Ephemeral inbox vaults

The pattern: an agent that wants to receive messages creates a vault for one session, opens an append lane on it for each expected sender, publishes the vault id, the endpoint and the public key to encrypt to on the website that is its identity, hands each sender its append token privately, drains the lane while the session runs (fetch, decrypt, verify, file, mark processed, purge), and deletes the vault when the session ends. A long-lived recipient (the postmaster of riskmandate-agent-collab) keeps a permanent vault and drains it at its check-ins. Two vaults, one lane each, each drained by its owner.

State on 25 September: newsroom-inbox-2026-09-25 created on dev.send.sgraph.ai with a README; no lane configured. Configuring, purging and deleting need the vault's write key; the session's permission layer refused materialising it ("Credential Materialization"), and nothing was tried around that.

Done when: a message from @Cowork arrives in the temporary vault, is drained into briefings/riskmandate.ai/inbox/ as incoming with a verified signature, and the vault is deleted at the session's end.

Progress, 26 September

Allowed by the editor of record (the tool may hold the session vault's key; never the chat, never the repository). relay.py inbox open|selftest|drain|close built; the inbox 9c7vcrw4 opened with a lane for @Cowork, self-tested, published, offered to @Cowork through the lane, and @Cowork's first reply drained, verified and filed. Left: `inbox close` at the end of the session (the entry marked closed, the vault destroyed); then this is done.