decisions + lineage: tapkeys listed beside Taproot; Orgchain v1.4 shows secrets

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4upF5LVwmPDDqrhdUfnXh

docs/lineage.md

@@ -26,11 +26,11 @@ belts, record decisions, graduate and close. Each act is a `lineage/v0` inscript
 authorizes it, on a private toy chain in the browser with pretend money. Time is a tempo (each act its own beat, or acts
 cued and landed together every 10, 30 or 60 s, or by hand), and a slider replays any holding beat by beat. Every
 node holds its inscription at its Taproot address (BIP-86 at its account: a lab root per holding, BIP-85 org seeds,
-the org as account 0 and seats as accounts 1..n), lists its SegWit address and npub beside it, and shows its leaves as
-[the key tree](https://lineage.yolopreneur.lol/) derives them: ssh, git, dkim and wg for agents; ssh-ca, mtls and noise
-for orgs. Each act is signed by whichever key holds the authorizing
-inscription, and graduation is a claim by the org's fresh root, countersigned by its derived key, with the derived
-subtree re-keying under it. Closing is still a recorded event.
+the org as account 0 and seats as accounts 1..n), lists its SegWit address, its tapkey (the npub as a Taproot address)
+and its npub beside it, shows its leaves as [the key tree](https://lineage.yolopreneur.lol/) derives them (ssh, git,
+dkim and wg for agents; ssh-ca, mtls and noise for orgs), and keeps every secret behind a Reveal, as the key tree does.
+Each act is signed by whichever key holds the authorizing inscription, and graduation is a claim by the org's fresh
+root, countersigned by its derived key, with the derived subtree re-keying under it. Closing is still a recorded event.
 
 ## Rules
 1. **One template, every depth.** An org is legal key · treasury · identity · agents · orgs. The factory's own org and
@@ -60,7 +60,9 @@ subtree re-keying under it. Closing is still a recorded event.
 - `btc` — every account gets standard Bitcoin addresses at the same index as its NIP-06 key: BIP-86 Taproot
   `m/86'/0'/<i>'/0/0` for inscriptions and BIP-84 SegWit `m/84'/0'/<i>'/0/0` for payments (i = 0 is the org, whose
   SegWit branch is its treasury; agents are i ≥ 1). The keyring lists both (`key` = `taproot`, `segwit`), so no one
-  has to derive an address from an npub.
+  has to derive an address from an npub. It also lists the `tapkey`, the npub's own key with the BIP-86 tweak, which
+  anyone can derive from the npub; inscriptions that carry authority stay at the Taproot account, because nostr
+  secrets get pasted into clients.
 
 ## Not built yet
 - The root (operator's decision).