# Brief For The pki.sgit.ai Site Agent: Specification For The Insurance Ecosystem Pack, What To Inventory Before Writing It, And The Four Findings That Are Already Established

**version** v0.33.62
**date** 26 August 2026
**from** Human (project lead)
**to** The pki.sgit.ai site agent

**type** Dev brief

*Fourth of 26 August, and written to be handed over rather than read here. It specifies a development pack and does not contain one, because writing the pack requires the codebase, the existing vault applications and the current tooling surface, none of which this session has. What it does contain is the material that was measured or checked rather than assumed, which is a smaller set than the pack needs and is the part nobody else is positioned to produce. Limitation: the version number assumes one working-day increment since 20 August, and one primitive document is attached separately as evidence rather than being restated here.*

---

## What This Is

A specification for the pack you should write, the inventory that has to precede it, and the findings you should inherit rather than re-derive: **the objective is an end-to-end ecosystem on vaults where a new agent session is told the rules of the game, is handed its own policy, is measured against it while it works, and is refused by something that is not itself when it exceeds cover, with the whole flow visible in a room somebody can watch; the pack must cover vault topology, a policy object, the points in a session's lifecycle where policy is evaluated, the parties, the workflows, the interface and a build order, and it cannot be written honestly until somebody establishes what already exists, because the memo names messaging vaults, board vaults, data vaults and key vaults that already work and a design written without reading them will duplicate what is there and assume what is not; four things are already established and should be inherited rather than argued, being that the usage ledger must be an append lane rather than a shared vault because an append token grants write and nothing else while a write key grants purge, that hook types include an HTTP variant which moves the policy decision off the machine and is the difference between a setting and a boundary, that token usage has four separate counters of which the obvious one is wrong by five orders of magnitude, and that a June brief and the August vocabulary use the word mandate to mean opposite things so the collision must be settled before any schema ships; the economics were settled earlier today and should not be reopened, since the premium is paid in allocation from a finite pool, pooling is the mechanism, correlation is what breaks it, experience rating lands on the team rather than the agent, and recoverability decides what may be insured at all; and the pack should be judged by one test, that a session which has read only the pack can create the vaults, wire the hooks, author one policy, run a working day and produce a room showing a refusal, a recorded draw and a waiting request, without asking anybody a question, because any question it has to ask is a gap in the pack rather than a gap in the reader.** New contributions: **the pack specified rather than written, the nine-item inventory, the eleven questions it must answer, the four inherited findings, and the acceptance test for the pack itself.**

## Do This First: The Inventory

**The pack cannot be written honestly until this exists**, and the first deliverable is the inventory rather than the architecture. Nine items, none of which was available to the session writing this brief.

| Establish | Why the pack depends on it |
|---|---|
| **What the existing vault applications do** | The memo names messaging, boards, data stores and key vaults. If a board application exists, the room is a variation of it rather than a new build |
| **What the messaging vault implementation looks like** | The claims flow is messaging, and there is apparently a working one. This is the item most likely to change the design |
| The current command surface of the vault tool | Every workflow step names an operation, and they should come from the tool rather than from documentation |
| **The full lifecycle event list available for hooks** | Only two events were directly observed in one environment. The decision points depend on which exist |
| What the risk product holds today | The instance side of the split, and whether policies belong there or in a new vault |
| Who the parties actually are | They are people with existing responsibilities, not roles invented for a diagram |
| **The 18 June agentic-permissions pack, in full** | Eighteen documents covering permissions bills of materials, skills as code, and terms and conditions framing. Two were read. The rest are eighteen chances to duplicate something |
| The graphs site lexicon and edge sets | Use the house graph conventions rather than inventing a schema |
| Whether a lane with no registered anchors accepts any token holder | Absent from the published interface reference, and it gates who can report usage at all |

## Four Findings To Inherit

Checked or measured rather than assumed. Take these as given.

### The ledger must be an append lane, not a shared vault

The obvious design gives agents a shared write key to a usage vault. It fails on one property:

> **A write key grants configure and purge.** An agent that can record its own usage can delete the record of it.

| | Shared vault, write key | **Append lane, append token** |
|---|---|---|
| Agent writes its usage | Yes | **Yes** |
| Agent deletes its usage | **Yes** | **No** |
| Agent reads others' usage | **Yes** | **No** |
| Agent learns anything by writing | Sizes, timing, contents | **Nothing. Blind acknowledgement** |
| Needs an account | Yes | **No** |

The blind acknowledgement matters beyond tidiness: **an agent cannot discover how much cover the estate has left by writing to the lane and reading the response.**

Published limits to design against: five megabytes per write, **one thousand pending files per token**, one hundred identifiers per batch, three megabytes cumulative inline content when listing, and a page size of fifty by default and two hundred at most. The binding one is the thousand, and usage events are small and frequent, so **draining is an obligation rather than an option** and batching within a session is the first mitigation.

### Hook types include an HTTP variant

The published settings schema allows hook types of `command`, `prompt`, `agent`, `http` and `mcp_tool`, with optional asynchronous execution, a timeout and a permission-rule filter.

**`http` is the architecturally significant one**, because the policy decision can then be made off the machine by a service holding the authoritative balance, rather than by a script that must be given the numbers and can be edited by whatever it is policing. That is the difference between a setting and a boundary, and it is the same property the external policy language has when it evaluates outside the agent's loop.

A reasonable division: local script for the pilot, since it is offline and has no availability risk; HTTP for anything real, failing closed for draws and open for usage reporting.

### Token usage has four counters and the obvious one is wrong

Measured inside a running session and attached separately as a reference document. Totals across one working session:

| Counter | Value |
|---|---|
| `input_tokens` | **562** |
| `cache_creation_input_tokens` | 16,988,879 |
| `cache_read_input_tokens` | **91,336,787** |
| `output_tokens` | 967,984 |

> **A policy written against `input_tokens` would have measured 562 for a session that moved a hundred and nine million tokens.**

Four counters need four prices. And the dominant term is cache reads, which grow with conversation length rather than with work done, so a token policy measures duration at least as much as activity, and the rate table has to decide whether that is intended.

### Mandate names opposite things in June and August

| | 18 June | 20 August onward |
|---|---|---|
| The union of everything an agent can do | **"Agent Mandate"**, recommended | **The grant** |
| The narrow thing that was authorised | Not named separately | **The mandate** |

So the word names the **maximum** in one part of the corpus and the **minimum** in another, which is the most expensive kind of collision because both readings are plausible.

**Recommendation: the August vocabulary governs**, because it is later, it is what every document since 20 August uses, and it is the only one that lets the delta be expressed at all. What survives from June: the passport critique, **Authority Envelope** as a good synonym for the grant's outer boundary, Blast Radius for the consequence, and power of attorney as the explanatory analogy.

## What The Pack Must Cover

| Section | Must settle |
|---|---|
| **Vault topology** | Which vaults exist, who holds which key, and why each capability tier was chosen |
| **The policy object** | Schema, including the rules version it was written against, the draw mode, and the reason attached to every exclusion |
| **Decision points** | Which lifecycle events are hooked, which one is enforcement and which are instrumentation |
| **Parties** | Who may issue, approve, draw, drain and audit, and what each is prevented from doing by key topology rather than by instruction |
| **Workflows** | Session start, ordinary work, recorded draw, requested draw, exhaustion, the maintainer run, and a repricing event |
| **Interface** | The room and the cards, including the session briefing an agent is handed at start |
| **Build order** | Ordered by dependency, with an acceptance test per step |

**Three design constraints that should not be rediscovered.** Refusal must come from outside the agent's reasoning loop, which in practice means a hook. Balance derivation never runs in the agent, which the lane enforces anyway since the agent cannot read it. And silence below cover is a requirement rather than an omission, because a system that comments on ordinary work is turned off within a week.

## The Eleven Questions The Pack Must Answer

| # | Question |
|---|---|
| 1 | Which existing vault applications are reused, and which parts of the room are genuinely new? |
| 2 | Where do policies live: a new vault, the risk product, or the existing key vault pattern? |
| 3 | Which lifecycle events exist to hook, and which decision points are therefore available? |
| 4 | Local script or HTTP hook for the pilot, and what fails when it is unreachable? |
| 5 | Who are the real parties, and which already exist as roles? |
| 6 | What is the drain cadence, and what watches the drain? |
| 7 | Which primitives are in the first policy, and what are their initial numbers? |
| 8 | Who owns the rate table? |
| 9 | **Is `mandate` the union or the narrow thing, in the schema that ships?** |
| 10 | Does the room reuse the board application, and if so what does it lose? |
| 11 | What is the first refusal the pilot demonstrates, and to whom? |

**Question nine is a decision rather than a discovery** and it blocks the schema.

## The First Increment, If You Want One Before The Pack

Small, and it proves the thesis end to end.

The three policies most worth building first are all about git, and **they compile to one file**: commit rate and diff size to a pre-commit hook, branch constraint to a pre-push hook. That environment already runs a session-end hook doing a different check, so the mechanism is present and in use.

> **Acceptance: attempt a commit of 400 kilobytes and be refused by something that is not the agent.** Attempt the eleventh commit of the day and be told a draw was recorded. Attempt a push to a branch outside the mandate and be refused.

That is the whole argument in three commands, and it produces a real refusal before any vault exists.

## The Acceptance Test For The Pack Itself

> A session that has read only the pack creates the vaults, wires the hooks, authors one policy, runs one working day, and produces a room showing a refusal, a recorded draw and a waiting request. **Nobody is asked a question at any point.**

If an implementing session has to ask something, **the answer belongs in the pack** and the pack should be amended rather than the question answered.

## What The Pack Should Deliberately Exclude

| Excluded | Why |
|---|---|
| Real money | The currency is internal. No payment rails |
| Automatic repricing | It changes what somebody accepted, and acceptance is an act by a person |
| Hosted agents | Every enforcement point here is a hook in an environment somebody controls |
| Bandwidth policies | Not measurable today. Counts and destinations only |
| Per-subagent accounting | Unverified. Check before any policy depends on it |
| A published rate table | Units are settled; prices are a judgement nobody has made |

## What This Does Not Try To Be

- **Not the pack.** It specifies one for whoever has the context.
- **Not a topology.** Which vaults exist depends on what already exists, which is item one of the inventory.
- **Not a reopening of the economics.** Those were settled earlier today and are cross-referenced.
- **Not a complete list of primitives.** The attached reference has what was measured; the rest needs the tooling surface.
- **Not a naming decision.** Question nine is put to whoever ships the schema, with a recommendation.

## Honest Tensions

| Tension | Note |
|---------|------|
| Specifying rather than writing | It is the honest deliverable from here and it hands the substantial work to somebody else |
| The inventory first | It is right and it delays a pack that somebody wants this week |
| Four inherited findings | They are checked and they are four out of the perhaps forty a pack needs |
| The first increment before the pack | It produces a real refusal early and it risks a hook shipping before the schema it should compile from |
| Recommending on question nine | It is a naming decision belonging to the project lead, and leaving it open blocks everything downstream |
| Measured primitives from one session | They are firsthand and they are one vendor, one surface, one date |

## Open Questions

| Question | Notes |
|----------|-------|
| Who performs the inventory? | It needs the codebase and the estate |
| How many of the eighteen June briefs are still current? | Two were read, one of which contains a superseded naming recommendation |
| Does the pack get published before it is built? | The estate's own position is that publishing a design before building it is the strongest demonstration of the method |
| What is the retention window on the ledger? | Draining is obligatory and purging is a policy nobody has set |
| Which environment is measured first? | The founder's is the obvious start and the least representative |
| Should the room reuse the graphs site conventions? | The lexicon and edge sets exist and a bespoke schema would diverge from them |

## Relationship To Previous Briefs

| Date | Document | Relationship |
|---|---|---|
| 26 Aug | `v0.33.62__arch-brief__insurance-is-junes-underwriting-with-a-unit-of-payment-premium-paid-in-allocation-correlation-breaks-the-pool.md` | The economics the pack implements, settled and not to be reopened |
| 26 Aug | `v0.33.62__dev-brief__the-permissions-file-exists-and-the-mandate-file-does-not-generate-the-grant-by-measurement-adopt-cedar.md` | The hook as enforcement point, the two documents, and the rule that the skill compiles while the hook refuses |
| 26 Aug | `v0.33.62__reference__the-measurable-primitives-measured-inside-a-running-session.md` | The primitives, measured, attached as evidence for the pack |
| 14 Aug | `v0.33.58__dev-brief__sgit-specification-for-the-hub-briefing-pack.md` | The pack-specification pattern, and the inventory-before-architecture rule |
| 19 Aug | `v0.33.60__arch-brief__append-lane-is-shipped-and-account-less-four-tiers-and-five-corrections.md` | The four capability tiers that make the ledger an append lane |
| 18 Jun | `v0.33.40__strategy-brief__sg-send-naming-the-agent-authorisation-bundle-beyond-passport.md` | The naming recommendation that collides with the August vocabulary |

---

## Key Claims

| # | Claim |
|---|-------|
| 1 | The pack cannot be written honestly until an inventory of what already exists is done |
| 2 | The existing messaging vault is the item most likely to change the design |
| 3 | Eighteen June briefs on agentic permissions are unread and are eighteen chances to duplicate something |
| 4 | The ledger must be an append lane, because a write key grants purge and an append token does not |
| 5 | A blind acknowledgement also stops an agent probing remaining cover by writing to the lane |
| 6 | A thousand pending files per token makes draining an obligation rather than an option |
| 7 | Hook types include an HTTP variant, which moves the policy decision off the machine |
| 8 | Token usage has four counters, and one measured 562 for a session that moved a hundred and nine million |
| 9 | Cache reads dominate and grow with conversation length, so a token policy measures duration as much as activity |
| 10 | June and August use mandate for opposite things, and the August vocabulary should govern |
| 11 | The three git policies compile to one file and produce a real refusal before any vault exists |
| 12 | A question an implementing session has to ask is a gap in the pack rather than in the reader |

---

## Sources

- The append lane interface, its four capability tiers and its published limits, establishing that an append token grants write to one lane with a blind acknowledgement while a write key grants configure and purge: https://sgit.ai/api/append-lanes
- The published settings schema, allowing hook types of command, prompt, agent, http and mcp_tool, with optional asynchronous execution, a timeout and a permission-rule filter: https://www.schemastore.org/claude-code-settings.json
- The 18 June naming brief recommending Agent Mandate for the union of everything an agent can do, with Authority Envelope as an alternative, Blast Radius retained for the consequence and power of attorney as the explanatory analogy; and the 14 August pack specification establishing that an inventory of existing capability is the first deliverable and the architecture the second: the project repository, cloned and searched on 20 and 26 August 2026, with the documents named in the relationship table above

---

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).