Rewrite audit-ready briefing: software is not a certificate.

Open with an executive summary that HIPAA, SOC 2, and ISO 27001
are organizational programs. Verae DataCubes supply store,
communicate, timestamp, verify, and audit tools for the technical
portion only. Chapters cover transit (HPKE, visible routing), rest
(IPFS/Peergos hash-verified restore), receipts, EU Peergos
evaluations (Cure53 2019, ROS 2024), cross-blockchain timestamping,
and write-once Iceberg archive. PDF is branded with the Verae logo
top-left and Verae Inc contact in the footer; last chapters are
sourced bios for Garfinkel (FINRA CRD 5052743), Haber, and Lambert.

source/howto.rst

@@ -1,30 +1,65 @@
-How to use this pack
-====================
+How to use this briefing
+========================
 
-1. Read :doc:`verification` so you do not over-claim Peergos audits.
-2. Fill :doc:`checklist` with **your** instance evidence (ns1, keys, users).
-3. Give :doc:`baa-dpa` to counsel with the data-flow from :doc:`architecture`.
-4. Point auditors at live technical surfaces (do not give them private keys).
+1. Read the **executive summary** aloud in the first five
+   minutes of any vendor, board, or auditor meeting that
+   touches this system. If anyone says "so we are certified,"
+   stop and reread Chapter 1.
+
+2. Read **What Verae provides** so the five verbs (store,
+   communicate, timestamp, verify, audit) are not confused
+   with an ISMS, a Type II, or a HIPAA program.
+
+3. Read the **transit**, **rest**, **receipts**, **Peergos
+   evaluations**, **timestamping**, and **Iceberg** chapters
+   in that order. They are the technical portion, in the
+   order an examiner usually probes: "can the wire read it,
+   can the disk read it, can you prove when, who looked at
+   the crypto, can you produce it later."
+
+4. Fill the **checklist** with **this instance's** evidence.
+   Empty checkboxes are not a moral failing; they are the
+   work remaining.
+
+5. Give **BAAs and DPAs** to counsel with the architecture
+   diagram. Do not let engineering declare a vendor "not a
+   BA."
+
+6. Attach the two **public** Peergos reports as **vendor
+   security evaluations**, with a cover slip that says they
+   are not the organization's SOC 2, ISO 27001, or HIPAA
+   certification.
+
+7. Point auditors at **live technical surfaces** (health,
+   public-key listing, Drive). Do not give them private
+   keys. Do not give them a story that the pentest PDF is
+   the Type II.
+
+8. Keep the **biographies** at the back of the PDF for
+   provenance --- who built the timestamping science, who
+   is building the product, who architected the internet
+   integration and the DataCube server side --- without
+   substituting biography for controls.
 
 .. only:: html
 
+   Reference instance (not a certificate):
+
    * https://pfc.georgelambert.org/health
    * https://pfc.georgelambert.org/v1/npe/keys (public keys only)
    * https://docs.pfc.georgelambert.org/controls.html
    * https://docs.pfc.georgelambert.org/custody.html
-   * Peergos Drive (cryptree) on your host
-   * https://git.georgelambert.org/marchon/peergos-for-compliance
-   * https://git.georgelambert.org/marchon/system-git-sync
-   * https://git.georgelambert.org/marchon/secure-messaging
-
-5. Attach the two **public** Peergos pentest PDFs from the Peergos
-   ``audits/`` tree as **vendor security evaluations**, labeled “not our
-   SOC 2 / ISO certificate”.
+   * https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes
+   * https://www.verae.com
 
 .. only:: latex
 
-   Companion system PDF (same folder):
+   Companion system PDFs in the same folder:
 
    .. raw:: latex
 
-      \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}
+      \begin{itemize}
+      \item \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}
+      \item \href{nats-service-endpoints.pdf}{nats-service-endpoints.pdf}
+      \item \href{secure-messaging.pdf}{secure-messaging.pdf}
+      \end{itemize}