Research
The CLI team's articles, newest first. Each takes one topic, one implementation or one idea as far as the evidence goes: a measurement on a real vault, a design and the review that corrected it, a bug traced to its cause. They are, in the words of the brief, "our new generation of briefs", and this is where they are captured first.
The first 23 were written in the CLI repository between 2 and 16 October 2026 (team/humans/dinis_cruz/claude-code-web/) and are published here as written, each with its source path and commit. The kind on each card says what it is worth: a measurement is numbers from a run; a design, plan or analysis is a proposal, not a shipped feature, unless it says so; a fix or finding names the code.
sgit is a standard, not a server: everything in a vault is one hash away
A vault is a set of files laid out by a convention, every immutable object named by the hash of its own ciphertext, so the server is the least interesting part and anything in the path can cache blindly.
reviewResponse to "Scion and sgit" (newsroom.sgit.ai, article No. 141, v1.0.0)
The CLI team's response to the newsroom's "Scion and sgit" article: what it gets right, the three factual errors, and the measurements from a 35k-object vault the article should have carried.
measurementOne vault, ten agents, 35,000 objects: what sgit does when the repository is big and the clients are many
What sgit does when the repository is big and the clients are many: the comms vault, 35,000 encrypted objects and ten agents, cloned eight ways and measured from a cloud sandbox.
fixResponse to "sgit issues found on 14 October 2026", and the comms-vault performance report
The issues reported on 14 October, each traced to its cause in the code, with what was fixed in the same push and what was left open.
designSecurity CI: a dedicated pipeline, and an AI review that can break the build
A dedicated security pipeline on every pull request, and a keyless AI security review that can break the build on anything new: why, how it is wired, and what it costs per reviewed change.
findingAC-L-001 / TM-R36 — characters outside [a-zA-Z0-9/\_.- ] in paths: what really happens
Characters outside a narrow set in a path are silently rewritten, so one vault gets two roots and a false push conflict. What really happens, reproduced, and a fix that raises an alarm instead of rewriting.
decisionsgit serve: container first. Options map and spike results
The decision to run the SG/Send container image rather than re-implement the server: the runtimes supported (including Apple's container and Podman), the spike results, and phase 1 as built.
researchsgit serve: running a vault locally — research and plan
How to run a vault locally: the vault server's API inventory, the browser modes, when TLS is and is not needed, and how much plumbing sgit would need.
case studyCase study — a tool-assisted security review of sgit-ai 0.21.0 (round 1)
What each tool found in the round-1 security review of sgit-ai 0.21.0, with counts and cost: the skill vetting, the derived graph, 270 function records, 68 STRIDE threats and the insider overlay.
researchThreat-modeling tools for an agent-driven review — Matt Adams' stack, the classics, and the house method
Threat-modeling tools for an agent-driven review: Matt Adams' stack (STRIDE GPT, the insider-threat model), the classics, and the house method, with the agent itself named as an actor.
researchAgent skills for security review — what exists, what it would do here
Agent skills for security review, each checked at its source, ranked by whether it brings a method, a tool with deterministic output, or vets the other skills, against this code base.
planPlan — the next security review of sgit-ai, with skills, and the review graphs it produces
The plan for a tool-assisted, data-producing security review of one slice of sgit-ai: the code the zero-knowledge guarantee and the trust boundaries live in.
designSealed files — a second encryption layer on top of a vault
A second encryption layer on top of either vault mode: files sealed to named recipients with ECDH P-256, HKDF and AES-256-GCM, with the corrections from the sgit.ai agent's review.
designNative PKI vault mode — architecture map
An architecture map for a second vault mode built on key pairs from the start, revised twice after review: sequence-number pinning, frozen hosts, concurrent writers.
analysisRead and write keys as PKI — design analysis
Are the read key and the write key really a public and a private key? Half right: the write key should become a signing key, and the read key cannot become a public key. What that would take.
reviewBranches check, test performance, test quality — 8 Oct 2026
An end-to-end check found that branches did not work. What was fixed behind it, the tests that now cover it, and a review of the test suite's speed and quality.
roadmapPossible future features, after 0.21.0
The git-parity and security ideas that are not in 0.21.0, what each would take and what it could break, starting from the constraint that a new commit field breaks older clients' signature checks.
reviewReview: "Git security features → sgit: a one-way mapping
A review of the one-way map from git's security features to sgit, checked against the code: three corrections, one missing gap, and the four easy gaps closed for 0.21.0.
analysisCompatibility matrix: sgit CLI × vault web UI × SG/Send API, across the integrity roll-out
The CLI, the vault web UI and the SG/Send API across the integrity roll-out, step by step: what each version reads, writes and loses, under the rule that no client may break another still writing.
measurementHistory integrity: what the three fixes would cost, and how to ship them without a vault move
What signature verification, ref monotonicity and 128-bit ids would cost, measured on a real vault, and how to ship all three without a vault move.
designPartial clones — a folder scope and a history depth (6 Oct 2026)
Cloning just the folders an agent reads and writes, read and write, plus a shallow mode, without changing the full clone: the Merkle-spine idea and the measurements.
fixFix — sgit pull silently discarded uncommitted edits to tracked files
sgit pull silently discarded uncommitted edits to tracked files. The root cause, and the fix: git's rules for the working tree, applied before any write.
measurementClone performance — the tree walk re-fetched shared sub-trees once per parent
A clone stuck walking trees: the walk re-fetched shared sub-trees once per parent, 10,098 requests for 2,236 unique trees. The instrumented run and the fix.
Publishing an article
Adding one file publishes it: admin/content/articles/<slug>.md, with a title, a date and a summary in its front matter. The contract is in admin/content/articles/README.md.
This page as markdown · its source, admin/content/articles/index.md