Sphinx HTML and 17-page LaTeX PDF for the audit-ready pack

source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.
2026-09-15 23:59:54 -04:00 · 2026-09-15 23:59:54 -04:00 · da60402e88
commit da60402e88
parent afa270a141
104 changed files with 16818 additions and 0 deletions
--- a/build/html/.buildinfo
+++ b/build/html/.buildinfo
@ -0,0 +1,4 @@
+# Sphinx build info version 1
+# This file records the configuration used when building these files. When it is not found, a full rebuild will be done.
+config: dcabbffa1333b74218cb7af3656cfe35
+tags: 645f666f9bcd5a90fca523b33c5a78b7
--- a/build/html/.doctrees/architecture.doctree
+++ b/build/html/.doctrees/architecture.doctree
--- a/build/html/.doctrees/baa-dpa.doctree
+++ b/build/html/.doctrees/baa-dpa.doctree
--- a/build/html/.doctrees/checklist.doctree
+++ b/build/html/.doctrees/checklist.doctree
--- a/build/html/.doctrees/environment.pickle
+++ b/build/html/.doctrees/environment.pickle
--- a/build/html/.doctrees/howto.doctree
+++ b/build/html/.doctrees/howto.doctree
--- a/build/html/.doctrees/index.doctree
+++ b/build/html/.doctrees/index.doctree
--- a/build/html/.doctrees/verification.doctree
+++ b/build/html/.doctrees/verification.doctree
--- a/build/html/_sources/architecture.rst.txt
+++ b/build/html/_sources/architecture.rst.txt
@ -0,0 +1,43 @@
+Architecture (audit interview)
+==============================
+
+::
+
+   Endpoint (keys stay here / HSM)
+       │  HPKE content (NPE suite)
+       │  routing: dest + subject in the clear
+       ▼
+   Untrusted NATS (cannot read bodies)
+       │
+       ▼
+   Verae DataCube chain (append-only hashes)
+       │  written through Peergos client
+       ▼
+   Peergos cryptree (encrypted names, sizes, graph)
+       │  chunks → CID / hash
+       ▼
+   IPFS  (distributed, hash-verified ciphertext)
+
+* **At rest:** Peergos cryptree + IPFS. Hosts with disk/backup see
+  **opaque hashed ciphertext**, not PHI, if they lack keys.
+* **In transit (NATS):** HPKE-Base to directory public keys. Broker is
+  honest-but-curious: destinations yes, bodies no.
+* **Integrity:** cube JSONL chain + dual hash + IPFS CID check on
+  restore (re-fetch blocks, re-verify hashes — not a plaintext tape).
+
+NATS remains an untrusted router. Production E2E is NPE/HPKE.
+Passthrough means destination in the clear; the body is ciphertext.
+
+.. only:: html
+
+   Live: https://pfc.georgelambert.org/v1/npe/keys (public keys only).
+   Controls: https://docs.pfc.georgelambert.org/controls.html
+
+.. only:: latex
+
+   See companion ``peergos-for-compliance.pdf`` (same folder) for
+   controls, custody, and variables chapters.
+
+   .. raw:: latex
+
+      \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}
--- a/build/html/_sources/baa-dpa.rst.txt
+++ b/build/html/_sources/baa-dpa.rst.txt
@ -0,0 +1,76 @@
+BAAs and DPAs when ciphertext has no host keys
+==============================================
+
+This is **guidance for an evidence pack**, not legal advice.
+
+The operator statement
+----------------------
+
+Data at rest lives in the **encrypted Peergos cryptree**. Restore uses
+**distributed, hash-verified, encrypted IPFS blocks**. Hosts and backup
+media see **opaque blobs** (and random CHAMP labels), not filenames, not
+PHI, not social graph — if keys never leave the client / customer HSM.
+
+That is **true of the Peergos design** (see :doc:`verification`).
+It **changes the BAA/DPA conversation**. It does **not** auto-delete the
+need for contracts.
+
+HIPAA (US) — Business Associate
+-------------------------------
+
+A Business Associate is a person who **creates, receives, maintains, or
+transmits ePHI** for a covered entity.
+
+**Technical argument you can make (and should document):**
+
+1. ePHI is encrypted **before** it leaves the endpoint (Peergos client /
+   DataCube writer).
+2. The storage node, IPFS, disk, and backup hold **ciphertext + hashes**.
+3. Private keys **do not** reside on the storage host (customer HSM /
+   client). Hash verification detects tampering.
+4. Therefore the host **cannot maintain ePHI in intelligible form**.
+
+HHS distinguishes **conduits** and parties that never have access to
+ePHI. Many programs still **sign a BAA** when a vendor touches
+infrastructure, because misconfiguration, support exports, or logs could
+later expose plaintext. OCR looks at **your** risk analysis.
+
+**Practical pack:** risk analysis memo citing cryptree + IPFS hash checks
+ key custody; BAA **or** written determination that the vendor is
+**not** a BA because they cannot decrypt; list every party with
+disk/backup (ns1, IPFS cluster, offsite replica).
+
+GDPR (EU/UK) — processor vs technical measure
+---------------------------------------------
+
+Encrypted data can still be **personal data** if it is reasonably
+attributable (usernames, IPs, invoice identity). GDPR **Art. 32** lists
+encryption as a security measure.
+
+Peergos is designed so the **server is an adversary** for content and
+most metadata. EU-based **independent pentests** (Cure53 DE, ROS NL)
+evaluated that design. Processing location for **self-host** is *your*
+ns1 / customer region, not peergos.net’s Germany hosting, unless you use
+peergos.net.
+
+You may still need a **DPA (Art. 28)** with anyone who **processes**
+personal data (usernames, logs, billing). Ciphertext-only storage
+**narrows** the DPA’s technical annex.
+
+NATS operators
+--------------
+
+NATS is an **untrusted broker**. Content is HPKE; destinations and
+subjects are in the clear. A NATS operator **cannot** read bodies without
+endpoint private keys; **can** see routing metadata; **can** drop/delay
+copy **ciphertext**. Treat like a transit provider: DPA/BAA depends on
+whether routing metadata is personal data in your jurisdiction.
+
+What “making yourself audit-ready” means
+----------------------------------------
+
+You are **not** buying Peergos’s Cure53/ROS reports as *your* SOC 2.
+You are **reusing** those public evaluations as **vendor/component
+assurance**, then adding your scope, RoPA, key-custody, inspect k-of-n,
+admin-history, instance evidence, and contracts that match who can
+actually see plaintext.
--- a/build/html/_sources/checklist.rst.txt
+++ b/build/html/_sources/checklist.rst.txt
@ -0,0 +1,62 @@
+Audit-ready checklist
+=====================
+
+Use this as a working list. Check items only when **evidence exists**
+(screenshot, log export, signed policy, ticket). This list is not a
+certificate.
+
+A. Scope and data map
+---------------------
+
+* Named legal entity and systems in scope (console, Drive, NATS, IPFS, ns1)
+* Data-flow diagram: endpoint → HPKE/NATS → cryptree/IPFS
+* What is PHI / personal data vs ciphertext vs routing metadata
+* Peergos verification chapter attached (:doc:`verification`)
+
+B. Keys and encryption
+----------------------
+
+* Customer holds Peergos/Drive keys; not on storage host
+* NPE/HPKE endpoint keys in directory; private 0600; no xor content
+* Signed Ed25519 config; unsigned rejected; admin-history prev+new+diff
+* HSM or documented lab-to-HSM path
+
+C. Access
+---------
+
+* Console ``PFC_REQUIRE_AUTH=1``, TOTP; Drive login separate
+* Inspect k-of-n; author is not an officer; log-before-reveal
+* Joiner / mover / leaver for console users
+* Google SSO does **not** unwrap cubes
+
+D. Integrity and backup
+-----------------------
+
+* Cube chain append-only JSONL; dual hash
+* Hash registry: first SHA-256 and receipt win
+* Peergos/IPFS: hash-verified encrypted blocks (restore = re-fetch CIDs)
+* Restore test: recover a cube from content-addressed ciphertext without
+  plaintext backup tapes
+
+E. Logging
+----------
+
+* Inspect audit events
+* SM summaries: codes + lookup_id only (no bodies)
+* Admin-history cube for config
+
+F. Contracts (counsel)
+----------------------
+
+* Written BA / not-a-BA determination for disk, VM, backup, IPFS
+* DPA Art. 28 where usernames/logs/IPs are processed
+* NATS operator: metadata vs content in the annex
+* Peergos component assurance: attach Cure53 2019 + ROS 2024 PDFs
+  (public; not your org’s ISO/SOC report)
+
+G. Independent audit of *you*
+-----------------------------
+
+* SOC 2 Type I/II engagement **or** ISO 27001 registrar **or** HIPAA
+  risk analysis + policies (pick the program you actually need)
+* Evidence window (Type II / surveillance) if applicable
--- a/build/html/_sources/howto.rst.txt
+++ b/build/html/_sources/howto.rst.txt
@ -0,0 +1,30 @@
+How to use this pack
+====================
+
+1. Read :doc:`verification` so you do not over-claim Peergos audits.
+2. Fill :doc:`checklist` with **your** instance evidence (ns1, keys, users).
+3. Give :doc:`baa-dpa` to counsel with the data-flow from :doc:`architecture`.
+4. Point auditors at live technical surfaces (do not give them private keys).
+
+.. only:: html
+
+   * https://pfc.georgelambert.org/health
+   * https://pfc.georgelambert.org/v1/npe/keys (public keys only)
+   * https://docs.pfc.georgelambert.org/controls.html
+   * https://docs.pfc.georgelambert.org/custody.html
+   * Peergos Drive (cryptree) on your host
+   * https://git.georgelambert.org/marchon/peergos-for-compliance
+   * https://git.georgelambert.org/marchon/system-git-sync
+   * https://git.georgelambert.org/marchon/secure-messaging
+
+5. Attach the two **public** Peergos pentest PDFs from the Peergos
+   ``audits/`` tree as **vendor security evaluations**, labeled “not our
+   SOC 2 / ISO certificate”.
+
+.. only:: latex
+
+   Companion system PDF (same folder):
+
+   .. raw:: latex
+
+      \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}
--- a/build/html/_sources/index.rst.txt
+++ b/build/html/_sources/index.rst.txt
@ -0,0 +1,61 @@
+Making yourself audit-ready with Verae DataCubes
+================================================
+
+How to **prepare an organization** for HIPAA-aligned, SOC 2, or ISO 27001
+work using Verae DataCubes on **Peergos** (encrypted cryptree + hashed
+IPFS) and HPKE on an **untrusted NATS** broker.
+
+**This document is not a HIPAA, SOC 2, or ISO certificate.**
+Peergos’s public pentests are **not** your Type II or ISO registrar
+certificate. They are **component security evaluations** you can attach.
+
+.. toctree::
+   :maxdepth: 2
+
+   verification
+   architecture
+   baa-dpa
+   checklist
+   howto
+
+What we verified about Peergos (EU)
+-----------------------------------
+
+See the full sourced table in :doc:`verification`.
+
+* Encrypted client-side filesystem (cryptree); keys not on the storage
+  server — **yes** (Peergos book + Cure53 design review).
+* IPFS blocks content-addressed; Peergos verifies hashes — **yes**.
+* Independent **EU** security audits, reports published — **yes, two:**
+  Cure53 Berlin (2019); Radically Open Security Amsterdam (2024).
+* “Peergos is HIPAA/SOC 2/ISO certified” — **no.** Those audits are
+  pentest/code/design reviews, not management-system certificates.
+
+Peergos **was designed as a trust-minimized encrypted filesystem**,
+**evaluated in Europe** by two specialist firms, with **public reports**.
+That supports the **at-rest / backup** story. It does **not** finish
+*your* audit.
+
+.. only:: html
+
+   Live technical surfaces:
+
+   * https://pfc.georgelambert.org/health
+   * https://pfc.georgelambert.org/v1/npe/keys
+   * https://docs.pfc.georgelambert.org/controls.html
+   * https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes
+
+   Companion system docs (HTML): https://docs.pfc.georgelambert.org/
+
+.. only:: latex
+
+   Companion PDFs in the **same directory** as this file (relative PDF
+   links, not Markdown):
+
+   .. raw:: latex
+
+      \begin{itemize}
+      \item \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}
+      \item \href{nats-service-endpoints.pdf}{nats-service-endpoints.pdf}
+      \item \href{secure-messaging.pdf}{secure-messaging.pdf}
+      \end{itemize}
--- a/build/html/_sources/verification.rst.txt
+++ b/build/html/_sources/verification.rst.txt
@ -0,0 +1,84 @@
+Peergos verification (what was actually audited)
+================================================
+
+This chapter records **sourced** facts. It does **not** turn Peergos, Verae,
+or DataCubes into a HIPAA, SOC 2, or ISO 27001 certificate.
+
+Claim to check
+--------------
+
+Data at rest is stored in an encrypted append-only Peergos filesystem;
+backup/restore is managed via a distributed, hashed, encrypted Peergos
+IPFS system, designed and evaluated in the EU as an audited secure
+filesystem.
+
+Independent security audits (Europe)
+------------------------------------
+
+**2019 — Cure53 (Berlin, Germany).**
+Pentest, source-code audit, **crypto/design review** (May–June 2019).
+No fundamental architectural or cryptographic problems; issues fixed.
+Cure53: the platform **passed this evaluation**.
+
+**2024 — Radically Open Security B.V. (Amsterdam, Netherlands).**
+Crystal-box pentest + code audit of Peergos web-ui (Sep–Nov 2024).
+**0** extreme / high / elevated; **2** moderate, **6** low; Peergos
+states all fixed; no data exposure or integrity compromise (mostly UI
+crashes).
+
+Both firms are **EU-based**. Both full reports are **public**. That is a
+**security evaluation of the Peergos protocol/implementation**, not a
+HIPAA/SOC 2/ISO management-system certificate.
+
+.. only:: html
+
+   Primary sources:
+
+   * https://peergos.org/posts/security-audit
+   * https://cure53.de/pentest-report_peergos.pdf
+   * https://peergos.org/posts/security-audit-2024
+   * https://github.com/Peergos/Peergos/tree/master/audits
+
+EU funding / NLnet
+------------------
+
+* Peergos received funding from the **European Union Horizon 2020**
+  programme under **NGI-POINTER**, grant **871528** (stated on the 2024
+  audit post).
+* The 2024 audit was supported by **NLnet** (Netherlands).
+
+Hosted instance location
+------------------------
+
+Peergos’s hosted privacy notice states peergos.net uses servers in
+**Germany**. **Self-hosted ns1 / customer cryptree is a different
+processing location** and must be documented in *your* RoPA / BAA pack.
+
+Encrypted filesystem + hashed IPFS (design)
+-------------------------------------------
+
+* **Cryptree**: tree of symmetric keys; fine-grained read/write caps;
+  sibling names hidden; writes **signed**.
+* **Chunks**: up to 5 MiB, padded, independently encrypted
+  (Salsa20-Poly1305); random 256-bit keys (not convergent).
+* **IPFS**: content-addressed blocks. Peergos **verifies the hash** of
+  every block read from or written to IPFS. Clients verify hashes and
+  signatures from a Peergos server.
+* **CHAMP**: encrypted cryptree nodes under **random 32-byte labels**.
+* Sharing: hybrid **X25519 + ML-KEM-1024**.
+
+“Append-only” in Verae DataCubes is the **cube chain JSONL** (application
+integrity). Peergos uses signed updates and immutable blocks. Do not
+conflate the two layers in an audit interview.
+
+Not verified / do not claim
+---------------------------
+
+* “Peergos is HIPAA certified” — **false.** HIPAA is not a product certificate.
+* “Peergos is SOC 2 / ISO 27001 certified” — **not shown.** Published
+  work is pentest/code audit, not Type II or ISO registrar.
+* “EU certified Peergos as a government-standard filesystem” —
+  **overstated.** What exists: EU grant funding, NLNet-funded ROS
+  pentest, Cure53 Berlin design+code audit.
+* “Hosts with disk/backup never need a BAA/DPA” — **legal conclusion,
+  not a technical fact.** See :doc:`baa-dpa`.
--- a/build/html/_static/alabaster.css
+++ b/build/html/_static/alabaster.css
@ -0,0 +1,663 @@
+/* -- page layout ----------------------------------------------------------- */
+
+body {
+    font-family: Georgia, serif;
+    font-size: 17px;
+    background-color: #fff;
+    color: #000;
+    margin: 0;
+    padding: 0;
+}
+
+
+div.document {
+    width: 940px;
+    margin: 30px auto 0 auto;
+}
+
+div.documentwrapper {
+    float: left;
+    width: 100%;
+}
+
+div.bodywrapper {
+    margin: 0 0 0 220px;
+}
+
+div.sphinxsidebar {
+    width: 220px;
+    font-size: 14px;
+    line-height: 1.5;
+}
+
+hr {
+    border: 1px solid #B1B4B6;
+}
+
+div.body {
+    background-color: #fff;
+    color: #3E4349;
+    padding: 0 30px 0 30px;
+}
+
+div.body > .section {
+    text-align: left;
+}
+
+div.footer {
+    width: 940px;
+    margin: 20px auto 30px auto;
+    font-size: 14px;
+    color: #888;
+    text-align: right;
+}
+
+div.footer a {
+    color: #888;
+}
+
+p.caption {
+    font-family: inherit;
+    font-size: inherit;
+}
+
+
+div.relations {
+    display: none;
+}
+
+
+div.sphinxsidebar {
+    max-height: 100%;
+    overflow-y: auto;
+}
+
+div.sphinxsidebar a {
+    color: #444;
+    text-decoration: none;
+    border-bottom: 1px dotted #999;
+}
+
+div.sphinxsidebar a:hover {
+    border-bottom: 1px solid #999;
+}
+
+div.sphinxsidebarwrapper {
+    padding: 18px 10px;
+}
+
+div.sphinxsidebarwrapper p.logo {
+    padding: 0;
+    margin: -10px 0 0 0px;
+    text-align: center;
+}
+
+div.sphinxsidebarwrapper h1.logo {
+    margin-top: -10px;
+    text-align: center;
+    margin-bottom: 5px;
+    text-align: left;
+}
+
+div.sphinxsidebarwrapper h1.logo-name {
+    margin-top: 0px;
+}
+
+div.sphinxsidebarwrapper p.blurb {
+    margin-top: 0;
+    font-style: normal;
+}
+
+div.sphinxsidebar h3,
+div.sphinxsidebar h4 {
+    font-family: Georgia, serif;
+    color: #444;
+    font-size: 24px;
+    font-weight: normal;
+    margin: 0 0 5px 0;
+    padding: 0;
+}
+
+div.sphinxsidebar h4 {
+    font-size: 20px;
+}
+
+div.sphinxsidebar h3 a {
+    color: #444;
+}
+
+div.sphinxsidebar p.logo a,
+div.sphinxsidebar h3 a,
+div.sphinxsidebar p.logo a:hover,
+div.sphinxsidebar h3 a:hover {
+    border: none;
+}
+
+div.sphinxsidebar p {
+    color: #555;
+    margin: 10px 0;
+}
+
+div.sphinxsidebar ul {
+    margin: 10px 0;
+    padding: 0;
+    color: #000;
+}
+
+div.sphinxsidebar ul li.toctree-l1 > a {
+    font-size: 120%;
+}
+
+div.sphinxsidebar ul li.toctree-l2 > a {
+    font-size: 110%;
+}
+
+div.sphinxsidebar input {
+    border: 1px solid #CCC;
+    font-family: Georgia, serif;
+    font-size: 1em;
+}
+
+div.sphinxsidebar #searchbox {
+    margin: 1em 0;
+}
+
+div.sphinxsidebar .search > div {
+    display: table-cell;
+}
+
+div.sphinxsidebar hr {
+    border: none;
+    height: 1px;
+    color: #AAA;
+    background: #AAA;
+
+    text-align: left;
+    margin-left: 0;
+    width: 50%;
+}
+
+div.sphinxsidebar .badge {
+    border-bottom: none;
+}
+
+div.sphinxsidebar .badge:hover {
+    border-bottom: none;
+}
+
+/* To address an issue with donation coming after search */
+div.sphinxsidebar h3.donation {
+    margin-top: 10px;
+}
+
+/* -- body styles ----------------------------------------------------------- */
+
+a {
+    color: #004B6B;
+    text-decoration: underline;
+}
+
+a:hover {
+    color: #6D4100;
+    text-decoration: underline;
+}
+
+div.body h1,
+div.body h2,
+div.body h3,
+div.body h4,
+div.body h5,
+div.body h6 {
+    font-family: Georgia, serif;
+    font-weight: normal;
+    margin: 30px 0px 10px 0px;
+    padding: 0;
+}
+
+div.body h1 { margin-top: 0; padding-top: 0; font-size: 240%; }
+div.body h2 { font-size: 180%; }
+div.body h3 { font-size: 150%; }
+div.body h4 { font-size: 130%; }
+div.body h5 { font-size: 100%; }
+div.body h6 { font-size: 100%; }
+
+a.headerlink {
+    color: #DDD;
+    padding: 0 4px;
+    text-decoration: none;
+}
+
+a.headerlink:hover {
+    color: #444;
+    background: #EAEAEA;
+}
+
+div.body p, div.body dd, div.body li {
+    line-height: 1.4em;
+}
+
+div.admonition {
+    margin: 20px 0px;
+    padding: 10px 30px;
+    background-color: #EEE;
+    border: 1px solid #CCC;
+}
+
+div.admonition tt.xref, div.admonition code.xref, div.admonition a tt {
+    background-color: #FBFBFB;
+    border-bottom: 1px solid #fafafa;
+}
+
+div.admonition p.admonition-title {
+    font-family: Georgia, serif;
+    font-weight: normal;
+    font-size: 24px;
+    margin: 0 0 10px 0;
+    padding: 0;
+    line-height: 1;
+}
+
+div.admonition p.last {
+    margin-bottom: 0;
+}
+
+dt:target, .highlight {
+    background: #FAF3E8;
+}
+
+div.warning {
+    background-color: #FCC;
+    border: 1px solid #FAA;
+}
+
+div.danger {
+    background-color: #FCC;
+    border: 1px solid #FAA;
+    -moz-box-shadow: 2px 2px 4px #D52C2C;
+    -webkit-box-shadow: 2px 2px 4px #D52C2C;
+    box-shadow: 2px 2px 4px #D52C2C;
+}
+
+div.error {
+    background-color: #FCC;
+    border: 1px solid #FAA;
+    -moz-box-shadow: 2px 2px 4px #D52C2C;
+    -webkit-box-shadow: 2px 2px 4px #D52C2C;
+    box-shadow: 2px 2px 4px #D52C2C;
+}
+
+div.caution {
+    background-color: #FCC;
+    border: 1px solid #FAA;
+}
+
+div.attention {
+    background-color: #FCC;
+    border: 1px solid #FAA;
+}
+
+div.important {
+    background-color: #EEE;
+    border: 1px solid #CCC;
+}
+
+div.note {
+    background-color: #EEE;
+    border: 1px solid #CCC;
+}
+
+div.tip {
+    background-color: #EEE;
+    border: 1px solid #CCC;
+}
+
+div.hint {
+    background-color: #EEE;
+    border: 1px solid #CCC;
+}
+
+div.seealso {
+    background-color: #EEE;
+    border: 1px solid #CCC;
+}
+
+div.topic {
+    background-color: #EEE;
+}
+
+p.admonition-title {
+    display: inline;
+}
+
+p.admonition-title:after {
+    content: ":";
+}
+
+pre, tt, code {
+    font-family: 'Consolas', 'Menlo', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace;
+    font-size: 0.9em;
+}
+
+.hll {
+    background-color: #FFC;
+    margin: 0 -12px;
+    padding: 0 12px;
+    display: block;
+}
+
+img.screenshot {
+}
+
+tt.descname, tt.descclassname, code.descname, code.descclassname {
+    font-size: 0.95em;
+}
+
+tt.descname, code.descname {
+    padding-right: 0.08em;
+}
+
+img.screenshot {
+    -moz-box-shadow: 2px 2px 4px #EEE;
+    -webkit-box-shadow: 2px 2px 4px #EEE;
+    box-shadow: 2px 2px 4px #EEE;
+}
+
+table.docutils {
+    border: 1px solid #888;
+    -moz-box-shadow: 2px 2px 4px #EEE;
+    -webkit-box-shadow: 2px 2px 4px #EEE;
+    box-shadow: 2px 2px 4px #EEE;
+}
+
+table.docutils td, table.docutils th {
+    border: 1px solid #888;
+    padding: 0.25em 0.7em;
+}
+
+table.field-list, table.footnote {
+    border: none;
+    -moz-box-shadow: none;
+    -webkit-box-shadow: none;
+    box-shadow: none;
+}
+
+table.footnote {
+    margin: 15px 0;
+    width: 100%;
+    border: 1px solid #EEE;
+    background: #FDFDFD;
+    font-size: 0.9em;
+}
+
+table.footnote + table.footnote {
+    margin-top: -15px;
+    border-top: none;
+}
+
+table.field-list th {
+    padding: 0 0.8em 0 0;
+}
+
+table.field-list td {
+    padding: 0;
+}
+
+table.field-list p {
+    margin-bottom: 0.8em;
+}
+
+/* Cloned from
+ * https://github.com/sphinx-doc/sphinx/commit/ef60dbfce09286b20b7385333d63a60321784e68
+ */
+.field-name {
+    -moz-hyphens: manual;
+    -ms-hyphens: manual;
+    -webkit-hyphens: manual;
+    hyphens: manual;
+}
+
+table.footnote td.label {
+    width: .1px;
+    padding: 0.3em 0 0.3em 0.5em;
+}
+
+table.footnote td {
+    padding: 0.3em 0.5em;
+}
+
+dl {
+    margin-left: 0;
+    margin-right: 0;
+    margin-top: 0;
+    padding: 0;
+}
+
+dl dd {
+    margin-left: 30px;
+}
+
+blockquote {
+    margin: 0 0 0 30px;
+    padding: 0;
+}
+
+ul, ol {
+    /* Matches the 30px from the narrow-screen "li > ul" selector below */
+    margin: 10px 0 10px 30px;
+    padding: 0;
+}
+
+pre {
+    background: unset;
+    padding: 7px 30px;
+    margin: 15px 0px;
+    line-height: 1.3em;
+}
+
+div.viewcode-block:target {
+    background: #ffd;
+}
+
+dl pre, blockquote pre, li pre {
+    margin-left: 0;
+    padding-left: 30px;
+}
+
+tt, code {
+    background-color: #ecf0f3;
+    color: #222;
+    /* padding: 1px 2px; */
+}
+
+tt.xref, code.xref, a tt {
+    background-color: #FBFBFB;
+    border-bottom: 1px solid #fff;
+}
+
+a.reference {
+    text-decoration: none;
+    border-bottom: 1px dotted #004B6B;
+}
+
+a.reference:hover {
+    border-bottom: 1px solid #6D4100;
+}
+
+/* Don't put an underline on images */
+a.image-reference, a.image-reference:hover {
+    border-bottom: none;
+}
+
+a.footnote-reference {
+    text-decoration: none;
+    font-size: 0.7em;
+    vertical-align: top;
+    border-bottom: 1px dotted #004B6B;
+}
+
+a.footnote-reference:hover {
+    border-bottom: 1px solid #6D4100;
+}
+
+a:hover tt, a:hover code {
+    background: #EEE;
+}
+
+@media screen and (max-width: 940px) {
+
+    body {
+        margin: 0;
+        padding: 20px 30px;
+    }
+
+    div.documentwrapper {
+        float: none;
+        background: #fff;
+        margin-left: 0;
+        margin-top: 0;
+        margin-right: 0;
+        margin-bottom: 0;
+    }
+
+    div.sphinxsidebar {
+        display: block;
+        float: none;
+        width: unset;
+        margin: 50px -30px -20px -30px;
+        padding: 10px 20px;
+        background: #333;
+        color: #FFF;
+    }
+
+    div.sphinxsidebar h3, div.sphinxsidebar h4, div.sphinxsidebar p,
+    div.sphinxsidebar h3 a {
+        color: #fff;
+    }
+
+    div.sphinxsidebar a {
+        color: #AAA;
+    }
+
+    div.sphinxsidebar p.logo {
+        display: none;
+    }
+
+    div.document {
+        width: 100%;
+        margin: 0;
+    }
+
+    div.footer {
+        display: none;
+    }
+
+    div.bodywrapper {
+        margin: 0;
+    }
+
+    div.body {
+        min-height: 0;
+        min-width: auto; /* fixes width on small screens, breaks .hll */
+        padding: 0;
+    }
+    
+    .hll {
+        /* "fixes" the breakage */
+        width: max-content;
+    }
+
+    .rtd_doc_footer {
+        display: none;
+    }
+
+    .document {
+        width: auto;
+    }
+
+    .footer {
+        width: auto;
+    }
+
+    .github {
+        display: none;
+    }
+
+    ul {
+        margin-left: 0;
+    }
+
+    li > ul {
+       /* Matches the 30px from the "ul, ol" selector above */
+        margin-left: 30px;
+    }
+}
+
+
+/* misc. */
+
+.revsys-inline {
+    display: none!important;
+}
+
+/* Hide ugly table cell borders in ..bibliography:: directive output */
+table.docutils.citation, table.docutils.citation td, table.docutils.citation th {
+  border: none;
+  /* Below needed in some edge cases; if not applied, bottom shadows appear */
+  -moz-box-shadow: none;
+  -webkit-box-shadow: none;
+  box-shadow: none;
+}
+
+
+/* relbar */
+
+.related {
+    line-height: 30px;
+    width: 100%;
+    font-size: 0.9rem;
+}
+
+.related.top {
+    border-bottom: 1px solid #EEE;
+    margin-bottom: 20px;
+}
+
+.related.bottom {
+    border-top: 1px solid #EEE;
+}
+
+.related ul {
+    padding: 0;
+    margin: 0;
+    list-style: none;
+}
+
+.related li {
+    display: inline;
+}
+
+nav#rellinks {
+    float: right;
+}
+
+nav#rellinks li+li:before {
+    content: "|";
+}
+
+nav#breadcrumbs li+li:before {
+    content: "\00BB";
+}
+
+/* Hide certain items when printing */
+@media print {
+    div.related {
+        display: none;
+    }
+}
+
+img.github  {
+    position: absolute;
+    top: 0;
+    border: 0;
+    right: 0;
+}
--- a/build/html/_static/base-stemmer.js
+++ b/build/html/_static/base-stemmer.js
@ -0,0 +1,476 @@
+// @ts-check
+
+/**@constructor*/
+BaseStemmer = function() {
+    /** @protected */
+    this.current = '';
+    this.cursor = 0;
+    this.limit = 0;
+    this.limit_backward = 0;
+    this.bra = 0;
+    this.ket = 0;
+
+    /**
+     * @param {string} value
+     */
+    this.setCurrent = function(value) {
+        this.current = value;
+        this.cursor = 0;
+        this.limit = this.current.length;
+        this.limit_backward = 0;
+        this.bra = this.cursor;
+        this.ket = this.limit;
+    };
+
+    /**
+     * @return {string}
+     */
+    this.getCurrent = function() {
+        return this.current;
+    };
+
+    /**
+     * @param {BaseStemmer} other
+     */
+    this.copy_from = function(other) {
+        /** @protected */
+        this.current          = other.current;
+        this.cursor           = other.cursor;
+        this.limit            = other.limit;
+        this.limit_backward   = other.limit_backward;
+        this.bra              = other.bra;
+        this.ket              = other.ket;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.in_grouping = function(s, min, max) {
+        /** @protected */
+        if (this.cursor >= this.limit) return false;
+        var ch = this.current.charCodeAt(this.cursor);
+        if (ch > max || ch < min) return false;
+        ch -= min;
+        if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) return false;
+        this.cursor++;
+        return true;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.go_in_grouping = function(s, min, max) {
+        /** @protected */
+        while (this.cursor < this.limit) {
+            var ch = this.current.charCodeAt(this.cursor);
+            if (ch > max || ch < min)
+                return true;
+            ch -= min;
+            if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0)
+                return true;
+            this.cursor++;
+        }
+        return false;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.in_grouping_b = function(s, min, max) {
+        /** @protected */
+        if (this.cursor <= this.limit_backward) return false;
+        var ch = this.current.charCodeAt(this.cursor - 1);
+        if (ch > max || ch < min) return false;
+        ch -= min;
+        if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) return false;
+        this.cursor--;
+        return true;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.go_in_grouping_b = function(s, min, max) {
+        /** @protected */
+        while (this.cursor > this.limit_backward) {
+            var ch = this.current.charCodeAt(this.cursor - 1);
+            if (ch > max || ch < min) return true;
+            ch -= min;
+            if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) return true;
+            this.cursor--;
+        }
+        return false;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.out_grouping = function(s, min, max) {
+        /** @protected */
+        if (this.cursor >= this.limit) return false;
+        var ch = this.current.charCodeAt(this.cursor);
+        if (ch > max || ch < min) {
+            this.cursor++;
+            return true;
+        }
+        ch -= min;
+        if ((s[ch >>> 3] & (0X1 << (ch & 0x7))) == 0) {
+            this.cursor++;
+            return true;
+        }
+        return false;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.go_out_grouping = function(s, min, max) {
+        /** @protected */
+        while (this.cursor < this.limit) {
+            var ch = this.current.charCodeAt(this.cursor);
+            if (ch <= max && ch >= min) {
+                ch -= min;
+                if ((s[ch >>> 3] & (0X1 << (ch & 0x7))) != 0) {
+                    return true;
+                }
+            }
+            this.cursor++;
+        }
+        return false;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.out_grouping_b = function(s, min, max) {
+        /** @protected */
+        if (this.cursor <= this.limit_backward) return false;
+        var ch = this.current.charCodeAt(this.cursor - 1);
+        if (ch > max || ch < min) {
+            this.cursor--;
+            return true;
+        }
+        ch -= min;
+        if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) == 0) {
+            this.cursor--;
+            return true;
+        }
+        return false;
+    };
+
+    /**
+     * @param {number[]} s
+     * @param {number} min
+     * @param {number} max
+     * @return {boolean}
+     */
+    this.go_out_grouping_b = function(s, min, max) {
+        /** @protected */
+        while (this.cursor > this.limit_backward) {
+            var ch = this.current.charCodeAt(this.cursor - 1);
+            if (ch <= max && ch >= min) {
+                ch -= min;
+                if ((s[ch >>> 3] & (0x1 << (ch & 0x7))) != 0) {
+                    return true;
+                }
+            }
+            this.cursor--;
+        }
+        return false;
+    };
+
+    /**
+     * @param {string} s
+     * @return {boolean}
+     */
+    this.eq_s = function(s)
+    {
+        /** @protected */
+        if (this.limit - this.cursor < s.length) return false;
+        if (this.current.slice(this.cursor, this.cursor + s.length) != s)
+        {
+            return false;
+        }
+        this.cursor += s.length;
+        return true;
+    };
+
+    /**
+     * @param {string} s
+     * @return {boolean}
+     */
+    this.eq_s_b = function(s)
+    {
+        /** @protected */
+        if (this.cursor - this.limit_backward < s.length) return false;
+        if (this.current.slice(this.cursor - s.length, this.cursor) != s)
+        {
+            return false;
+        }
+        this.cursor -= s.length;
+        return true;
+    };
+
+    /**
+     * @param {Among[]} v
+     * @return {number}
+     */
+    this.find_among = function(v)
+    {
+        /** @protected */
+        var i = 0;
+        var j = v.length;
+
+        var c = this.cursor;
+        var l = this.limit;
+
+        var common_i = 0;
+        var common_j = 0;
+
+        var first_key_inspected = false;
+
+        while (true)
+        {
+            var k = i + ((j - i) >>> 1);
+            var diff = 0;
+            var common = common_i < common_j ? common_i : common_j; // smaller
+            // w[0]: string, w[1]: substring_i, w[2]: result, w[3]: function (optional)
+            var w = v[k];
+            var i2;
+            for (i2 = common; i2 < w[0].length; i2++)
+            {
+                if (c + common == l)
+                {
+                    diff = -1;
+                    break;
+                }
+                diff = this.current.charCodeAt(c + common) - w[0].charCodeAt(i2);
+                if (diff != 0) break;
+                common++;
+            }
+            if (diff < 0)
+            {
+                j = k;
+                common_j = common;
+            }
+            else
+            {
+                i = k;
+                common_i = common;
+            }
+            if (j - i <= 1)
+            {
+                if (i > 0) break; // v->s has been inspected
+                if (j == i) break; // only one item in v
+
+                // - but now we need to go round once more to get
+                // v->s inspected. This looks messy, but is actually
+                // the optimal approach.
+
+                if (first_key_inspected) break;
+                first_key_inspected = true;
+            }
+        }
+        do {
+            var w = v[i];
+            if (common_i >= w[0].length)
+            {
+                this.cursor = c + w[0].length;
+                if (w.length < 4) return w[2];
+                var res = w[3](this);
+                this.cursor = c + w[0].length;
+                if (res) return w[2];
+            }
+            i = w[1];
+        } while (i >= 0);
+        return 0;
+    };
+
+    // find_among_b is for backwards processing. Same comments apply
+    /**
+     * @param {Among[]} v
+     * @return {number}
+     */
+    this.find_among_b = function(v)
+    {
+        /** @protected */
+        var i = 0;
+        var j = v.length
+
+        var c = this.cursor;
+        var lb = this.limit_backward;
+
+        var common_i = 0;
+        var common_j = 0;
+
+        var first_key_inspected = false;
+
+        while (true)
+        {
+            var k = i + ((j - i) >> 1);
+            var diff = 0;
+            var common = common_i < common_j ? common_i : common_j;
+            var w = v[k];
+            var i2;
+            for (i2 = w[0].length - 1 - common; i2 >= 0; i2--)
+            {
+                if (c - common == lb)
+                {
+                    diff = -1;
+                    break;
+                }
+                diff = this.current.charCodeAt(c - 1 - common) - w[0].charCodeAt(i2);
+                if (diff != 0) break;
+                common++;
+            }
+            if (diff < 0)
+            {
+                j = k;
+                common_j = common;
+            }
+            else
+            {
+                i = k;
+                common_i = common;
+            }
+            if (j - i <= 1)
+            {
+                if (i > 0) break;
+                if (j == i) break;
+                if (first_key_inspected) break;
+                first_key_inspected = true;
+            }
+        }
+        do {
+            var w = v[i];
+            if (common_i >= w[0].length)
+            {
+                this.cursor = c - w[0].length;
+                if (w.length < 4) return w[2];
+                var res = w[3](this);
+                this.cursor = c - w[0].length;
+                if (res) return w[2];
+            }
+            i = w[1];
+        } while (i >= 0);
+        return 0;
+    };
+
+    /* to replace chars between c_bra and c_ket in this.current by the
+     * chars in s.
+     */
+    /**
+     * @param {number} c_bra
+     * @param {number} c_ket
+     * @param {string} s
+     * @return {number}
+     */
+    this.replace_s = function(c_bra, c_ket, s)
+    {
+        /** @protected */
+        var adjustment = s.length - (c_ket - c_bra);
+        this.current = this.current.slice(0, c_bra) + s + this.current.slice(c_ket);
+        this.limit += adjustment;
+        if (this.cursor >= c_ket) this.cursor += adjustment;
+        else if (this.cursor > c_bra) this.cursor = c_bra;
+        return adjustment;
+    };
+
+    /**
+     * @return {boolean}
+     */
+    this.slice_check = function()
+    {
+        /** @protected */
+        if (this.bra < 0 ||
+            this.bra > this.ket ||
+            this.ket > this.limit ||
+            this.limit > this.current.length)
+        {
+            return false;
+        }
+        return true;
+    };
+
+    /**
+     * @param {number} c_bra
+     * @return {boolean}
+     */
+    this.slice_from = function(s)
+    {
+        /** @protected */
+        var result = false;
+        if (this.slice_check())
+        {
+            this.replace_s(this.bra, this.ket, s);
+            result = true;
+        }
+        return result;
+    };
+
+    /**
+     * @return {boolean}
+     */
+    this.slice_del = function()
+    {
+        /** @protected */
+        return this.slice_from("");
+    };
+
+    /**
+     * @param {number} c_bra
+     * @param {number} c_ket
+     * @param {string} s
+     */
+    this.insert = function(c_bra, c_ket, s)
+    {
+        /** @protected */
+        var adjustment = this.replace_s(c_bra, c_ket, s);
+        if (c_bra <= this.bra) this.bra += adjustment;
+        if (c_bra <= this.ket) this.ket += adjustment;
+    };
+
+    /**
+     * @return {string}
+     */
+    this.slice_to = function()
+    {
+        /** @protected */
+        var result = '';
+        if (this.slice_check())
+        {
+            result = this.current.slice(this.bra, this.ket);
+        }
+        return result;
+    };
+
+    /**
+     * @return {string}
+     */
+    this.assign_to = function()
+    {
+        /** @protected */
+        return this.current.slice(0, this.limit);
+    };
+};
--- a/build/html/_static/basic.css
+++ b/build/html/_static/basic.css
@ -0,0 +1,906 @@
+/*
+ * Sphinx stylesheet -- basic theme.
+ */
+
+/* -- main layout ----------------------------------------------------------- */
+
+div.clearer {
+    clear: both;
+}
+
+div.section::after {
+    display: block;
+    content: '';
+    clear: left;
+}
+
+/* -- relbar ---------------------------------------------------------------- */
+
+div.related {
+    width: 100%;
+    font-size: 90%;
+}
+
+div.related h3 {
+    display: none;
+}
+
+div.related ul {
+    margin: 0;
+    padding: 0 0 0 10px;
+    list-style: none;
+}
+
+div.related li {
+    display: inline;
+}
+
+div.related li.right {
+    float: right;
+    margin-right: 5px;
+}
+
+/* -- sidebar --------------------------------------------------------------- */
+
+div.sphinxsidebarwrapper {
+    padding: 10px 5px 0 10px;
+}
+
+div.sphinxsidebar {
+    float: left;
+    width: 230px;
+    margin-left: -100%;
+    font-size: 90%;
+    word-wrap: break-word;
+    overflow-wrap : break-word;
+}
+
+div.sphinxsidebar ul {
+    list-style: none;
+}
+
+div.sphinxsidebar ul ul,
+div.sphinxsidebar ul.want-points {
+    margin-left: 20px;
+    list-style: square;
+}
+
+div.sphinxsidebar ul ul {
+    margin-top: 0;
+    margin-bottom: 0;
+}
+
+div.sphinxsidebar form {
+    margin-top: 10px;
+}
+
+div.sphinxsidebar input {
+    border: 1px solid #98dbcc;
+    font-family: sans-serif;
+    font-size: 1em;
+}
+
+div.sphinxsidebar #searchbox form.search {
+    overflow: hidden;
+}
+
+div.sphinxsidebar #searchbox input[type="text"] {
+    float: left;
+    width: 80%;
+    padding: 0.25em;
+    box-sizing: border-box;
+}
+
+div.sphinxsidebar #searchbox input[type="submit"] {
+    float: left;
+    width: 20%;
+    border-left: none;
+    padding: 0.25em;
+    box-sizing: border-box;
+}
+
+
+img {
+    border: 0;
+    max-width: 100%;
+}
+
+/* -- search page ----------------------------------------------------------- */
+
+ul.search {
+    margin-top: 10px;
+}
+
+ul.search li {
+    padding: 5px 0;
+}
+
+ul.search li a {
+    font-weight: bold;
+}
+
+ul.search li p.context {
+    color: #888;
+    margin: 2px 0 0 30px;
+    text-align: left;
+}
+
+ul.keywordmatches li.goodmatch a {
+    font-weight: bold;
+}
+
+/* -- index page ------------------------------------------------------------ */
+
+table.contentstable {
+    width: 90%;
+    margin-left: auto;
+    margin-right: auto;
+}
+
+table.contentstable p.biglink {
+    line-height: 150%;
+}
+
+a.biglink {
+    font-size: 1.3em;
+}
+
+span.linkdescr {
+    font-style: italic;
+    padding-top: 5px;
+    font-size: 90%;
+}
+
+/* -- general index --------------------------------------------------------- */
+
+table.indextable {
+    width: 100%;
+}
+
+table.indextable td {
+    text-align: left;
+    vertical-align: top;
+}
+
+table.indextable ul {
+    margin-top: 0;
+    margin-bottom: 0;
+    list-style-type: none;
+}
+
+table.indextable > tbody > tr > td > ul {
+    padding-left: 0em;
+}
+
+table.indextable tr.pcap {
+    height: 10px;
+}
+
+table.indextable tr.cap {
+    margin-top: 10px;
+    background-color: #f2f2f2;
+}
+
+img.toggler {
+    margin-right: 3px;
+    margin-top: 3px;
+    cursor: pointer;
+}
+
+div.modindex-jumpbox {
+    border-top: 1px solid #ddd;
+    border-bottom: 1px solid #ddd;
+    margin: 1em 0 1em 0;
+    padding: 0.4em;
+}
+
+div.genindex-jumpbox {
+    border-top: 1px solid #ddd;
+    border-bottom: 1px solid #ddd;
+    margin: 1em 0 1em 0;
+    padding: 0.4em;
+}
+
+/* -- domain module index --------------------------------------------------- */
+
+table.modindextable td {
+    padding: 2px;
+    border-collapse: collapse;
+}
+
+/* -- general body styles --------------------------------------------------- */
+
+div.body {
+    min-width: inherit;
+    max-width: 800px;
+}
+
+div.body p, div.body dd, div.body li, div.body blockquote {
+    -moz-hyphens: auto;
+    -ms-hyphens: auto;
+    -webkit-hyphens: auto;
+    hyphens: auto;
+}
+
+a.headerlink {
+    visibility: hidden;
+}
+
+a:visited {
+    color: #551A8B;
+}
+
+h1:hover > a.headerlink,
+h2:hover > a.headerlink,
+h3:hover > a.headerlink,
+h4:hover > a.headerlink,
+h5:hover > a.headerlink,
+h6:hover > a.headerlink,
+dt:hover > a.headerlink,
+caption:hover > a.headerlink,
+p.caption:hover > a.headerlink,
+div.code-block-caption:hover > a.headerlink {
+    visibility: visible;
+}
+
+div.body p.caption {
+    text-align: inherit;
+}
+
+div.body td {
+    text-align: left;
+}
+
+.first {
+    margin-top: 0 !important;
+}
+
+p.rubric {
+    margin-top: 30px;
+    font-weight: bold;
+}
+
+img.align-left, figure.align-left, .figure.align-left, object.align-left {
+    clear: left;
+    float: left;
+    margin-right: 1em;
+}
+
+img.align-right, figure.align-right, .figure.align-right, object.align-right {
+    clear: right;
+    float: right;
+    margin-left: 1em;
+}
+
+img.align-center, figure.align-center, .figure.align-center, object.align-center {
+  display: block;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+img.align-default, figure.align-default, .figure.align-default {
+  display: block;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.align-left {
+    text-align: left;
+}
+
+.align-center {
+    text-align: center;
+}
+
+.align-default {
+    text-align: center;
+}
+
+.align-right {
+    text-align: right;
+}
+
+/* -- sidebars -------------------------------------------------------------- */
+
+div.sidebar,
+aside.sidebar {
+    margin: 0 0 0.5em 1em;
+    border: 1px solid #ddb;
+    padding: 7px;
+    background-color: #ffe;
+    width: 40%;
+    float: right;
+    clear: right;
+    overflow-x: auto;
+}
+
+p.sidebar-title {
+    font-weight: bold;
+}
+
+nav.contents,
+aside.topic,
+div.admonition, div.topic, blockquote {
+    clear: left;
+}
+
+/* -- topics ---------------------------------------------------------------- */
+
+nav.contents,
+aside.topic,
+div.topic {
+    border: 1px solid #ccc;
+    padding: 7px;
+    margin: 10px 0 10px 0;
+}
+
+p.topic-title {
+    font-size: 1.1em;
+    font-weight: bold;
+    margin-top: 10px;
+}
+
+/* -- admonitions ----------------------------------------------------------- */
+
+div.admonition {
+    margin-top: 10px;
+    margin-bottom: 10px;
+    padding: 7px;
+}
+
+div.admonition dt {
+    font-weight: bold;
+}
+
+p.admonition-title {
+    margin: 0px 10px 5px 0px;
+    font-weight: bold;
+}
+
+div.body p.centered {
+    text-align: center;
+    margin-top: 25px;
+}
+
+/* -- content of sidebars/topics/admonitions -------------------------------- */
+
+div.sidebar > :last-child,
+aside.sidebar > :last-child,
+nav.contents > :last-child,
+aside.topic > :last-child,
+div.topic > :last-child,
+div.admonition > :last-child {
+    margin-bottom: 0;
+}
+
+div.sidebar::after,
+aside.sidebar::after,
+nav.contents::after,
+aside.topic::after,
+div.topic::after,
+div.admonition::after,
+blockquote::after {
+    display: block;
+    content: '';
+    clear: both;
+}
+
+/* -- tables ---------------------------------------------------------------- */
+
+table.docutils {
+    margin-top: 10px;
+    margin-bottom: 10px;
+    border: 0;
+    border-collapse: collapse;
+}
+
+table.align-center {
+    margin-left: auto;
+    margin-right: auto;
+}
+
+table.align-default {
+    margin-left: auto;
+    margin-right: auto;
+}
+
+table caption span.caption-number {
+    font-style: italic;
+}
+
+table caption span.caption-text {
+}
+
+table.docutils td, table.docutils th {
+    padding: 1px 8px 1px 5px;
+    border-top: 0;
+    border-left: 0;
+    border-right: 0;
+    border-bottom: 1px solid #aaa;
+}
+
+th {
+    text-align: left;
+    padding-right: 5px;
+}
+
+table.citation {
+    border-left: solid 1px gray;
+    margin-left: 1px;
+}
+
+table.citation td {
+    border-bottom: none;
+}
+
+th > :first-child,
+td > :first-child {
+    margin-top: 0px;
+}
+
+th > :last-child,
+td > :last-child {
+    margin-bottom: 0px;
+}
+
+/* -- figures --------------------------------------------------------------- */
+
+div.figure, figure {
+    margin: 0.5em;
+    padding: 0.5em;
+}
+
+div.figure p.caption, figcaption {
+    padding: 0.3em;
+}
+
+div.figure p.caption span.caption-number,
+figcaption span.caption-number {
+    font-style: italic;
+}
+
+div.figure p.caption span.caption-text,
+figcaption span.caption-text {
+}
+
+/* -- field list styles ----------------------------------------------------- */
+
+table.field-list td, table.field-list th {
+    border: 0 !important;
+}
+
+.field-list ul {
+    margin: 0;
+    padding-left: 1em;
+}
+
+.field-list p {
+    margin: 0;
+}
+
+.field-name {
+    -moz-hyphens: manual;
+    -ms-hyphens: manual;
+    -webkit-hyphens: manual;
+    hyphens: manual;
+}
+
+/* -- hlist styles ---------------------------------------------------------- */
+
+table.hlist {
+    margin: 1em 0;
+}
+
+table.hlist td {
+    vertical-align: top;
+}
+
+/* -- object description styles --------------------------------------------- */
+
+.sig {
+	font-family: 'Consolas', 'Menlo', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace;
+}
+
+.sig-name, code.descname {
+    background-color: transparent;
+    font-weight: bold;
+}
+
+.sig-name {
+	font-size: 1.1em;
+}
+
+code.descname {
+    font-size: 1.2em;
+}
+
+.sig-prename, code.descclassname {
+    background-color: transparent;
+}
+
+.optional {
+    font-size: 1.3em;
+}
+
+.sig-paren {
+    font-size: larger;
+}
+
+.sig-param.n {
+	font-style: italic;
+}
+
+/* C++ specific styling */
+
+.sig-inline.c-texpr,
+.sig-inline.cpp-texpr {
+	font-family: unset;
+}
+
+.sig.c   .k, .sig.c   .kt,
+.sig.cpp .k, .sig.cpp .kt {
+	color: #0033B3;
+}
+
+.sig.c   .m,
+.sig.cpp .m {
+	color: #1750EB;
+}
+
+.sig.c   .s, .sig.c   .sc,
+.sig.cpp .s, .sig.cpp .sc {
+	color: #067D17;
+}
+
+
+/* -- other body styles ----------------------------------------------------- */
+
+ol.arabic {
+    list-style: decimal;
+}
+
+ol.loweralpha {
+    list-style: lower-alpha;
+}
+
+ol.upperalpha {
+    list-style: upper-alpha;
+}
+
+ol.lowerroman {
+    list-style: lower-roman;
+}
+
+ol.upperroman {
+    list-style: upper-roman;
+}
+
+:not(li) > ol > li:first-child > :first-child,
+:not(li) > ul > li:first-child > :first-child {
+    margin-top: 0px;
+}
+
+:not(li) > ol > li:last-child > :last-child,
+:not(li) > ul > li:last-child > :last-child {
+    margin-bottom: 0px;
+}
+
+ol.simple ol p,
+ol.simple ul p,
+ul.simple ol p,
+ul.simple ul p {
+    margin-top: 0;
+}
+
+ol.simple > li:not(:first-child) > p,
+ul.simple > li:not(:first-child) > p {
+    margin-top: 0;
+}
+
+ol.simple p,
+ul.simple p {
+    margin-bottom: 0;
+}
+
+aside.footnote > span,
+div.citation > span {
+    float: left;
+}
+aside.footnote > span:last-of-type,
+div.citation > span:last-of-type {
+  padding-right: 0.5em;
+}
+aside.footnote > p {
+  margin-left: 2em;
+}
+div.citation > p {
+  margin-left: 4em;
+}
+aside.footnote > p:last-of-type,
+div.citation > p:last-of-type {
+    margin-bottom: 0em;
+}
+aside.footnote > p:last-of-type:after,
+div.citation > p:last-of-type:after {
+    content: "";
+    clear: both;
+}
+
+dl.field-list {
+    display: grid;
+    grid-template-columns: fit-content(30%) auto;
+}
+
+dl.field-list > dt {
+    font-weight: bold;
+    word-break: break-word;
+    padding-left: 0.5em;
+    padding-right: 5px;
+}
+
+dl.field-list > dd {
+    padding-left: 0.5em;
+    margin-top: 0em;
+    margin-left: 0em;
+    margin-bottom: 0em;
+}
+
+dl {
+    margin-bottom: 15px;
+}
+
+dd > :first-child {
+    margin-top: 0px;
+}
+
+dd ul, dd table {
+    margin-bottom: 10px;
+}
+
+dd {
+    margin-top: 3px;
+    margin-bottom: 10px;
+    margin-left: 30px;
+}
+
+.sig dd {
+    margin-top: 0px;
+    margin-bottom: 0px;
+}
+
+.sig dl {
+    margin-top: 0px;
+    margin-bottom: 0px;
+}
+
+dl > dd:last-child,
+dl > dd:last-child > :last-child {
+    margin-bottom: 0;
+}
+
+dt:target, span.highlighted {
+    background-color: #fbe54e;
+}
+
+rect.highlighted {
+    fill: #fbe54e;
+}
+
+dl.glossary dt {
+    font-weight: bold;
+    font-size: 1.1em;
+}
+
+.versionmodified {
+    font-style: italic;
+}
+
+.system-message {
+    background-color: #fda;
+    padding: 5px;
+    border: 3px solid red;
+}
+
+.footnote:target  {
+    background-color: #ffa;
+}
+
+.line-block {
+    display: block;
+    margin-top: 1em;
+    margin-bottom: 1em;
+}
+
+.line-block .line-block {
+    margin-top: 0;
+    margin-bottom: 0;
+    margin-left: 1.5em;
+}
+
+.guilabel, .menuselection {
+    font-family: sans-serif;
+}
+
+.accelerator {
+    text-decoration: underline;
+}
+
+.classifier {
+    font-style: oblique;
+}
+
+.classifier:before {
+    font-style: normal;
+    margin: 0 0.5em;
+    content: ":";
+    display: inline-block;
+}
+
+abbr, acronym {
+    border-bottom: dotted 1px;
+    cursor: help;
+}
+
+/* -- code displays --------------------------------------------------------- */
+
+pre {
+    overflow: auto;
+    overflow-y: hidden;  /* fixes display issues on Chrome browsers */
+}
+
+pre, div[class*="highlight-"] {
+    clear: both;
+}
+
+span.pre {
+    -moz-hyphens: none;
+    -ms-hyphens: none;
+    -webkit-hyphens: none;
+    hyphens: none;
+    white-space: nowrap;
+}
+
+div[class*="highlight-"] {
+    margin: 1em 0;
+}
+
+td.linenos pre {
+    border: 0;
+    background-color: transparent;
+    color: #aaa;
+}
+
+table.highlighttable {
+    display: block;
+}
+
+table.highlighttable tbody {
+    display: block;
+}
+
+table.highlighttable tr {
+    display: flex;
+}
+
+table.highlighttable td {
+    margin: 0;
+    padding: 0;
+}
+
+table.highlighttable td.linenos {
+    padding-right: 0.5em;
+}
+
+table.highlighttable td.code {
+    flex: 1;
+    overflow: hidden;
+}
+
+.highlight .hll {
+    display: block;
+}
+
+div.highlight pre,
+table.highlighttable pre {
+    margin: 0;
+}
+
+div.code-block-caption + div {
+    margin-top: 0;
+}
+
+div.code-block-caption {
+    margin-top: 1em;
+    padding: 2px 5px;
+    font-size: small;
+}
+
+div.code-block-caption code {
+    background-color: transparent;
+}
+
+table.highlighttable td.linenos,
+span.linenos,
+div.highlight span.gp {  /* gp: Generic.Prompt */
+  user-select: none;
+  -webkit-user-select: text; /* Safari fallback only */
+  -webkit-user-select: none; /* Chrome/Safari */
+  -moz-user-select: none; /* Firefox */
+  -ms-user-select: none; /* IE10+ */
+}
+
+div.code-block-caption span.caption-number {
+    padding: 0.1em 0.3em;
+    font-style: italic;
+}
+
+div.code-block-caption span.caption-text {
+}
+
+div.literal-block-wrapper {
+    margin: 1em 0;
+}
+
+code.xref, a code {
+    background-color: transparent;
+    font-weight: bold;
+}
+
+h1 code, h2 code, h3 code, h4 code, h5 code, h6 code {
+    background-color: transparent;
+}
+
+.viewcode-link {
+    float: right;
+}
+
+.viewcode-back {
+    float: right;
+    font-family: sans-serif;
+}
+
+div.viewcode-block:target {
+    margin: -1px -10px;
+    padding: 0 10px;
+}
+
+/* -- math display ---------------------------------------------------------- */
+
+img.math {
+    vertical-align: middle;
+}
+
+div.body div.math p {
+    text-align: center;
+}
+
+span.eqno {
+    float: right;
+}
+
+span.eqno a.headerlink {
+    position: absolute;
+    z-index: 1;
+}
+
+div.math:hover a.headerlink {
+    visibility: visible;
+}
+
+/* -- printout stylesheet --------------------------------------------------- */
+
+@media print {
+    div.document,
+    div.documentwrapper,
+    div.bodywrapper {
+        margin: 0 !important;
+        width: 100%;
+    }
+
+    div.sphinxsidebar,
+    div.related,
+    div.footer,
+    #top-link {
+        display: none;
+    }
+}
--- a/build/html/_static/custom.css
+++ b/build/html/_static/custom.css
@ -0,0 +1 @@
+/* This file intentionally left blank. */
--- a/build/html/_static/doctools.js
+++ b/build/html/_static/doctools.js
@ -0,0 +1,150 @@
+/*
+ * Base JavaScript utilities for all Sphinx HTML documentation.
+ */
+"use strict";
+
+const BLACKLISTED_KEY_CONTROL_ELEMENTS = new Set([
+  "TEXTAREA",
+  "INPUT",
+  "SELECT",
+  "BUTTON",
+]);
+
+const _ready = (callback) => {
+  if (document.readyState !== "loading") {
+    callback();
+  } else {
+    document.addEventListener("DOMContentLoaded", callback);
+  }
+};
+
+/**
+ * Small JavaScript module for the documentation.
+ */
+const Documentation = {
+  init: () => {
+    Documentation.initDomainIndexTable();
+    Documentation.initOnKeyListeners();
+  },
+
+  /**
+   * i18n support
+   */
+  TRANSLATIONS: {},
+  PLURAL_EXPR: (n) => (n === 1 ? 0 : 1),
+  LOCALE: "unknown",
+
+  // gettext and ngettext don't access this so that the functions
+  // can safely bound to a different name (_ = Documentation.gettext)
+  gettext: (string) => {
+    const translated = Documentation.TRANSLATIONS[string];
+    switch (typeof translated) {
+      case "undefined":
+        return string; // no translation
+      case "string":
+        return translated; // translation exists
+      default:
+        return translated[0]; // (singular, plural) translation tuple exists
+    }
+  },
+
+  ngettext: (singular, plural, n) => {
+    const translated = Documentation.TRANSLATIONS[singular];
+    if (typeof translated !== "undefined")
+      return translated[Documentation.PLURAL_EXPR(n)];
+    return n === 1 ? singular : plural;
+  },
+
+  addTranslations: (catalog) => {
+    Object.assign(Documentation.TRANSLATIONS, catalog.messages);
+    Documentation.PLURAL_EXPR = new Function(
+      "n",
+      `return (${catalog.plural_expr})`,
+    );
+    Documentation.LOCALE = catalog.locale;
+  },
+
+  /**
+   * helper function to focus on search bar
+   */
+  focusSearchBar: () => {
+    document.querySelectorAll("input[name=q]")[0]?.focus();
+  },
+
+  /**
+   * Initialise the domain index toggle buttons
+   */
+  initDomainIndexTable: () => {
+    const toggler = (el) => {
+      const idNumber = el.id.substr(7);
+      const toggledRows = document.querySelectorAll(`tr.cg-${idNumber}`);
+      if (el.src.substr(-9) === "minus.png") {
+        el.src = `${el.src.substr(0, el.src.length - 9)}plus.png`;
+        toggledRows.forEach((el) => (el.style.display = "none"));
+      } else {
+        el.src = `${el.src.substr(0, el.src.length - 8)}minus.png`;
+        toggledRows.forEach((el) => (el.style.display = ""));
+      }
+    };
+
+    const togglerElements = document.querySelectorAll("img.toggler");
+    togglerElements.forEach((el) =>
+      el.addEventListener("click", (event) => toggler(event.currentTarget)),
+    );
+    togglerElements.forEach((el) => (el.style.display = ""));
+    if (DOCUMENTATION_OPTIONS.COLLAPSE_INDEX) togglerElements.forEach(toggler);
+  },
+
+  initOnKeyListeners: () => {
+    // only install a listener if it is really needed
+    if (
+      !DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS
+      && !DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS
+    )
+      return;
+
+    document.addEventListener("keydown", (event) => {
+      // bail for input elements
+      if (BLACKLISTED_KEY_CONTROL_ELEMENTS.has(document.activeElement.tagName))
+        return;
+      // bail with special keys
+      if (event.altKey || event.ctrlKey || event.metaKey) return;
+
+      if (!event.shiftKey) {
+        switch (event.key) {
+          case "ArrowLeft":
+            if (!DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) break;
+
+            const prevLink = document.querySelector('link[rel="prev"]');
+            if (prevLink && prevLink.href) {
+              window.location.href = prevLink.href;
+              event.preventDefault();
+            }
+            break;
+          case "ArrowRight":
+            if (!DOCUMENTATION_OPTIONS.NAVIGATION_WITH_KEYS) break;
+
+            const nextLink = document.querySelector('link[rel="next"]');
+            if (nextLink && nextLink.href) {
+              window.location.href = nextLink.href;
+              event.preventDefault();
+            }
+            break;
+        }
+      }
+
+      // some keyboard layouts may need Shift to get /
+      switch (event.key) {
+        case "/":
+          if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) break;
+          Documentation.focusSearchBar();
+          event.preventDefault();
+      }
+    });
+  },
+};
+
+// quick alias for translations
+const _ = Documentation.gettext;
+
+_ready(Documentation.init);
--- a/build/html/_static/documentation_options.js
+++ b/build/html/_static/documentation_options.js
@ -0,0 +1,13 @@
+const DOCUMENTATION_OPTIONS = {
+    VERSION: '',
+    LANGUAGE: 'en',
+    COLLAPSE_INDEX: false,
+    BUILDER: 'html',
+    FILE_SUFFIX: '.html',
+    LINK_SUFFIX: '.html',
+    HAS_SOURCE: true,
+    SOURCELINK_SUFFIX: '.txt',
+    NAVIGATION_WITH_KEYS: false,
+    SHOW_SEARCH_SUMMARY: true,
+    ENABLE_SEARCH_SHORTCUTS: true,
+};
--- a/build/html/_static/english-stemmer.js
+++ b/build/html/_static/english-stemmer.js
--- a/build/html/_static/file.png
+++ b/build/html/_static/file.png
--- a/build/html/_static/github-banner.svg
+++ b/build/html/_static/github-banner.svg
@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="80" height="80" viewBox="0 0 250 250" fill="#fff">
+    <path d="M0 0l115 115h15l12 27 108 108V0z" fill="#151513"/>
+    <path d="M128 109c-15-9-9-19-9-19 3-7 2-11 2-11-1-7 3-2 3-2 4 5 2 11 2 11-3 10 5 15 9 16"/>
+    <path d="M115 115s4 2 5 0l14-14c3-2 6-3 8-3-8-11-15-24 2-41 5-5 10-7 16-7 1-2 3-7 12-11 0 0 5 3 7 16 4 2 8 5 12 9s7 8 9 12c14 3 17 7 17 7-4 8-9 11-11 11 0 6-2 11-7 16-16 16-30 10-41 2 0 3-1 7-5 11l-12 11c-1 1 1 5 1 5z"/>
+</svg>
--- a/build/html/_static/language_data.js
+++ b/build/html/_static/language_data.js
--- a/build/html/_static/minus.png
+++ b/build/html/_static/minus.png
--- a/build/html/_static/plus.png
+++ b/build/html/_static/plus.png
--- a/build/html/_static/pygments.css
+++ b/build/html/_static/pygments.css
@ -0,0 +1,84 @@
+pre { line-height: 125%; }
+td.linenos .normal { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
+span.linenos { color: inherit; background-color: transparent; padding-left: 5px; padding-right: 5px; }
+td.linenos .special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
+span.linenos.special { color: #000000; background-color: #ffffc0; padding-left: 5px; padding-right: 5px; }
+.highlight .hll { background-color: #ffffcc }
+.highlight { background: #f8f8f8; }
+.highlight .c { color: #8F5902; font-style: italic } /* Comment */
+.highlight .err { color: #A40000; border: 1px solid #EF2929 } /* Error */
+.highlight .g { color: #000 } /* Generic */
+.highlight .k { color: #004461; font-weight: bold } /* Keyword */
+.highlight .l { color: #000 } /* Literal */
+.highlight .n { color: #000 } /* Name */
+.highlight .o { color: #582800 } /* Operator */
+.highlight .x { color: #000 } /* Other */
+.highlight .p { color: #000; font-weight: bold } /* Punctuation */
+.highlight .ch { color: #8F5902; font-style: italic } /* Comment.Hashbang */
+.highlight .cm { color: #8F5902; font-style: italic } /* Comment.Multiline */
+.highlight .cp { color: #8F5902 } /* Comment.Preproc */
+.highlight .cpf { color: #8F5902; font-style: italic } /* Comment.PreprocFile */
+.highlight .c1 { color: #8F5902; font-style: italic } /* Comment.Single */
+.highlight .cs { color: #8F5902; font-style: italic } /* Comment.Special */
+.highlight .gd { color: #A40000 } /* Generic.Deleted */
+.highlight .ge { color: #000; font-style: italic } /* Generic.Emph */
+.highlight .ges { color: #000 } /* Generic.EmphStrong */
+.highlight .gr { color: #EF2929 } /* Generic.Error */
+.highlight .gh { color: #000080; font-weight: bold } /* Generic.Heading */
+.highlight .gi { color: #00A000 } /* Generic.Inserted */
+.highlight .go { color: #888 } /* Generic.Output */
+.highlight .gp { color: #745334 } /* Generic.Prompt */
+.highlight .gs { color: #000; font-weight: bold } /* Generic.Strong */
+.highlight .gu { color: #800080; font-weight: bold } /* Generic.Subheading */
+.highlight .gt { color: #A40000; font-weight: bold } /* Generic.Traceback */
+.highlight .kc { color: #004461; font-weight: bold } /* Keyword.Constant */
+.highlight .kd { color: #004461; font-weight: bold } /* Keyword.Declaration */
+.highlight .kn { color: #004461; font-weight: bold } /* Keyword.Namespace */
+.highlight .kp { color: #004461; font-weight: bold } /* Keyword.Pseudo */
+.highlight .kr { color: #004461; font-weight: bold } /* Keyword.Reserved */
+.highlight .kt { color: #004461; font-weight: bold } /* Keyword.Type */
+.highlight .ld { color: #000 } /* Literal.Date */
+.highlight .m { color: #900 } /* Literal.Number */
+.highlight .s { color: #4E9A06 } /* Literal.String */
+.highlight .na { color: #C4A000 } /* Name.Attribute */
+.highlight .nb { color: #004461 } /* Name.Builtin */
+.highlight .nc { color: #000 } /* Name.Class */
+.highlight .no { color: #000 } /* Name.Constant */
+.highlight .nd { color: #888 } /* Name.Decorator */
+.highlight .ni { color: #CE5C00 } /* Name.Entity */
+.highlight .ne { color: #C00; font-weight: bold } /* Name.Exception */
+.highlight .nf { color: #000 } /* Name.Function */
+.highlight .nl { color: #F57900 } /* Name.Label */
+.highlight .nn { color: #000 } /* Name.Namespace */
+.highlight .nx { color: #000 } /* Name.Other */
+.highlight .py { color: #000 } /* Name.Property */
+.highlight .nt { color: #004461; font-weight: bold } /* Name.Tag */
+.highlight .nv { color: #000 } /* Name.Variable */
+.highlight .ow { color: #004461; font-weight: bold } /* Operator.Word */
+.highlight .pm { color: #000; font-weight: bold } /* Punctuation.Marker */
+.highlight .w { color: #F8F8F8 } /* Text.Whitespace */
+.highlight .mb { color: #900 } /* Literal.Number.Bin */
+.highlight .mf { color: #900 } /* Literal.Number.Float */
+.highlight .mh { color: #900 } /* Literal.Number.Hex */
+.highlight .mi { color: #900 } /* Literal.Number.Integer */
+.highlight .mo { color: #900 } /* Literal.Number.Oct */
+.highlight .sa { color: #4E9A06 } /* Literal.String.Affix */
+.highlight .sb { color: #4E9A06 } /* Literal.String.Backtick */
+.highlight .sc { color: #4E9A06 } /* Literal.String.Char */
+.highlight .dl { color: #4E9A06 } /* Literal.String.Delimiter */
+.highlight .sd { color: #8F5902; font-style: italic } /* Literal.String.Doc */
+.highlight .s2 { color: #4E9A06 } /* Literal.String.Double */
+.highlight .se { color: #4E9A06 } /* Literal.String.Escape */
+.highlight .sh { color: #4E9A06 } /* Literal.String.Heredoc */
+.highlight .si { color: #4E9A06 } /* Literal.String.Interpol */
+.highlight .sx { color: #4E9A06 } /* Literal.String.Other */
+.highlight .sr { color: #4E9A06 } /* Literal.String.Regex */
+.highlight .s1 { color: #4E9A06 } /* Literal.String.Single */
+.highlight .ss { color: #4E9A06 } /* Literal.String.Symbol */
+.highlight .bp { color: #3465A4 } /* Name.Builtin.Pseudo */
+.highlight .fm { color: #000 } /* Name.Function.Magic */
+.highlight .vc { color: #000 } /* Name.Variable.Class */
+.highlight .vg { color: #000 } /* Name.Variable.Global */
+.highlight .vi { color: #000 } /* Name.Variable.Instance */
+.highlight .vm { color: #000 } /* Name.Variable.Magic */
+.highlight .il { color: #900 } /* Literal.Number.Integer.Long */
--- a/build/html/_static/searchtools.js
+++ b/build/html/_static/searchtools.js
@ -0,0 +1,693 @@
+/*
+ * Sphinx JavaScript utilities for the full-text search.
+ */
+"use strict";
+
+/**
+ * Simple result scoring code.
+ */
+if (typeof Scorer === "undefined") {
+  var Scorer = {
+    // Implement the following function to further tweak the score for each result
+    // The function takes a result array [docname, title, anchor, descr, score, filename]
+    // and returns the new score.
+    /*
+    score: result => {
+      const [docname, title, anchor, descr, score, filename, kind] = result
+      return score
+    },
+    */
+
+    // query matches the full name of an object
+    objNameMatch: 11,
+    // or matches in the last dotted part of the object name
+    objPartialMatch: 6,
+    // Additive scores depending on the priority of the object
+    objPrio: {
+      0: 15, // used to be importantResults
+      1: 5, // used to be objectResults
+      2: -5, // used to be unimportantResults
+    },
+    //  Used when the priority is not in the mapping.
+    objPrioDefault: 0,
+
+    // query found in title
+    title: 15,
+    partialTitle: 7,
+    // query found in terms
+    term: 5,
+    partialTerm: 2,
+  };
+}
+
+// Global search result kind enum, used by themes to style search results.
+// prettier-ignore
+class SearchResultKind {
+  static get index() { return "index"; }
+  static get object() { return "object"; }
+  static get text() { return "text"; }
+  static get title() { return "title"; }
+}
+
+const _removeChildren = (element) => {
+  while (element && element.lastChild) element.removeChild(element.lastChild);
+};
+
+/**
+ * See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping
+ */
+const _escapeRegExp = (string) =>
+  string.replace(/[.*+\-?^${}()|[\]\\]/g, "\\$&"); // $& means the whole matched string
+
+const _escapeHTML = (text) => {
+  return text
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;");
+};
+
+const _displayItem = (item, searchTerms, highlightTerms) => {
+  const docBuilder = DOCUMENTATION_OPTIONS.BUILDER;
+  const docFileSuffix = DOCUMENTATION_OPTIONS.FILE_SUFFIX;
+  const docLinkSuffix = DOCUMENTATION_OPTIONS.LINK_SUFFIX;
+  const showSearchSummary = DOCUMENTATION_OPTIONS.SHOW_SEARCH_SUMMARY;
+  const contentRoot = document.documentElement.dataset.content_root;
+
+  const [docName, title, anchor, descr, score, _filename, kind] = item;
+
+  let listItem = document.createElement("li");
+  // Add a class representing the item's type:
+  // can be used by a theme's CSS selector for styling
+  // See SearchResultKind for the class names.
+  listItem.classList.add(`kind-${kind}`);
+  let requestUrl;
+  let linkUrl;
+  if (docBuilder === "dirhtml") {
+    // dirhtml builder
+    let dirname = docName + "/";
+    if (dirname.match(/\/index\/$/))
+      dirname = dirname.substring(0, dirname.length - 6);
+    else if (dirname === "index/") dirname = "";
+    requestUrl = contentRoot + dirname;
+    linkUrl = requestUrl;
+  } else {
+    // normal html builders
+    requestUrl = contentRoot + docName + docFileSuffix;
+    linkUrl = docName + docLinkSuffix;
+  }
+  let linkEl = listItem.appendChild(document.createElement("a"));
+  linkEl.href = linkUrl + anchor;
+  linkEl.dataset.score = score;
+  linkEl.innerHTML = _escapeHTML(title);
+  if (descr) {
+    listItem.appendChild(document.createElement("span")).innerHTML =
+      ` (${_escapeHTML(descr)})`;
+    // highlight search terms in the description
+    if (SPHINX_HIGHLIGHT_ENABLED)
+      // SPHINX_HIGHLIGHT_ENABLED is set in sphinx_highlight.js
+      highlightTerms.forEach((term) =>
+        _highlightText(listItem, term, "highlighted"),
+      );
+  } else if (showSearchSummary)
+    fetch(requestUrl)
+      .then((responseData) => responseData.text())
+      .then((data) => {
+        if (data)
+          listItem.appendChild(
+            Search.makeSearchSummary(data, searchTerms, anchor),
+          );
+        // highlight search terms in the summary
+        if (SPHINX_HIGHLIGHT_ENABLED)
+          // SPHINX_HIGHLIGHT_ENABLED is set in sphinx_highlight.js
+          highlightTerms.forEach((term) =>
+            _highlightText(listItem, term, "highlighted"),
+          );
+      });
+  Search.output.appendChild(listItem);
+};
+const _finishSearch = (resultCount) => {
+  Search.stopPulse();
+  Search.title.innerText = _("Search Results");
+  if (!resultCount)
+    Search.status.innerText = Documentation.gettext(
+      "Your search did not match any documents. Please make sure that all words are spelled correctly and that you've selected enough categories.",
+    );
+  else
+    Search.status.innerText = Documentation.ngettext(
+      "Search finished, found one page matching the search query.",
+      "Search finished, found ${resultCount} pages matching the search query.",
+      resultCount,
+    ).replace("${resultCount}", resultCount);
+};
+const _displayNextItem = (
+  results,
+  resultCount,
+  searchTerms,
+  highlightTerms,
+) => {
+  // results left, load the summary and display it
+  // this is intended to be dynamic (don't sub resultsCount)
+  if (results.length) {
+    _displayItem(results.pop(), searchTerms, highlightTerms);
+    setTimeout(
+      () => _displayNextItem(results, resultCount, searchTerms, highlightTerms),
+      5,
+    );
+  }
+  // search finished, update title and status message
+  else _finishSearch(resultCount);
+};
+// Helper function used by query() to order search results.
+// Each input is an array of [docname, title, anchor, descr, score, filename, kind].
+// Order the results by score (in opposite order of appearance, since the
+// `_displayNextItem` function uses pop() to retrieve items) and then alphabetically.
+const _orderResultsByScoreThenName = (a, b) => {
+  const leftScore = a[4];
+  const rightScore = b[4];
+  if (leftScore === rightScore) {
+    // same score: sort alphabetically
+    const leftTitle = a[1].toLowerCase();
+    const rightTitle = b[1].toLowerCase();
+    if (leftTitle === rightTitle) return 0;
+    return leftTitle > rightTitle ? -1 : 1; // inverted is intentional
+  }
+  return leftScore > rightScore ? 1 : -1;
+};
+
+/**
+ * Default splitQuery function. Can be overridden in ``sphinx.search`` with a
+ * custom function per language.
+ *
+ * The regular expression works by splitting the string on consecutive characters
+ * that are not Unicode letters, numbers, underscores, or emoji characters.
+ * This is the same as ``\W+`` in Python, preserving the surrogate pair area.
+ */
+if (typeof splitQuery === "undefined") {
+  var splitQuery = (query) =>
+    query
+      .split(/[^\p{Letter}\p{Number}_\p{Emoji_Presentation}]+/gu)
+      .filter((term) => term); // remove remaining empty strings
+}
+
+/**
+ * Search Module
+ */
+const Search = {
+  _index: null,
+  _queued_query: null,
+  _pulse_status: -1,
+
+  htmlToText: (htmlString, anchor) => {
+    const htmlElement = new DOMParser().parseFromString(
+      htmlString,
+      "text/html",
+    );
+    for (const removalQuery of [".headerlink", "script", "style"]) {
+      htmlElement.querySelectorAll(removalQuery).forEach((el) => {
+        el.remove();
+      });
+    }
+    if (anchor) {
+      const anchorContent = htmlElement.querySelector(
+        `[role="main"] ${anchor}`,
+      );
+      if (anchorContent) return anchorContent.textContent;
+
+      console.warn(
+        `Anchored content block not found. Sphinx search tries to obtain it via DOM query '[role=main] ${anchor}'. Check your theme or template.`,
+      );
+    }
+
+    // if anchor not specified or not found, fall back to main content
+    const docContent = htmlElement.querySelector('[role="main"]');
+    if (docContent) return docContent.textContent;
+
+    console.warn(
+      "Content block not found. Sphinx search tries to obtain it via DOM query '[role=main]'. Check your theme or template.",
+    );
+    return "";
+  },
+
+  init: () => {
+    const query = new URLSearchParams(window.location.search).get("q");
+    document
+      .querySelectorAll('input[name="q"]')
+      .forEach((el) => (el.value = query));
+    if (query) Search.performSearch(query);
+  },
+
+  loadIndex: (url) =>
+    (document.body.appendChild(document.createElement("script")).src = url),
+
+  setIndex: (index) => {
+    Search._index = index;
+    if (Search._queued_query !== null) {
+      const query = Search._queued_query;
+      Search._queued_query = null;
+      Search.query(query);
+    }
+  },
+
+  hasIndex: () => Search._index !== null,
+
+  deferQuery: (query) => (Search._queued_query = query),
+
+  stopPulse: () => (Search._pulse_status = -1),
+
+  startPulse: () => {
+    if (Search._pulse_status >= 0) return;
+
+    const pulse = () => {
+      Search._pulse_status = (Search._pulse_status + 1) % 4;
+      Search.dots.innerText = ".".repeat(Search._pulse_status);
+      if (Search._pulse_status >= 0) window.setTimeout(pulse, 500);
+    };
+    pulse();
+  },
+
+  /**
+   * perform a search for something (or wait until index is loaded)
+   */
+  performSearch: (query) => {
+    // create the required interface elements
+    const searchText = document.createElement("h2");
+    searchText.textContent = _("Searching");
+    const searchSummary = document.createElement("p");
+    searchSummary.classList.add("search-summary");
+    searchSummary.innerText = "";
+    const searchList = document.createElement("ul");
+    searchList.setAttribute("role", "list");
+    searchList.classList.add("search");
+
+    const out = document.getElementById("search-results");
+    Search.title = out.appendChild(searchText);
+    Search.dots = Search.title.appendChild(document.createElement("span"));
+    Search.status = out.appendChild(searchSummary);
+    Search.output = out.appendChild(searchList);
+
+    const searchProgress = document.getElementById("search-progress");
+    // Some themes don't use the search progress node
+    if (searchProgress) {
+      searchProgress.innerText = _("Preparing search...");
+    }
+    Search.startPulse();
+
+    // index already loaded, the browser was quick!
+    if (Search.hasIndex()) Search.query(query);
+    else Search.deferQuery(query);
+  },
+
+  _parseQuery: (query) => {
+    // stem the search terms and add them to the correct list
+    const stemmer = new Stemmer();
+    const searchTerms = new Set();
+    const excludedTerms = new Set();
+    const highlightTerms = new Set();
+    const objectTerms = new Set(splitQuery(query.toLowerCase().trim()));
+    splitQuery(query.trim()).forEach((queryTerm) => {
+      const queryTermLower = queryTerm.toLowerCase();
+
+      // maybe skip this "word"
+      // stopwords set is from language_data.js
+      if (stopwords.has(queryTermLower) || queryTerm.match(/^\d+$/)) return;
+
+      // stem the word
+      let word = stemmer.stemWord(queryTermLower);
+      // select the correct list
+      if (word[0] === "-") excludedTerms.add(word.substr(1));
+      else {
+        searchTerms.add(word);
+        highlightTerms.add(queryTermLower);
+      }
+    });
+
+    if (SPHINX_HIGHLIGHT_ENABLED) {
+      // SPHINX_HIGHLIGHT_ENABLED is set in sphinx_highlight.js
+      localStorage.setItem(
+        "sphinx_highlight_terms",
+        [...highlightTerms].join(" "),
+      );
+    }
+
+    // console.debug("SEARCH: searching for:");
+    // console.info("required: ", [...searchTerms]);
+    // console.info("excluded: ", [...excludedTerms]);
+
+    return [query, searchTerms, excludedTerms, highlightTerms, objectTerms];
+  },
+
+  /**
+   * execute search (requires search index to be loaded)
+   */
+  _performSearch: (
+    query,
+    searchTerms,
+    excludedTerms,
+    highlightTerms,
+    objectTerms,
+  ) => {
+    const filenames = Search._index.filenames;
+    const docNames = Search._index.docnames;
+    const titles = Search._index.titles;
+    const allTitles = Search._index.alltitles;
+    const indexEntries = Search._index.indexentries;
+
+    // Collect multiple result groups to be sorted separately and then ordered.
+    // Each is an array of [docname, title, anchor, descr, score, filename, kind].
+    const normalResults = [];
+    const nonMainIndexResults = [];
+
+    _removeChildren(document.getElementById("search-progress"));
+
+    const queryLower = query.toLowerCase().trim();
+    for (const [title, foundTitles] of Object.entries(allTitles)) {
+      if (
+        title.toLowerCase().trim().includes(queryLower)
+        && queryLower.length >= title.length / 2
+      ) {
+        for (const [file, id] of foundTitles) {
+          const score = Math.round(
+            (Scorer.title * queryLower.length) / title.length,
+          );
+          const boost = titles[file] === title ? 1 : 0; // add a boost for document titles
+          normalResults.push([
+            docNames[file],
+            titles[file] !== title ? `${titles[file]} > ${title}` : title,
+            id !== null ? "#" + id : "",
+            null,
+            score + boost,
+            filenames[file],
+            SearchResultKind.title,
+          ]);
+        }
+      }
+    }
+
+    // search for explicit entries in index directives
+    for (const [entry, foundEntries] of Object.entries(indexEntries)) {
+      if (entry.includes(queryLower) && queryLower.length >= entry.length / 2) {
+        for (const [file, id, isMain] of foundEntries) {
+          const score = Math.round((100 * queryLower.length) / entry.length);
+          const result = [
+            docNames[file],
+            titles[file],
+            id ? "#" + id : "",
+            null,
+            score,
+            filenames[file],
+            SearchResultKind.index,
+          ];
+          if (isMain) {
+            normalResults.push(result);
+          } else {
+            nonMainIndexResults.push(result);
+          }
+        }
+      }
+    }
+
+    // lookup as object
+    objectTerms.forEach((term) =>
+      normalResults.push(...Search.performObjectSearch(term, objectTerms)),
+    );
+
+    // lookup as search terms in fulltext
+    normalResults.push(
+      ...Search.performTermsSearch(searchTerms, excludedTerms),
+    );
+
+    // let the scorer override scores with a custom scoring function
+    if (Scorer.score) {
+      normalResults.forEach((item) => (item[4] = Scorer.score(item)));
+      nonMainIndexResults.forEach((item) => (item[4] = Scorer.score(item)));
+    }
+
+    // Sort each group of results by score and then alphabetically by name.
+    normalResults.sort(_orderResultsByScoreThenName);
+    nonMainIndexResults.sort(_orderResultsByScoreThenName);
+
+    // Combine the result groups in (reverse) order.
+    // Non-main index entries are typically arbitrary cross-references,
+    // so display them after other results.
+    let results = [...nonMainIndexResults, ...normalResults];
+
+    // remove duplicate search results
+    // note the reversing of results, so that in the case of duplicates, the highest-scoring entry is kept
+    let seen = new Set();
+    results = results.reverse().reduce((acc, result) => {
+      let resultStr = result
+        .slice(0, 4)
+        .concat([result[5]])
+        .map((v) => String(v))
+        .join(",");
+      if (!seen.has(resultStr)) {
+        acc.push(result);
+        seen.add(resultStr);
+      }
+      return acc;
+    }, []);
+
+    return results.reverse();
+  },
+
+  query: (query) => {
+    const [
+      searchQuery,
+      searchTerms,
+      excludedTerms,
+      highlightTerms,
+      objectTerms,
+    ] = Search._parseQuery(query);
+    const results = Search._performSearch(
+      searchQuery,
+      searchTerms,
+      excludedTerms,
+      highlightTerms,
+      objectTerms,
+    );
+
+    // for debugging
+    //Search.lastresults = results.slice();  // a copy
+    // console.info("search results:", Search.lastresults);
+
+    // print the results
+    _displayNextItem(results, results.length, searchTerms, highlightTerms);
+  },
+
+  /**
+   * search for object names
+   */
+  performObjectSearch: (object, objectTerms) => {
+    const filenames = Search._index.filenames;
+    const docNames = Search._index.docnames;
+    const objects = Search._index.objects;
+    const objNames = Search._index.objnames;
+    const titles = Search._index.titles;
+
+    const results = [];
+
+    const objectSearchCallback = (prefix, match) => {
+      const name = match[4];
+      const fullname = (prefix ? prefix + "." : "") + name;
+      const fullnameLower = fullname.toLowerCase();
+      if (fullnameLower.indexOf(object) < 0) return;
+
+      let score = 0;
+      const parts = fullnameLower.split(".");
+
+      // check for different match types: exact matches of full name or
+      // "last name" (i.e. last dotted part)
+      if (fullnameLower === object || parts.slice(-1)[0] === object)
+        score += Scorer.objNameMatch;
+      else if (parts.slice(-1)[0].indexOf(object) > -1)
+        score += Scorer.objPartialMatch; // matches in last name
+
+      const objName = objNames[match[1]][2];
+      const title = titles[match[0]];
+
+      // If more than one term searched for, we require other words to be
+      // found in the name/title/description
+      const otherTerms = new Set(objectTerms);
+      otherTerms.delete(object);
+      if (otherTerms.size > 0) {
+        const haystack = `${prefix} ${name} ${objName} ${title}`.toLowerCase();
+        if (
+          [...otherTerms].some((otherTerm) => haystack.indexOf(otherTerm) < 0)
+        )
+          return;
+      }
+
+      let anchor = match[3];
+      if (anchor === "") anchor = fullname;
+      else if (anchor === "-") anchor = objNames[match[1]][1] + "-" + fullname;
+
+      const descr = objName + _(", in ") + title;
+
+      // add custom score for some objects according to scorer
+      if (Scorer.objPrio.hasOwnProperty(match[2]))
+        score += Scorer.objPrio[match[2]];
+      else score += Scorer.objPrioDefault;
+
+      results.push([
+        docNames[match[0]],
+        fullname,
+        "#" + anchor,
+        descr,
+        score,
+        filenames[match[0]],
+        SearchResultKind.object,
+      ]);
+    };
+    Object.keys(objects).forEach((prefix) =>
+      objects[prefix].forEach((array) => objectSearchCallback(prefix, array)),
+    );
+    return results;
+  },
+
+  /**
+   * search for full-text terms in the index
+   */
+  performTermsSearch: (searchTerms, excludedTerms) => {
+    // prepare search
+    const terms = Search._index.terms;
+    const titleTerms = Search._index.titleterms;
+    const filenames = Search._index.filenames;
+    const docNames = Search._index.docnames;
+    const titles = Search._index.titles;
+
+    const scoreMap = new Map();
+    const fileMap = new Map();
+
+    // perform the search on the required terms
+    searchTerms.forEach((word) => {
+      const files = [];
+      // find documents, if any, containing the query word in their text/title term indices
+      // use Object.hasOwnProperty to avoid mismatching against prototype properties
+      const arr = [
+        {
+          files: terms.hasOwnProperty(word) ? terms[word] : undefined,
+          score: Scorer.term,
+        },
+        {
+          files: titleTerms.hasOwnProperty(word) ? titleTerms[word] : undefined,
+          score: Scorer.title,
+        },
+      ];
+      // add support for partial matches
+      if (word.length > 2) {
+        const escapedWord = _escapeRegExp(word);
+        if (!terms.hasOwnProperty(word)) {
+          Object.keys(terms).forEach((term) => {
+            if (term.match(escapedWord))
+              arr.push({ files: terms[term], score: Scorer.partialTerm });
+          });
+        }
+        if (!titleTerms.hasOwnProperty(word)) {
+          Object.keys(titleTerms).forEach((term) => {
+            if (term.match(escapedWord))
+              arr.push({ files: titleTerms[term], score: Scorer.partialTitle });
+          });
+        }
+      }
+
+      // no match but word was a required one
+      if (arr.every((record) => record.files === undefined)) return;
+
+      // found search word in contents
+      arr.forEach((record) => {
+        if (record.files === undefined) return;
+
+        let recordFiles = record.files;
+        if (recordFiles.length === undefined) recordFiles = [recordFiles];
+        files.push(...recordFiles);
+
+        // set score for the word in each file
+        recordFiles.forEach((file) => {
+          if (!scoreMap.has(file)) scoreMap.set(file, new Map());
+          const fileScores = scoreMap.get(file);
+          fileScores.set(word, record.score);
+        });
+      });
+
+      // create the mapping
+      files.forEach((file) => {
+        if (!fileMap.has(file)) fileMap.set(file, [word]);
+        else if (fileMap.get(file).indexOf(word) === -1)
+          fileMap.get(file).push(word);
+      });
+    });
+
+    // now check if the files don't contain excluded terms
+    const results = [];
+    for (const [file, wordList] of fileMap) {
+      // check if all requirements are matched
+
+      // as search terms with length < 3 are discarded
+      const filteredTermCount = [...searchTerms].filter(
+        (term) => term.length > 2,
+      ).length;
+      if (
+        wordList.length !== searchTerms.size
+        && wordList.length !== filteredTermCount
+      )
+        continue;
+
+      // ensure that none of the excluded terms is in the search result
+      if (
+        [...excludedTerms].some(
+          (term) =>
+            terms[term] === file
+            || titleTerms[term] === file
+            || (terms[term] || []).includes(file)
+            || (titleTerms[term] || []).includes(file),
+        )
+      )
+        break;
+
+      // select one (max) score for the file.
+      const score = Math.max(...wordList.map((w) => scoreMap.get(file).get(w)));
+      // add result to the result list
+      results.push([
+        docNames[file],
+        titles[file],
+        "",
+        null,
+        score,
+        filenames[file],
+        SearchResultKind.text,
+      ]);
+    }
+    return results;
+  },
+
+  /**
+   * helper function to return a node containing the
+   * search summary for a given text. keywords is a list
+   * of stemmed words.
+   */
+  makeSearchSummary: (htmlText, keywords, anchor) => {
+    const text = Search.htmlToText(htmlText, anchor);
+    if (text === "") return null;
+
+    const textLower = text.toLowerCase();
+    const actualStartPosition = [...keywords]
+      .map((k) => textLower.indexOf(k.toLowerCase()))
+      .filter((i) => i > -1)
+      .slice(-1)[0];
+    const startWithContext = Math.max(actualStartPosition - 120, 0);
+
+    const top = startWithContext === 0 ? "" : "...";
+    const tail = startWithContext + 240 < text.length ? "..." : "";
+
+    let summary = document.createElement("p");
+    summary.classList.add("context");
+    summary.textContent =
+      top + text.substr(startWithContext, 240).trim() + tail;
+
+    return summary;
+  },
+};
+
+_ready(Search.init);
--- a/build/html/_static/sphinx_highlight.js
+++ b/build/html/_static/sphinx_highlight.js
@ -0,0 +1,159 @@
+/* Highlighting utilities for Sphinx HTML documentation. */
+"use strict";
+
+const SPHINX_HIGHLIGHT_ENABLED = true;
+
+/**
+ * highlight a given string on a node by wrapping it in
+ * span elements with the given class name.
+ */
+const _highlight = (node, addItems, text, className) => {
+  if (node.nodeType === Node.TEXT_NODE) {
+    const val = node.nodeValue;
+    const parent = node.parentNode;
+    const pos = val.toLowerCase().indexOf(text);
+    if (
+      pos >= 0
+      && !parent.classList.contains(className)
+      && !parent.classList.contains("nohighlight")
+    ) {
+      let span;
+
+      const closestNode = parent.closest("body, svg, foreignObject");
+      const isInSVG = closestNode && closestNode.matches("svg");
+      if (isInSVG) {
+        span = document.createElementNS("http://www.w3.org/2000/svg", "tspan");
+      } else {
+        span = document.createElement("span");
+        span.classList.add(className);
+      }
+
+      span.appendChild(document.createTextNode(val.substr(pos, text.length)));
+      const rest = document.createTextNode(val.substr(pos + text.length));
+      parent.insertBefore(span, parent.insertBefore(rest, node.nextSibling));
+      node.nodeValue = val.substr(0, pos);
+      /* There may be more occurrences of search term in this node. So call this
+       * function recursively on the remaining fragment.
+       */
+      _highlight(rest, addItems, text, className);
+
+      if (isInSVG) {
+        const rect = document.createElementNS(
+          "http://www.w3.org/2000/svg",
+          "rect",
+        );
+        const bbox = parent.getBBox();
+        rect.x.baseVal.value = bbox.x;
+        rect.y.baseVal.value = bbox.y;
+        rect.width.baseVal.value = bbox.width;
+        rect.height.baseVal.value = bbox.height;
+        rect.setAttribute("class", className);
+        addItems.push({ parent: parent, target: rect });
+      }
+    }
+  } else if (node.matches && !node.matches("button, select, textarea")) {
+    node.childNodes.forEach((el) => _highlight(el, addItems, text, className));
+  }
+};
+const _highlightText = (thisNode, text, className) => {
+  let addItems = [];
+  _highlight(thisNode, addItems, text, className);
+  addItems.forEach((obj) =>
+    obj.parent.insertAdjacentElement("beforebegin", obj.target),
+  );
+};
+
+/**
+ * Small JavaScript module for the documentation.
+ */
+const SphinxHighlight = {
+  /**
+   * highlight the search words provided in localstorage in the text
+   */
+  highlightSearchWords: () => {
+    if (!SPHINX_HIGHLIGHT_ENABLED) return; // bail if no highlight
+
+    // get and clear terms from localstorage
+    const url = new URL(window.location);
+    const highlight =
+      localStorage.getItem("sphinx_highlight_terms")
+      || url.searchParams.get("highlight")
+      || "";
+    localStorage.removeItem("sphinx_highlight_terms");
+    // Update history only if '?highlight' is present; otherwise it
+    // clears text fragments (not set in window.location by the browser)
+    if (url.searchParams.has("highlight")) {
+      url.searchParams.delete("highlight");
+      window.history.replaceState({}, "", url);
+    }
+
+    // get individual terms from highlight string
+    const terms = highlight
+      .toLowerCase()
+      .split(/\s+/)
+      .filter((x) => x);
+    if (terms.length === 0) return; // nothing to do
+
+    // There should never be more than one element matching "div.body"
+    const divBody = document.querySelectorAll("div.body");
+    const body = divBody.length ? divBody[0] : document.querySelector("body");
+    window.setTimeout(() => {
+      terms.forEach((term) => _highlightText(body, term, "highlighted"));
+    }, 10);
+
+    const searchBox = document.getElementById("searchbox");
+    if (searchBox === null) return;
+    searchBox.appendChild(
+      document
+        .createRange()
+        .createContextualFragment(
+          '<p class="highlight-link">'
+            + '<a href="javascript:SphinxHighlight.hideSearchWords()">'
+            + _("Hide Search Matches")
+            + "</a></p>",
+        ),
+    );
+  },
+
+  /**
+   * helper function to hide the search marks again
+   */
+  hideSearchWords: () => {
+    document
+      .querySelectorAll("#searchbox .highlight-link")
+      .forEach((el) => el.remove());
+    document
+      .querySelectorAll("span.highlighted")
+      .forEach((el) => el.classList.remove("highlighted"));
+    localStorage.removeItem("sphinx_highlight_terms");
+  },
+
+  initEscapeListener: () => {
+    // only install a listener if it is really needed
+    if (!DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS) return;
+
+    document.addEventListener("keydown", (event) => {
+      // bail for input elements
+      if (BLACKLISTED_KEY_CONTROL_ELEMENTS.has(document.activeElement.tagName))
+        return;
+      // bail with special keys
+      if (event.shiftKey || event.altKey || event.ctrlKey || event.metaKey)
+        return;
+      if (
+        DOCUMENTATION_OPTIONS.ENABLE_SEARCH_SHORTCUTS
+        && event.key === "Escape"
+      ) {
+        SphinxHighlight.hideSearchWords();
+        event.preventDefault();
+      }
+    });
+  },
+};
+
+_ready(() => {
+  /* Do not call highlightSearchWords() when we are on the search page.
+   * It will highlight words from the *previous* search query.
+   */
+  if (typeof Search === "undefined") SphinxHighlight.highlightSearchWords();
+  SphinxHighlight.initEscapeListener();
+});
--- a/build/html/architecture.html
+++ b/build/html/architecture.html
@ -0,0 +1,139 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>Architecture (audit interview) &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="BAAs and DPAs when ciphertext has no host keys" href="baa-dpa.html" />
+    <link rel="prev" title="Peergos verification (what was actually audited)" href="verification.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="architecture-audit-interview">
+<h1>Architecture (audit interview)<a class="headerlink" href="#architecture-audit-interview" title="Link to this heading">¶</a></h1>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>Endpoint (keys stay here / HSM)
+    │  HPKE content (NPE suite)
+    │  routing: dest + subject in the clear
+    ▼
+Untrusted NATS (cannot read bodies)
+    │
+    ▼
+Verae DataCube chain (append-only hashes)
+    │  written through Peergos client
+    ▼
+Peergos cryptree (encrypted names, sizes, graph)
+    │  chunks → CID / hash
+    ▼
+IPFS  (distributed, hash-verified ciphertext)
+</pre></div>
+</div>
+<ul class="simple">
+<li><p><strong>At rest:</strong> Peergos cryptree + IPFS. Hosts with disk/backup see
+<strong>opaque hashed ciphertext</strong>, not PHI, if they lack keys.</p></li>
+<li><p><strong>In transit (NATS):</strong> HPKE-Base to directory public keys. Broker is
+honest-but-curious: destinations yes, bodies no.</p></li>
+<li><p><strong>Integrity:</strong> cube JSONL chain + dual hash + IPFS CID check on
+restore (re-fetch blocks, re-verify hashes — not a plaintext tape).</p></li>
+</ul>
+<p>NATS remains an untrusted router. Production E2E is NPE/HPKE.
+Passthrough means destination in the clear; the body is ciphertext.</p>
+<p>Live: <a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a> (public keys only).
+Controls: <a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+      <li>Previous: <a href="verification.html" title="previous chapter">Peergos verification (what was actually audited)</a></li>
+      <li>Next: <a href="baa-dpa.html" title="next chapter">BAAs and DPAs when ciphertext has no host keys</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/architecture.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/baa-dpa.html
+++ b/build/html/baa-dpa.html
@ -0,0 +1,181 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>BAAs and DPAs when ciphertext has no host keys &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="Audit-ready checklist" href="checklist.html" />
+    <link rel="prev" title="Architecture (audit interview)" href="architecture.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="baas-and-dpas-when-ciphertext-has-no-host-keys">
+<h1>BAAs and DPAs when ciphertext has no host keys<a class="headerlink" href="#baas-and-dpas-when-ciphertext-has-no-host-keys" title="Link to this heading">¶</a></h1>
+<p>This is <strong>guidance for an evidence pack</strong>, not legal advice.</p>
+<section id="the-operator-statement">
+<h2>The operator statement<a class="headerlink" href="#the-operator-statement" title="Link to this heading">¶</a></h2>
+<p>Data at rest lives in the <strong>encrypted Peergos cryptree</strong>. Restore uses
+<strong>distributed, hash-verified, encrypted IPFS blocks</strong>. Hosts and backup
+media see <strong>opaque blobs</strong> (and random CHAMP labels), not filenames, not
+PHI, not social graph — if keys never leave the client / customer HSM.</p>
+<p>That is <strong>true of the Peergos design</strong> (see <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>).
+It <strong>changes the BAA/DPA conversation</strong>. It does <strong>not</strong> auto-delete the
+need for contracts.</p>
+</section>
+<section id="hipaa-us-business-associate">
+<h2>HIPAA (US) — Business Associate<a class="headerlink" href="#hipaa-us-business-associate" title="Link to this heading">¶</a></h2>
+<p>A Business Associate is a person who <strong>creates, receives, maintains, or
+transmits ePHI</strong> for a covered entity.</p>
+<p><strong>Technical argument you can make (and should document):</strong></p>
+<ol class="arabic simple">
+<li><p>ePHI is encrypted <strong>before</strong> it leaves the endpoint (Peergos client /
+DataCube writer).</p></li>
+<li><p>The storage node, IPFS, disk, and backup hold <strong>ciphertext + hashes</strong>.</p></li>
+<li><p>Private keys <strong>do not</strong> reside on the storage host (customer HSM /
+client). Hash verification detects tampering.</p></li>
+<li><p>Therefore the host <strong>cannot maintain ePHI in intelligible form</strong>.</p></li>
+</ol>
+<p>HHS distinguishes <strong>conduits</strong> and parties that never have access to
+ePHI. Many programs still <strong>sign a BAA</strong> when a vendor touches
+infrastructure, because misconfiguration, support exports, or logs could
+later expose plaintext. OCR looks at <strong>your</strong> risk analysis.</p>
+<p><strong>Practical pack:</strong> risk analysis memo citing cryptree + IPFS hash checks
+ key custody; BAA <strong>or</strong> written determination that the vendor is
+<strong>not</strong> a BA because they cannot decrypt; list every party with
+disk/backup (ns1, IPFS cluster, offsite replica).</p>
+</section>
+<section id="gdpr-eu-uk-processor-vs-technical-measure">
+<h2>GDPR (EU/UK) — processor vs technical measure<a class="headerlink" href="#gdpr-eu-uk-processor-vs-technical-measure" title="Link to this heading">¶</a></h2>
+<p>Encrypted data can still be <strong>personal data</strong> if it is reasonably
+attributable (usernames, IPs, invoice identity). GDPR <strong>Art. 32</strong> lists
+encryption as a security measure.</p>
+<p>Peergos is designed so the <strong>server is an adversary</strong> for content and
+most metadata. EU-based <strong>independent pentests</strong> (Cure53 DE, ROS NL)
+evaluated that design. Processing location for <strong>self-host</strong> is <em>your</em>
+ns1 / customer region, not peergos.net’s Germany hosting, unless you use
+peergos.net.</p>
+<p>You may still need a <strong>DPA (Art. 28)</strong> with anyone who <strong>processes</strong>
+personal data (usernames, logs, billing). Ciphertext-only storage
+<strong>narrows</strong> the DPA’s technical annex.</p>
+</section>
+<section id="nats-operators">
+<h2>NATS operators<a class="headerlink" href="#nats-operators" title="Link to this heading">¶</a></h2>
+<p>NATS is an <strong>untrusted broker</strong>. Content is HPKE; destinations and
+subjects are in the clear. A NATS operator <strong>cannot</strong> read bodies without
+endpoint private keys; <strong>can</strong> see routing metadata; <strong>can</strong> drop/delay
+copy <strong>ciphertext</strong>. Treat like a transit provider: DPA/BAA depends on
+whether routing metadata is personal data in your jurisdiction.</p>
+</section>
+<section id="what-making-yourself-audit-ready-means">
+<h2>What “making yourself audit-ready” means<a class="headerlink" href="#what-making-yourself-audit-ready-means" title="Link to this heading">¶</a></h2>
+<p>You are <strong>not</strong> buying Peergos’s Cure53/ROS reports as <em>your</em> SOC 2.
+You are <strong>reusing</strong> those public evaluations as <strong>vendor/component
+assurance</strong>, then adding your scope, RoPA, key-custody, inspect k-of-n,
+admin-history, instance evidence, and contracts that match who can
+actually see plaintext.</p>
+</section>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">BAAs and DPAs when ciphertext has no host keys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#the-operator-statement">The operator statement</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#nats-operators">NATS operators</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+      <li>Previous: <a href="architecture.html" title="previous chapter">Architecture (audit interview)</a></li>
+      <li>Next: <a href="checklist.html" title="next chapter">Audit-ready checklist</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/baa-dpa.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/checklist.html
+++ b/build/html/checklist.html
@ -0,0 +1,186 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>Audit-ready checklist &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="How to use this pack" href="howto.html" />
+    <link rel="prev" title="BAAs and DPAs when ciphertext has no host keys" href="baa-dpa.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="audit-ready-checklist">
+<h1>Audit-ready checklist<a class="headerlink" href="#audit-ready-checklist" title="Link to this heading">¶</a></h1>
+<p>Use this as a working list. Check items only when <strong>evidence exists</strong>
+(screenshot, log export, signed policy, ticket). This list is not a
+certificate.</p>
+<section id="a-scope-and-data-map">
+<h2>A. Scope and data map<a class="headerlink" href="#a-scope-and-data-map" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Named legal entity and systems in scope (console, Drive, NATS, IPFS, ns1)</p></li>
+<li><p>Data-flow diagram: endpoint → HPKE/NATS → cryptree/IPFS</p></li>
+<li><p>What is PHI / personal data vs ciphertext vs routing metadata</p></li>
+<li><p>Peergos verification chapter attached (<a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>)</p></li>
+</ul>
+</section>
+<section id="b-keys-and-encryption">
+<h2>B. Keys and encryption<a class="headerlink" href="#b-keys-and-encryption" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Customer holds Peergos/Drive keys; not on storage host</p></li>
+<li><p>NPE/HPKE endpoint keys in directory; private 0600; no xor content</p></li>
+<li><p>Signed Ed25519 config; unsigned rejected; admin-history prev+new+diff</p></li>
+<li><p>HSM or documented lab-to-HSM path</p></li>
+</ul>
+</section>
+<section id="c-access">
+<h2>C. Access<a class="headerlink" href="#c-access" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Console <code class="docutils literal notranslate"><span class="pre">PFC_REQUIRE_AUTH=1</span></code>, TOTP; Drive login separate</p></li>
+<li><p>Inspect k-of-n; author is not an officer; log-before-reveal</p></li>
+<li><p>Joiner / mover / leaver for console users</p></li>
+<li><p>Google SSO does <strong>not</strong> unwrap cubes</p></li>
+</ul>
+</section>
+<section id="d-integrity-and-backup">
+<h2>D. Integrity and backup<a class="headerlink" href="#d-integrity-and-backup" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Cube chain append-only JSONL; dual hash</p></li>
+<li><p>Hash registry: first SHA-256 and receipt win</p></li>
+<li><p>Peergos/IPFS: hash-verified encrypted blocks (restore = re-fetch CIDs)</p></li>
+<li><p>Restore test: recover a cube from content-addressed ciphertext without
+plaintext backup tapes</p></li>
+</ul>
+</section>
+<section id="e-logging">
+<h2>E. Logging<a class="headerlink" href="#e-logging" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Inspect audit events</p></li>
+<li><p>SM summaries: codes + lookup_id only (no bodies)</p></li>
+<li><p>Admin-history cube for config</p></li>
+</ul>
+</section>
+<section id="f-contracts-counsel">
+<h2>F. Contracts (counsel)<a class="headerlink" href="#f-contracts-counsel" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Written BA / not-a-BA determination for disk, VM, backup, IPFS</p></li>
+<li><p>DPA Art. 28 where usernames/logs/IPs are processed</p></li>
+<li><p>NATS operator: metadata vs content in the annex</p></li>
+<li><p>Peergos component assurance: attach Cure53 2019 + ROS 2024 PDFs
+(public; not your org’s ISO/SOC report)</p></li>
+</ul>
+</section>
+<section id="g-independent-audit-of-you">
+<h2>G. Independent audit of <em>you</em><a class="headerlink" href="#g-independent-audit-of-you" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>SOC 2 Type I/II engagement <strong>or</strong> ISO 27001 registrar <strong>or</strong> HIPAA
+risk analysis + policies (pick the program you actually need)</p></li>
+<li><p>Evidence window (Type II / surveillance) if applicable</p></li>
+</ul>
+</section>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Audit-ready checklist</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#a-scope-and-data-map">A. Scope and data map</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#b-keys-and-encryption">B. Keys and encryption</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#c-access">C. Access</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#d-integrity-and-backup">D. Integrity and backup</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#e-logging">E. Logging</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#f-contracts-counsel">F. Contracts (counsel)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#g-independent-audit-of-you">G. Independent audit of <em>you</em></a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+      <li>Previous: <a href="baa-dpa.html" title="previous chapter">BAAs and DPAs when ciphertext has no host keys</a></li>
+      <li>Next: <a href="howto.html" title="next chapter">How to use this pack</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/checklist.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/genindex.html
+++ b/build/html/genindex.html
@ -0,0 +1,106 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Index &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="#" />
+    <link rel="search" title="Search" href="search.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+
+<h1 id="index">Index</h1>
+
+<div class="genindex-jumpbox">
+ 
+</div>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/howto.html
+++ b/build/html/howto.html
@ -0,0 +1,130 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>How to use this pack &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="prev" title="Audit-ready checklist" href="checklist.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="how-to-use-this-pack">
+<h1>How to use this pack<a class="headerlink" href="#how-to-use-this-pack" title="Link to this heading">¶</a></h1>
+<ol class="arabic simple">
+<li><p>Read <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a> so you do not over-claim Peergos audits.</p></li>
+<li><p>Fill <a class="reference internal" href="checklist.html"><span class="doc">Audit-ready checklist</span></a> with <strong>your</strong> instance evidence (ns1, keys, users).</p></li>
+<li><p>Give <a class="reference internal" href="baa-dpa.html"><span class="doc">BAAs and DPAs when ciphertext has no host keys</span></a> to counsel with the data-flow from <a class="reference internal" href="architecture.html"><span class="doc">Architecture (audit interview)</span></a>.</p></li>
+<li><p>Point auditors at live technical surfaces (do not give them private keys).</p></li>
+</ol>
+<ul class="simple">
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a> (public keys only)</p></li>
+<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
+<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/custody.html">https://docs.pfc.georgelambert.org/custody.html</a></p></li>
+<li><p>Peergos Drive (cryptree) on your host</p></li>
+<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/peergos-for-compliance">https://git.georgelambert.org/marchon/peergos-for-compliance</a></p></li>
+<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/system-git-sync">https://git.georgelambert.org/marchon/system-git-sync</a></p></li>
+<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/secure-messaging">https://git.georgelambert.org/marchon/secure-messaging</a></p></li>
+</ul>
+<ol class="arabic simple" start="5">
+<li><p>Attach the two <strong>public</strong> Peergos pentest PDFs from the Peergos
+<code class="docutils literal notranslate"><span class="pre">audits/</span></code> tree as <strong>vendor security evaluations</strong>, labeled “not our
+SOC 2 / ISO certificate”.</p></li>
+</ol>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul class="current">
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1 current"><a class="current reference internal" href="#">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+      <li>Previous: <a href="checklist.html" title="previous chapter">Audit-ready checklist</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/howto.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/index.html
+++ b/build/html/index.html
@ -0,0 +1,173 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>Making yourself audit-ready with Verae DataCubes &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="Peergos verification (what was actually audited)" href="verification.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="making-yourself-audit-ready-with-verae-datacubes">
+<h1>Making yourself audit-ready with Verae DataCubes<a class="headerlink" href="#making-yourself-audit-ready-with-verae-datacubes" title="Link to this heading">¶</a></h1>
+<p>How to <strong>prepare an organization</strong> for HIPAA-aligned, SOC 2, or ISO 27001
+work using Verae DataCubes on <strong>Peergos</strong> (encrypted cryptree + hashed
+IPFS) and HPKE on an <strong>untrusted NATS</strong> broker.</p>
+<p><strong>This document is not a HIPAA, SOC 2, or ISO certificate.</strong>
+Peergos’s public pentests are <strong>not</strong> your Type II or ISO registrar
+certificate. They are <strong>component security evaluations</strong> you can attach.</p>
+<div class="toctree-wrapper compound">
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#claim-to-check">Claim to check</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#independent-security-audits-europe">Independent security audits (Europe)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#eu-funding-nlnet">EU funding / NLnet</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#hosted-instance-location">Hosted instance location</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#encrypted-filesystem-hashed-ipfs-design">Encrypted filesystem + hashed IPFS (design)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="verification.html#not-verified-do-not-claim">Not verified / do not claim</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#the-operator-statement">The operator statement</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#hipaa-us-business-associate">HIPAA (US) — Business Associate</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#gdpr-eu-uk-processor-vs-technical-measure">GDPR (EU/UK) — processor vs technical measure</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#nats-operators">NATS operators</a></li>
+<li class="toctree-l2"><a class="reference internal" href="baa-dpa.html#what-making-yourself-audit-ready-means">What “making yourself audit-ready” means</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#a-scope-and-data-map">A. Scope and data map</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#b-keys-and-encryption">B. Keys and encryption</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#c-access">C. Access</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#d-integrity-and-backup">D. Integrity and backup</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#e-logging">E. Logging</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#f-contracts-counsel">F. Contracts (counsel)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="checklist.html#g-independent-audit-of-you">G. Independent audit of <em>you</em></a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+</div>
+<section id="what-we-verified-about-peergos-eu">
+<h2>What we verified about Peergos (EU)<a class="headerlink" href="#what-we-verified-about-peergos-eu" title="Link to this heading">¶</a></h2>
+<p>See the full sourced table in <a class="reference internal" href="verification.html"><span class="doc">Peergos verification (what was actually audited)</span></a>.</p>
+<ul class="simple">
+<li><p>Encrypted client-side filesystem (cryptree); keys not on the storage
+server — <strong>yes</strong> (Peergos book + Cure53 design review).</p></li>
+<li><p>IPFS blocks content-addressed; Peergos verifies hashes — <strong>yes</strong>.</p></li>
+<li><p>Independent <strong>EU</strong> security audits, reports published — <strong>yes, two:</strong>
+Cure53 Berlin (2019); Radically Open Security Amsterdam (2024).</p></li>
+<li><p>“Peergos is HIPAA/SOC 2/ISO certified” — <strong>no.</strong> Those audits are
+pentest/code/design reviews, not management-system certificates.</p></li>
+</ul>
+<p>Peergos <strong>was designed as a trust-minimized encrypted filesystem</strong>,
+<strong>evaluated in Europe</strong> by two specialist firms, with <strong>public reports</strong>.
+That supports the <strong>at-rest / backup</strong> story. It does <strong>not</strong> finish
+<em>your</em> audit.</p>
+<p>Live technical surfaces:</p>
+<ul class="simple">
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/health">https://pfc.georgelambert.org/health</a></p></li>
+<li><p><a class="reference external" href="https://pfc.georgelambert.org/v1/npe/keys">https://pfc.georgelambert.org/v1/npe/keys</a></p></li>
+<li><p><a class="reference external" href="https://docs.pfc.georgelambert.org/controls.html">https://docs.pfc.georgelambert.org/controls.html</a></p></li>
+<li><p><a class="reference external" href="https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes">https://git.georgelambert.org/marchon/peergos-making-yourself-audit-ready-with-verae-datacubes</a></p></li>
+</ul>
+<p>Companion system docs (HTML): <a class="reference external" href="https://docs.pfc.georgelambert.org/">https://docs.pfc.georgelambert.org/</a></p>
+</section>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="#">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="#">Documentation overview</a><ul>
+      <li>Next: <a href="verification.html" title="next chapter">Peergos verification (what was actually audited)</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/index.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/nats-service-endpoints.pdf
+++ b/build/html/nats-service-endpoints.pdf
--- a/build/html/objects.inv
+++ b/build/html/objects.inv
--- a/build/html/peergos-for-compliance.pdf
+++ b/build/html/peergos-for-compliance.pdf
--- a/build/html/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf
+++ b/build/html/peergos-making-yourself-audit-ready-with-verae-datacubes.pdf
--- a/build/html/search.html
+++ b/build/html/search.html
@ -0,0 +1,124 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Search &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <script src="_static/searchtools.js"></script>
+    <script src="_static/language_data.js"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="#" />
+    <script src="searchindex.js" defer="defer"></script>
+    <meta name="robots" content="noindex" />
+    
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <h1 id="search-documentation">Search</h1>
+  
+  <noscript>
+  <div class="admonition warning">
+  <p>
+    Please activate JavaScript to enable the search
+    functionality.
+  </p>
+  </div>
+  </noscript>
+  
+  
+  <p>
+    Searching for multiple words only shows matches that contain
+    all words.
+  </p>
+  
+  
+  <form action="" method="get">
+    <input type="text" name="q" aria-labelledby="search-documentation" value="" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
+    <input type="submit" value="search" />
+    <span id="search-progress" style="padding-left: 10px"></span>
+  </form>
+  
+  
+  <div id="search-results"></div>
+  
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+<h3>Navigation</h3>
+<ul>
+<li class="toctree-l1"><a class="reference internal" href="verification.html">Peergos verification (what was actually audited)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+    </div>
+
+    
+
+    
+  </body>
+</html>
--- a/build/html/searchindex.js
+++ b/build/html/searchindex.js
--- a/build/html/secure-messaging.pdf
+++ b/build/html/secure-messaging.pdf
--- a/build/html/verification.html
+++ b/build/html/verification.html
@ -0,0 +1,195 @@
+<!DOCTYPE html>
+
+<html lang="en" data-content_root="./">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
+
+    <title>Peergos verification (what was actually audited) &#8212; Making yourself audit-ready with Verae DataCubes</title>
+    <link rel="stylesheet" type="text/css" href="_static/pygments.css?v=5ecbeea2" />
+    <link rel="stylesheet" type="text/css" href="_static/basic.css?v=b08954a9" />
+    <link rel="stylesheet" type="text/css" href="_static/alabaster.css?v=27fed22d" />
+    <script src="_static/documentation_options.js?v=5929fcd5"></script>
+    <script src="_static/doctools.js?v=fd6eb6e6"></script>
+    <script src="_static/sphinx_highlight.js?v=6ffebe34"></script>
+    <link rel="index" title="Index" href="genindex.html" />
+    <link rel="search" title="Search" href="search.html" />
+    <link rel="next" title="Architecture (audit interview)" href="architecture.html" />
+    <link rel="prev" title="Making yourself audit-ready with Verae DataCubes" href="index.html" />
+   
+  <link rel="stylesheet" href="_static/custom.css" type="text/css" />
+  
+
+  
+  
+
+  </head><body>
+  
+
+    <div class="document">
+      <div class="documentwrapper">
+        <div class="bodywrapper">
+          
+
+          <div class="body" role="main">
+            
+  <section id="peergos-verification-what-was-actually-audited">
+<h1>Peergos verification (what was actually audited)<a class="headerlink" href="#peergos-verification-what-was-actually-audited" title="Link to this heading">¶</a></h1>
+<p>This chapter records <strong>sourced</strong> facts. It does <strong>not</strong> turn Peergos, Verae,
+or DataCubes into a HIPAA, SOC 2, or ISO 27001 certificate.</p>
+<section id="claim-to-check">
+<h2>Claim to check<a class="headerlink" href="#claim-to-check" title="Link to this heading">¶</a></h2>
+<p>Data at rest is stored in an encrypted append-only Peergos filesystem;
+backup/restore is managed via a distributed, hashed, encrypted Peergos
+IPFS system, designed and evaluated in the EU as an audited secure
+filesystem.</p>
+</section>
+<section id="independent-security-audits-europe">
+<h2>Independent security audits (Europe)<a class="headerlink" href="#independent-security-audits-europe" title="Link to this heading">¶</a></h2>
+<p><strong>2019 — Cure53 (Berlin, Germany).</strong>
+Pentest, source-code audit, <strong>crypto/design review</strong> (May–June 2019).
+No fundamental architectural or cryptographic problems; issues fixed.
+Cure53: the platform <strong>passed this evaluation</strong>.</p>
+<p><strong>2024 — Radically Open Security B.V. (Amsterdam, Netherlands).</strong>
+Crystal-box pentest + code audit of Peergos web-ui (Sep–Nov 2024).
+<strong>0</strong> extreme / high / elevated; <strong>2</strong> moderate, <strong>6</strong> low; Peergos
+states all fixed; no data exposure or integrity compromise (mostly UI
+crashes).</p>
+<p>Both firms are <strong>EU-based</strong>. Both full reports are <strong>public</strong>. That is a
+<strong>security evaluation of the Peergos protocol/implementation</strong>, not a
+HIPAA/SOC 2/ISO management-system certificate.</p>
+<p>Primary sources:</p>
+<ul class="simple">
+<li><p><a class="reference external" href="https://peergos.org/posts/security-audit">https://peergos.org/posts/security-audit</a></p></li>
+<li><p><a class="reference external" href="https://cure53.de/pentest-report_peergos.pdf">https://cure53.de/pentest-report_peergos.pdf</a></p></li>
+<li><p><a class="reference external" href="https://peergos.org/posts/security-audit-2024">https://peergos.org/posts/security-audit-2024</a></p></li>
+<li><p><a class="reference external" href="https://github.com/Peergos/Peergos/tree/master/audits">https://github.com/Peergos/Peergos/tree/master/audits</a></p></li>
+</ul>
+</section>
+<section id="eu-funding-nlnet">
+<h2>EU funding / NLnet<a class="headerlink" href="#eu-funding-nlnet" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>Peergos received funding from the <strong>European Union Horizon 2020</strong>
+programme under <strong>NGI-POINTER</strong>, grant <strong>871528</strong> (stated on the 2024
+audit post).</p></li>
+<li><p>The 2024 audit was supported by <strong>NLnet</strong> (Netherlands).</p></li>
+</ul>
+</section>
+<section id="hosted-instance-location">
+<h2>Hosted instance location<a class="headerlink" href="#hosted-instance-location" title="Link to this heading">¶</a></h2>
+<p>Peergos’s hosted privacy notice states peergos.net uses servers in
+<strong>Germany</strong>. <strong>Self-hosted ns1 / customer cryptree is a different
+processing location</strong> and must be documented in <em>your</em> RoPA / BAA pack.</p>
+</section>
+<section id="encrypted-filesystem-hashed-ipfs-design">
+<h2>Encrypted filesystem + hashed IPFS (design)<a class="headerlink" href="#encrypted-filesystem-hashed-ipfs-design" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p><strong>Cryptree</strong>: tree of symmetric keys; fine-grained read/write caps;
+sibling names hidden; writes <strong>signed</strong>.</p></li>
+<li><p><strong>Chunks</strong>: up to 5 MiB, padded, independently encrypted
+(Salsa20-Poly1305); random 256-bit keys (not convergent).</p></li>
+<li><p><strong>IPFS</strong>: content-addressed blocks. Peergos <strong>verifies the hash</strong> of
+every block read from or written to IPFS. Clients verify hashes and
+signatures from a Peergos server.</p></li>
+<li><p><strong>CHAMP</strong>: encrypted cryptree nodes under <strong>random 32-byte labels</strong>.</p></li>
+<li><p>Sharing: hybrid <strong>X25519 + ML-KEM-1024</strong>.</p></li>
+</ul>
+<p>“Append-only” in Verae DataCubes is the <strong>cube chain JSONL</strong> (application
+integrity). Peergos uses signed updates and immutable blocks. Do not
+conflate the two layers in an audit interview.</p>
+</section>
+<section id="not-verified-do-not-claim">
+<h2>Not verified / do not claim<a class="headerlink" href="#not-verified-do-not-claim" title="Link to this heading">¶</a></h2>
+<ul class="simple">
+<li><p>“Peergos is HIPAA certified” — <strong>false.</strong> HIPAA is not a product certificate.</p></li>
+<li><p>“Peergos is SOC 2 / ISO 27001 certified” — <strong>not shown.</strong> Published
+work is pentest/code audit, not Type II or ISO registrar.</p></li>
+<li><p>“EU certified Peergos as a government-standard filesystem” —
+<strong>overstated.</strong> What exists: EU grant funding, NLNet-funded ROS
+pentest, Cure53 Berlin design+code audit.</p></li>
+<li><p>“Hosts with disk/backup never need a BAA/DPA” — <strong>legal conclusion,
+not a technical fact.</strong> See <a class="reference internal" href="baa-dpa.html"><span class="doc">BAAs and DPAs when ciphertext has no host keys</span></a>.</p></li>
+</ul>
+</section>
+</section>
+
+
+          </div>
+          
+        </div>
+      </div>
+      <div class="sphinxsidebar" role="navigation" aria-label="Main">
+        <div class="sphinxsidebarwrapper">
+<h1 class="logo"><a href="index.html">Making yourself audit-ready with Verae DataCubes</a></h1>
+
+
+
+
+
+
+
+
+
+<search id="searchbox" style="display: none" role="search">
+    <div class="searchformwrapper">
+    <form class="search" action="search.html" method="get">
+      <input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" placeholder="Search"/>
+      <input type="submit" value="Go" />
+    </form>
+    </div>
+</search>
+<script>document.getElementById('searchbox').style.display = "block"</script><h3>Navigation</h3>
+<ul class="current">
+<li class="toctree-l1 current"><a class="current reference internal" href="#">Peergos verification (what was actually audited)</a><ul>
+<li class="toctree-l2"><a class="reference internal" href="#claim-to-check">Claim to check</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#independent-security-audits-europe">Independent security audits (Europe)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#eu-funding-nlnet">EU funding / NLnet</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#hosted-instance-location">Hosted instance location</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#encrypted-filesystem-hashed-ipfs-design">Encrypted filesystem + hashed IPFS (design)</a></li>
+<li class="toctree-l2"><a class="reference internal" href="#not-verified-do-not-claim">Not verified / do not claim</a></li>
+</ul>
+</li>
+<li class="toctree-l1"><a class="reference internal" href="architecture.html">Architecture (audit interview)</a></li>
+<li class="toctree-l1"><a class="reference internal" href="baa-dpa.html">BAAs and DPAs when ciphertext has no host keys</a></li>
+<li class="toctree-l1"><a class="reference internal" href="checklist.html">Audit-ready checklist</a></li>
+<li class="toctree-l1"><a class="reference internal" href="howto.html">How to use this pack</a></li>
+</ul>
+
+<div class="relations">
+<h3>Related Topics</h3>
+<ul>
+  <li><a href="index.html">Documentation overview</a><ul>
+      <li>Previous: <a href="index.html" title="previous chapter">Making yourself audit-ready with Verae DataCubes</a></li>
+      <li>Next: <a href="architecture.html" title="next chapter">Architecture (audit interview)</a></li>
+  </ul></li>
+</ul>
+</div>
+
+
+
+
+
+
+
+
+        </div>
+      </div>
+      <div class="clearer"></div>
+    </div>
+    <div class="footer">
+      &#169;2026, Verae.
+      
+      |
+      Powered by <a href="https://www.sphinx-doc.org/">Sphinx 9.1.0</a>
+      &amp; <a href="https://alabaster.readthedocs.io">Alabaster 1.0.0</a>
+      
+      |
+      <a href="_sources/verification.rst.txt"
+          rel="nofollow">Page source</a>
+    </div>
+
+    
+
+    
+  </body>
+</html>