queen: key_vault.t27 -- one key store, every consumer leases, review lanes first (Closes #10564)

[gHashTag]

Closes #10564

Why

The owner's demand of 2026-10-18: every API key lives in one place and is shared out among everyone who uses it, and the Mac reviewer stops running on five private z.ai keys outside the Queen's pool. Measured 2026-10-19 (names only): the Queen's 34 pool keys sit in 3 copies across 3 Railway services, contributor keys sit sealed in her Postgres, and the Mac holds ZAI_KEY_1, _2, _3, _5, _6 that she cannot see. At the same time 70 bees ran against 354 unreviewed dispatches at about 5 reviews an hour, so review is the bottleneck, and review gets the lanes first.

What

File	Change
specs/queen/key_vault.t27	New card on key_failover.t27 (error_kind) and reviewer_sizing.t27 (ZAI_REQUESTS_PER_KEY). may_serve: only the store serves. consumer_start: a consumer with private keys while a lease is configured is refused (two homes for one key). review_share / worker_share: reviews get their demand (holding + waiting, not the backlog), never below one key's 2 lanes; bees get the rest. holder_cap: the review share split over 3 holders, with idle lanes lent. lease_answer: GRANT / WAIT / REFUSE; a bee waits while every free lane belongs to a waiting review. retry_after_seconds, lease_step: a refused lane hands the request to the next, at most 3 lanes, and a wrong request is never retried.
.trinity/seals/queen_QueenKeyVault.json	Seal, saved and verified on the lab.
tools/bees/reviewer.py	BEE_QUEEN_LEASE_URL + BEE_QUEEN_LEASE_TOKEN (environment or ~/.claude/.env) send the z.ai agent through the Queen's lease route, so no key value leaves her. A ZAI_KEY_* kept beside a configured lease refuses to start (count only). Private keys without a lease still run, with a warning, until the route is live. The lease token is stripped from the agent env. The doctor shows warn/fail. One self-test row. +34/-6.
contrib/portable-claude-setup/	Deletes rotate-keys.sh, check-key-health.sh and rotate-opencode-keys.sh: a second private key pool rotated on one machine, with no state file, launchd job or cron entry on the bench. The README points at the card. -664 lines of shell, so the diff shrinks hand-written foreign code.

The lease route itself (an authenticated z.ai proxy on the Queen, decisions from the vendored wasm of this card) is a gHashTag/trios PR against queen. The sibling rule, no backlog admission while reviews wait, is not touched here.

Lab evidence (Railway lab, t27c 0.5.2, zig 0.16.0)

• t27c test-report specs/queen/key_vault.t27: 8/8 pass, 3 invariants proved, 0 vacuous; runtime asserts per test: 3, 8, 5, 10, 8, 20, 3, 11.
• gen, gen-c, gen-rust, gen-verilog, gen-js, gen-ts, gen-python: all exit 0.
• wasm32-wasi reactor, 11 exports, built twice: one sha256, 8eb18f8eb0d6ff7866c51b8771aeff69dae25db71254b557401332154e7bf20f (797 bytes).
• tri mutate spec: 57 mutants, 53 killed, 1 unviable (an overflow zig rejects), 3 survivors, all equivalent and stated in the spec: < to <= and > to >= in review_share, and > to >= in the saturating sum, where both branches give the same number at equality. The first run had 5 survivors: the dead guard share == 0 in holder_cap is removed, and holders <= 1 became holders == 0.
• t27c seal --save then --verify: all hashes MATCH. Spec sha256 caa5c091...4097, seal sha256 ccbf5adb...f1f6.
• reviewer.py self-test: 0 failures, including queen lease: both names or none, and the agent never sees its token.

Known defect found on the way (follow-up, not fixed here): gen-c emits a const initialised from an imported const before the import, so the C does not compile. REVIEW_FLOOR_LANES is a literal 2, pinned to ZAI_REQUESTS_PER_KEY by an invariant.

🤖 Generated with Claude Code

[github-actions]

PR Dashboard

Generated at: 2026-10-18 19:23:44 UTC

• claw: carry the TRI CLAW social-visual skill cards to master (#10574 merged into a dead branch) (Closes #10570) #10613 claw: carry the TRI CLAW social-visual skill cards to master (#10574 merged into a dead branch) (Closes #10570) | Created: 2026-10-18 | Updated: 2026-10-18 | 28 failing / 36 total
• t27o: integer ! is a bitwise ~, the oracle spec uses type_text, the harness drops no_std (Closes #10534) #10611 t27o: integer ! is a bitwise ~, the oracle spec uses type_text, the harness drops no_std (Closes #10534) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 34 total
• t27f: lay the reel's captions, cards and address over the beat video, LR_MODE=5 (Closes #10609) #10610 t27f: lay the reel's captions, cards and address over the beat video, LR_MODE=5 (Closes #10609) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 34 total
• t27f R4b.1: beat graph -- three scenes crossfaded at the beat clock's cuts, on whole frames (Closes #10603) #10605 t27f R4b.1: beat graph -- three scenes crossfaded at the beat clock's cuts, on whole frames (Closes #10603) | Created: 2026-10-18 | Updated: 2026-10-18 | 24 failing / 32 total
• analog: sar_comparator.t27 -- the SAR ADC dynamic comparator, multi-node Newton, square law against ngspice LEVEL=1 (Closes #10583) #10604 analog: sar_comparator.t27 -- the SAR ADC dynamic comparator, multi-node Newton, square law against ngspice LEVEL=1 (Closes #10583) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 34 total
• docs: t27o front-end census of the roadmap repos -- Zig first, then deeper Rust, Python, TypeScript, shell (Closes #10599) #10601 docs: t27o front-end census of the roadmap repos -- Zig first, then deeper Rust, Python, TypeScript, shell (Closes #10599) | Created: 2026-10-18 | Updated: 2026-10-18 | 23 failing / 29 total
• t27f: beat clock -- reel beats cut where the voice changes, crossfaded (Closes #10596) #10598 t27f: beat clock -- reel beats cut where the voice changes, crossfaded (Closes #10596) | Created: 2026-10-18 | Updated: 2026-10-18 | 24 failing / 32 total
• ledger: re-derive from master 90f62487604b, as its lab verdict APPLY says (Closes #10594) #10595 ledger: re-derive from master 90f62487604b, as its lab verdict APPLY says (Closes #10594) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 34 total
• t27o: five refusal classes from the roadmap dogfood convert (Closes #10526) #10593 t27o: five refusal classes from the roadmap dogfood convert (Closes #10526) | Created: 2026-10-18 | Updated: 2026-10-18 | 28 failing / 35 total
• t27f: scene renderers for the 12 archetypes and the still anomaly gate (R3) #10592 t27f: scene renderers for the 12 archetypes and the still anomaly gate (R3) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
• queen: key_credit.t27 -- a leased contributor key earns credit only for .t27 that landed (Closes #10589) #10591 queen: key_credit.t27 -- a leased contributor key earns credit only for .t27 that landed (Closes #10589) | Created: 2026-10-18 | Updated: 2026-10-18 | 31 failing / 38 total
• tri t27o-sweep: t27o over a whole tree, rows reused while the file and the two seals hold (Closes #10543) #10587 tri t27o-sweep: t27o over a whole tree, rows reused while the file and the two seals hold (Closes #10543) | Created: 2026-10-18 | Updated: 2026-10-18 | 25 failing / 33 total
• t27f: reel_beats.t27 -- every reel as open, main and close, no two the same sequence (Closes #10584) #10586 t27f: reel_beats.t27 -- every reel as open, main and close, no two the same sequence (Closes #10584) | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
• claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) #10585 claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576) | Created: 2026-10-18 | Updated: 2026-10-18 | 21 failing / 27 total
• t27f: reel_factory_plan.t27 -- print the factory's course-0 plan, and tri factory (Closes #10573) #10580 t27f: reel_factory_plan.t27 -- print the factory's course-0 plan, and tri factory (Closes #10573) | Created: 2026-10-18 | Updated: 2026-10-18 | 28 failing / 36 total
• fpga(ax7203): RLC and 5-node ladder through the linear cell -- one board top for both circuits, PASS on the board, negative controls FAIL on their own circuit (Closes #10565) #10578 fpga(ax7203): RLC and 5-node ladder through the linear cell -- one board top for both circuits, bitstreams built, board run pending (Closes #10565) | Created: 2026-10-18 | Updated: 2026-10-18 | 11 failing / 43 total
• claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) #10577 claw: token_shape.t27 -- every App-token job passes with a note when the token cannot be minted (#10576) | Created: 2026-10-18 | Updated: 2026-10-18 | 10 failing / 33 total
• claw: criteria.t27 + claw/criteria check -- commands settle the criteria they can (Closes #10549) #10572 claw: criteria.t27 + claw/criteria check -- commands settle the criteria they can (Closes #10549) | Created: 2026-10-18 | Updated: 2026-10-18 | 29 failing / 38 total
• queen: key_vault.t27 -- one key store, every consumer leases, review lanes first (Closes #10564) #10567 queen: key_vault.t27 -- one key store, every consumer leases, review lanes first (Closes #10564) | Created: 2026-10-18 | Updated: 2026-10-18 | 17 failing / 34 total
• spec(t27mcp): visual_output.t27 -- when answer_channel picks UI_RESOURCE #10563 spec(t27mcp): visual_output.t27 -- when answer_channel picks UI_RESOURCE | Created: 2026-10-18 | Updated: 2026-10-18 | 6 failing / 36 total
• spec(queen): review_first.t27 -- no backlog dispatch while finished work waits in review (Closes #10555) #10562 spec(queen): review_first.t27 -- no backlog dispatch while finished work waits in review (Closes #10555) | Created: 2026-10-18 | Updated: 2026-10-18 | 4 failing / 35 total
• ci: per-PR cancel groups on 9 uncancelled workflows, one provable paths filter (Closes #10552) #10557 ci: per-PR cancel groups on 9 uncancelled workflows, one provable paths filter (Closes #10552) | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 55 total
• t27f: frontend.t27 -- T27F is t27's frontend, every visual surface in one law, served by TRI CLAW (Closes #10537) #10551 t27f: frontend.t27 -- T27F is t27's frontend, every visual surface in one law, served by TRI CLAW (Closes #10537) | Created: 2026-10-18 | Updated: 2026-10-18 | 26 failing / 35 total
• claw: reel_still.t27 -- the TRI CLAW /mcp tool that renders one particle still #10548 claw: reel_still.t27 -- the TRI CLAW /mcp tool that renders one particle still | Created: 2026-10-18 | Updated: 2026-10-18 | 27 failing / 35 total
• claw: visual_output.t27 -- a T27F visual in every output that did work (Closes #10508) #10510 claw: visual_output.t27 -- a T27F visual in every output that did work (Closes #10508) | Created: 2026-10-18 | Updated: 2026-10-18 | 22 failing / 35 total
• fix(t27c): seal --verify reads the committed gen file; compile refuses a hand-written output (draft, needs owner-approved-foreign) #10481 fix(t27c): seal --verify reads the committed gen file; compile refuses a hand-written output (draft, needs owner-approved-foreign) | Created: 2026-10-18 | Updated: 2026-10-18 | 2 failing / 46 total
• fpga(ax7203): ternary mat-vec over real tern-tc-9m weights in DDR3, UART receipt (Closes #10461) #10475 fpga(ax7203): ternary mat-vec over real tern-tc-9m weights in DDR3, UART receipt (Closes #10461) | Created: 2026-10-18 | Updated: 2026-10-18 | 9 failing / 49 total
• spec(ml): eval_hslm and ngram_hslm -- HSLM held-out loss at step 8000 against unigram, bigram and trigram baselines (Refs #10372) #10467 spec(ml): eval_hslm -- held-out loss of an HSLM checkpoint, last position and full sequence (Refs #10372) | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 36 total
• fix(seal): refuse a seal file another spec owns, re-check the hash after the write, land it by rename #10464 fix(seal): refuse a seal file another spec owns, re-check the hash after the write, land it by rename | Created: 2026-10-18 | Updated: 2026-10-18 | 7 failing / 48 total
• igla ptx v2: cp.async ring, 128x128xBK64 tile, prmt-decoded W; within 1.33x of CUTLASS s8 (Refs #10404) #10456 igla ptx v2: cp.async ring, 128x128xBK64 tile, prmt-decoded W; within 1.33x of CUTLASS s8 (Refs #10404) | Created: 2026-10-18 | Updated: 2026-10-18 | 6 failing / 46 total
• check: refuse a module that declares a top-level name twice (Closes #10421) #10442 check: refuse a module that declares a top-level name twice (Closes #10421) | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 44 total
• t27c PTX backend: ternary x int8 GEMM kernel emitted by a .t27 spec (int8 mma.sync), ptx-run glue #10425 t27c PTX backend: ternary x int8 GEMM kernel emitted by a .t27 spec (int8 mma.sync), ptx-run glue | Created: 2026-10-18 | Updated: 2026-10-18 | 5 failing / 39 total
• spec(ml): train_hslm -- main() trains the whole 3-block HSLM with STE and LAMB, writes MSLH checkpoints (Refs #10372) #10387 spec(ml): train_hslm -- main() trains the whole 3-block HSLM with STE and LAMB, writes MSLH checkpoints (Refs #10372) | Created: 2026-10-18 | Updated: 2026-10-18 | 2 failing / 36 total
• demo: claw/sarif alert on a spec that does not parse (DO NOT MERGE, Refs #10356) #10381 demo: claw/sarif alert on a spec that does not parse (DO NOT MERGE, Refs #10356) | Created: 2026-10-18 | Updated: 2026-10-18 | 6 failing / 33 total
• spec(hslm): nn/hslm_tokenizer and ml/hslm_corpus -- the 729-token BPE and a pinned TinyStories token file (Refs #10372) #10380 spec(hslm): nn/hslm_tokenizer and ml/hslm_corpus -- the 729-token BPE and a pinned TinyStories token file (Refs #10372) | Created: 2026-10-18 | Updated: 2026-10-18 | 4 failing / 32 total
• spec(port): land the remaining CR-CHAT ring batch -- 18 targets (Closes #10579; Refs #8883, #8884) #10175 spec(port): land the remaining CR-CHAT ring batch -- 18 targets (Closes #10579; Refs #8883, #8884) | Created: 2026-10-18 | Updated: 2026-10-18 | 4 failing / 38 total
• spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/smoke_agent.t27 (Closes #9714) #10022 spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/smoke_agent.t27 (Closes #9714) | Created: 2026-10-17 | Updated: 2026-10-18 | 2 failing / 35 total
• spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/debug_queue.t27 (Closes #9704) #10015 spec(port): port specs/port/trios-railway/crates/trios-igla-race/src/bin/debug_queue.t27 (Closes #9704) | Created: 2026-10-17 | Updated: 2026-10-18 | 2 failing / 35 total
• t27b: repair crypto and rust_convert; distinguish PR ledger lag #9637 t27b: repair crypto and rust_convert; distinguish PR ledger lag | Created: 2026-10-15 | Updated: 2026-10-15 | 3 failing / 33 total
• spec(port): share tree helpers across eight gen_w ports (Closes #9633) #9636 spec(port): share tree helpers across eight gen_w ports (Closes #9633) | Created: 2026-10-15 | Updated: 2026-10-17 | 3 failing / 33 total
• Port fpga/verilog/gft_xorpercep_jtag.v (Verilog, 1 module) to specs/port/fpga/verilog/gft_xorpercep_jtag.t27 #9549 Port fpga/verilog/gft_xorpercep_jtag.v (Verilog, 1 module) to specs/port/fpga/verilog/gft_xorpercep_jtag.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
• Port gHashTag/trios:crates/trios-git/src/stage.rs (Rust, 2 functions) to specs/port/trios/crates/trios-git/src/stage.t27 #9548 Port gHashTag/trios:crates/trios-git/src/stage.rs (Rust, 2 functions) to specs/port/trios/crates/trios-git/src/stage.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
• Port gHashTag/trios:crates/trios-rainbow-bridge/src/bridge.rs (Rust, 5 functions) to specs/port/trios/crates/trios-rainb #9485 Port gHashTag/trios:crates/trios-rainbow-bridge/src/bridge.rs (Rust, 5 functions) to specs/port/trios/crates/trios-rainb | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
• Port scripts/gen_w734.py (Python, 3 functions) to specs/port/scripts/gen_w734.t27 #9484 Port scripts/gen_w734.py (Python, 3 functions) to specs/port/scripts/gen_w734.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 4 failing / 29 total
• Port scripts/gen_w726.py (Python, 3 functions) to specs/port/scripts/gen_w726.t27 #9463 Port scripts/gen_w726.py (Python, 3 functions) to specs/port/scripts/gen_w726.t27 | Created: 2026-10-14 | Updated: 2026-10-14 | 3 failing / 29 total
• Port gHashTag/trinity:src/tri/sacred_alu.zig (Zig, 4 functions) to specs/port/trinity/src/tri/sacred_alu.t27 #9427 Port gHashTag/trinity:src/tri/sacred_alu.zig (Zig, 4 functions) to specs/port/trinity/src/tri/sacred_alu.t27 | Created: 2026-10-13 | Updated: 2026-10-13 | 5 failing / 29 total
• Port gHashTag/trios:crates/trios-phd/src/bin/rag_search.rs (Rust, 3 functions) to specs/port/trios/crates/trios-phd/src/ #9426 Port gHashTag/trios:crates/trios-phd/src/bin/rag_search.rs (Rust, 3 functions) to specs/port/trios/crates/trios-phd/src/ | Created: 2026-10-13 | Updated: 2026-10-13 | 4 failing / 29 total
• Port gHashTag/trinity:src/vibeec/spec_loader.zig (Zig, 2 functions) to specs/port/trinity/src/vibeec/spec_loader.t27 #9407 Port gHashTag/trinity:src/vibeec/spec_loader.zig (Zig, 2 functions) to specs/port/trinity/src/vibeec/spec_loader.t27 | Created: 2026-10-13 | Updated: 2026-10-13 | 4 failing / 29 total
• Port gHashTag/trinity:src/background_agent/config.zig (Zig, 5 functions) to specs/port/trinity/src/background_agent/conf #9345 Port gHashTag/trinity:src/background_agent/config.zig (Zig, 5 functions) to specs/port/trinity/src/background_agent/conf | Created: 2026-10-13 | Updated: 2026-10-13 | 5 failing / 29 total
• chore(deps)(deps): Bump tower-http from 0.6.8 to 0.7.1 #9340 chore(deps)(deps): Bump tower-http from 0.6.8 to 0.7.1 | Created: 2026-10-13 | Updated: 2026-10-18 | 12 failing / 43 total

Summary

Status	Count
Total Open PRs	50
PRs with Failing Checks	44
PRs with All Checks Green	6
READY	0
FAILING	44
PENDING	0
NO CHECKS YET	0

These columns do not partition: 0 + 44 + 0 + 0 = 44, and there are 50 open PRs. A PR is being counted twice or not at all.

Seal Status

• ⚠️ STALE -- sha256(compiler.rs)=fad12492937a != manifest seal=87e5cbd3ad94.
  The committed NMSE numbers were certified against an older compiler.rs.
  Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).