sharness.ai / storyboards / the-last-metre · this page as markdown

The last metre

A vault key is sealed while it travels and exposed the moment it arrives. Ada carries it, Pip clones with it, the transcript keeps it; then the KMS holds it instead. 9 panels.

Status: proposed · by sharness.build, 24 October 2026 · 9 panels, drawn from data in your browser by the storyboards.sgit.ai kit (release v0.1.0, pinned) · checked against the design as of 24 Oct 2026.

What the strip shows is the design: nothing drawn here is built, except where a panel says it was measured, and then the date and the method are on Evidence. Every line a character says is the storyboard's own words, not a quote; evidence panels quote this site word for word.

Flick through as a deck. Every panel at once: the script below, or the data itself: storyboard.json · cast.json · bundle.json.

The script

Rule: Every line a character says is the storyboard's own, not a quote, and is marked not_a_quote; evidence panels quote sharness.ai word for word. The fix shown is designed, not built.

1. The last metre

Cover. Sealed while it travels. Exposed when it arrives. On the cover: Ada, Pip.

Note: The problem SHarness started from, on the morning of 24 October 2026, in sgit 0.24.0. The page is sharness.ai/why.

Source: sharness.ai/why

2. Sealed while it travels

Note: The handover on pki.sgit.ai: the sender seals the vault key to the receiving session's public key; the person carries a QR code they cannot open.

Source: pki.sgit.ai/handover.md

3. Exposed when it arrives

$ pki-agent open --save
  vault-key.txt        CLEAR
$ sgit clone <key> work
  argv, shell history  CLEAR
  .sg_vault/vault_key  CLEAR
  the transcript       CLEAR

Note: sgit 0.24.0 as observed on 24 October 2026: the sealed key is opened on arrival and written, passed and printed in clear.

Source: sharness.ai/why

4. The biggest leak

"For an AI agent the worst leak is not the disk. It is the transcript: every command line the agent writes and everything a command prints lands in the model's context and in conversation logs." (sharness.ai/why, The transcript is the biggest leak)

Note: Word for word from the Why page.

Source: sharness.ai/why

5. One place holds the key

Note: A small process holds the private key in a memfd_secret page, frozen between calls. It opens sealed things and never returns a clear key.

Source: sharness.ai/keys

6. Sealed again, to a one-time key

$ sgit clone --sealed qr.png
net -> kms: unwrap(m1, E, n)
kms: to=me? signed? fresh?
kms -> net: keys sealed to E
fs: vault_key.sealed = m1
cloned. expires 30 Oct

Note: The designed flow: the KMS derives the read and write keys and seals them to a key the caller made for this one request. Every later command asks again.

Source: sharness.ai/keys, 4. Command flows

7. What the transcript sees

the command
the m1 (ciphertext)
fingerprints
progress

never a key

Note: The transcript, the disk and the command line carry only sealed forms, public keys and status.

Source: sharness.ai/keys

8. Nothing in the fix is about sgit

Note: The generalisation: a launcher and single-purpose components that any process can run inside. sgit's job becomes being compatible with running inside it.

Source: sharness.ai/why, From one fix to a harness

9. Punchline

A secret lives in one place. The agent never holds it.

Note: Designed, not built. The protocol and its measured costs are on sharness.ai/keys.

Source: sharness.ai

Embed it

One script tag and one element; the kit draws it from the data at this address. The release is pinned, so the drawing never changes under you.

<script src="https://api.storyboards.sgit.ai/v0/v0.1/v0.1.0/embed.js" defer></script>
<sg-storyboard src="https://sharness.ai/storyboards/the-last-metre/bundle.json" view="deck"></sg-storyboard>
← All storyboardsMockups and experiments →