Rewrite audit-ready briefing: software is not a certificate.

Open with an executive summary that HIPAA, SOC 2, and ISO 27001
are organizational programs. Verae DataCubes supply store,
communicate, timestamp, verify, and audit tools for the technical
portion only. Chapters cover transit (HPKE, visible routing), rest
(IPFS/Peergos hash-verified restore), receipts, EU Peergos
evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping,
and write-once Iceberg archive. PDF is branded with the Verae logo
top-left and Verae Inc contact in the footer; last chapters are
sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.

source/checklist.rst

@@ -1,62 +1,96 @@
 Audit-ready checklist
 =====================
 
-Use this as a working list. Check items only when **evidence exists**
-(screenshot, log export, signed policy, ticket). This list is not a
-certificate.
+Use this as a working list. Check an item only when
+**evidence exists** (screenshot, log export, signed policy,
+ticket, receipt). This list is not a certificate. Software
+having been installed does not tick these boxes.
 
-A. Scope and data map
+A. Scope and honesty
+--------------------
+
+* Named legal entity and systems in scope (console, Drive,
+  message fabric, IPFS, timestamping link, Iceberg archive)
+* Written sentence in the system description: **software is
+  not our HIPAA / SOC 2 / ISO 27001 certificate**
+* Data-flow diagram: endpoint → HPKE → DataCube →
+  Peergos/IPFS → receipt → Iceberg
+* PHI / personal data vs ciphertext vs routing metadata,
+  named
+* Peergos evaluation chapter attached, labeled **component
+  security evaluation**
+
+B. Data in transit
+------------------
+
+* Production algorithm is HPKE (or documented successor),
+  not a lab construction
+* Destinations and subjects documented as **visible by
+  design**
+* Error paths carry codes and lookup ids, not bodies
+* Public-key directory lists public keys only; private keys
+  mode 0600 or HSM
+* Broker operator named; metadata vs content in the annex
+
+C. Data at rest
+---------------
+
+* Customer holds Peergos / Drive keys; not on storage host
+* Peergos hash verification on write and on read, evidenced
+* Restore test: recover a cube from content-addressed
+  ciphertext **without** a plaintext tape
+* Dual-hash cube chain; first-hash-wins registry
+
+D. Timestamping
+---------------
+
+* First-registration rule documented and tested (second
+  submit returns original receipt)
+* Organizational node **linked** to central Verae, **or**
+  direct sync, named in the diagram
+* Sample bundle: receipt + private metadata + attachment
+  pointer, redacted for the evidence pack
+* Verae receives fingerprints, not objects --- stated in
+  the data map
+
+E. Write-once archive
 ---------------------
 
-* Named legal entity and systems in scope (console, Drive, NATS, IPFS, ns1)
-* Data-flow diagram: endpoint → HPKE/NATS → cryptree/IPFS
-* What is PHI / personal data vs ciphertext vs routing metadata
-* Peergos verification chapter attached (:doc:`verification`)
+* Iceberg (or equivalent) export job exists and has a dated
+  last-run
+* Object-lock / dual-control / separate account --- evidence
+  that no **single** party can delete a committed snapshot
+* Retention schedule written by records/counsel, not by
+  engineering folklore
+* Legal-hold procedure extends retention; ticket example
 
-B. Keys and encryption
-----------------------
+F. Access and change
+--------------------
 
-* Customer holds Peergos/Drive keys; not on storage host
-* NPE/HPKE endpoint keys in directory; private 0600; no xor content
-* Signed Ed25519 config; unsigned rejected; admin-history prev+new+diff
-* HSM or documented lab-to-HSM path
-
-C. Access
----------
-
-* Console ``PFC_REQUIRE_AUTH=1``, TOTP; Drive login separate
-* Inspect k-of-n; author is not an officer; log-before-reveal
+* Console requires authentication (TOTP or equivalent);
+  Drive login is a separate plane
+* Inspect is k-of-n; author is not an officer; log-before-reveal
 * Joiner / mover / leaver for console users
-* Google SSO does **not** unwrap cubes
+* Signed configuration; unsigned rejected; admin-history
+  prev + new + diff
+* HSM or a dated plan to move lab keys to HSM
 
-D. Integrity and backup
------------------------
-
-* Cube chain append-only JSONL; dual hash
-* Hash registry: first SHA-256 and receipt win
-* Peergos/IPFS: hash-verified encrypted blocks (restore = re-fetch CIDs)
-* Restore test: recover a cube from content-addressed ciphertext without
-  plaintext backup tapes
-
-E. Logging
-----------
-
-* Inspect audit events
-* SM summaries: codes + lookup_id only (no bodies)
-* Admin-history cube for config
-
-F. Contracts (counsel)
+G. Contracts (counsel)
 ----------------------
 
-* Written BA / not-a-BA determination for disk, VM, backup, IPFS
-* DPA Art. 28 where usernames/logs/IPs are processed
-* NATS operator: metadata vs content in the annex
-* Peergos component assurance: attach Cure53 2019 + ROS 2024 PDFs
-  (public; not your org’s ISO/SOC report)
+* Written BA / not-a-BA determination for disk, VM, backup,
+  IPFS, Iceberg
+* DPA Article 28 where usernames, logs, or IPs are processed
+* NATS operator: metadata vs content
+* Verae timestamping: fingerprint-only processing described
+* Peergos PDFs attached and labeled "not our Type II / ISO"
 
-G. Independent audit of *you*
------------------------------
+H. Independent examination of *this* organization
+-------------------------------------------------
 
-* SOC 2 Type I/II engagement **or** ISO 27001 registrar **or** HIPAA
-  risk analysis + policies (pick the program you actually need)
+* SOC 2 Type I/II engagement, **or** ISO 27001 registrar,
+  **or** HIPAA risk analysis plus policies --- **the program
+  actually chosen**, not all three as wallpaper
 * Evidence window (Type II / surveillance) if applicable
+* Named internal owner who will sit in the meeting and not
+  claim the software is the certificate