical.
f05-validatecurrentfreshSix expected answers, six reproduced — and the fixture line printed for every record before any of them. The validator reads the flag first by construction, not by convention.
f06-sgit-verifycurrentfreshThe signer line names a fixture. The CLI is not wrong; it is answering the only question a signature can answer — who held the private half — and on this record the answer is everybody.
f07-forgerycurrentfresh`Verified OK` on a document that says `anyone can sign this`. Nothing failed. That is the point: a signature anybody can produce conveys nothing, and the register verifies it exactly as diligently as any other.
f08-refused-pushcurrentfreshThe last line before the banner is git's exit code, not the agent's decision. Read the Tier line at the bottom: the control names its own weakness on its own face.
f08b-amendedcurrentfreshThe same tag, the same command, the mandate the release actually ships — and it PERMITS. The release documenting the refusal cannot contain the state that produced it, because the control refused the release carrying its own documentation until the mandate was amended.
f09-tier-badgescurrentfreshTwo channels, never one: the border style carries the state as well as the colour, and the word is always present. `unknown` renders as `unknown` — never as a blank, because a gap is a fact about the floor.
f10-defeated-boundarycurrentfreshThe stored document says `boundary`. The block renders `setting`, with the defeat path attached. This is the rule working on real data that is wrong — the estate's own measurement tool produced the bad label.
f11-authority-splitcurrentfreshTwo indicators, never one. Averaging them into a single status is exactly how a demonstration gets mistaken for a control.
f12-assess-midflowcurrentfreshEscalation is drawn as an edge, not written as a note — so the reader sees the path that goes around a stated control rather than reading that one exists.

The harness is published with the book so any figure can be re-taken rather than believed: travel.sh, shot.mjs, transcripts.sh, shots.json. Gates: python3 book/build.py --check. Appendix A carries all of it.

The commissioning brief

This book was commissioned before it existed, and the brief was published at the same time: the commissioning brief (raw markdown). Where a number in the brief disagreed with the repository, the repository won and the brief was wrong — it happened four times, and the colophon lists all four.