Passthrough envelopes, signed config, DataCube admin history, error bundles (Python+Go)

Find a file

George Lambert 43cbf51d3e Some checks are pending ci / python (push) Waiting to run Details ci / go (push) Waiting to run Details S17/S18: send success and failure routes; Sphinx HTML/PDF Python router + Go sm-leaf reject missing to, empty ct, plaintext body. Summary logs never include ciphertext. MODULE.md.		2026-09-15 23:10:15 -04:00
.forgejo/workflows	S06-S08: Python spec, Go in-process leaf, tests and Forgejo CI	2026-09-15 22:17:19 -04:00
build	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
deploy	S15: sm-leaf health HTTP, verae.sm.* acks, systemd unit	2026-09-15 22:40:50 -04:00
go	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
python/secure_messaging	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
scripts	S14: NPE fail-closed adapter; npe mode never falls back to lab-xor	2026-09-15 22:22:56 -04:00
source	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
tests	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
.gitignore	S06-S08: Python spec, Go in-process leaf, tests and Forgejo CI	2026-09-15 22:17:19 -04:00
LICENSE	S06-S08: Python spec, Go in-process leaf, tests and Forgejo CI	2026-09-15 22:17:19 -04:00
Makefile	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
MODULE.md	S17/S18: send success and failure routes; Sphinx HTML/PDF	2026-09-15 23:10:15 -04:00
README.md	S15: sm-leaf health HTTP, verae.sm.* acks, systemd unit	2026-09-15 22:40:50 -04:00
requirements.txt	S06-S08: Python spec, Go in-process leaf, tests and Forgejo CI	2026-09-15 22:17:19 -04:00

README.md

secure-messaging

Passthrough NATS envelopes, Ed25519 signed configuration, DataCube admin history, and Network Error Bundles.

Python spec: python/secure_messaging/ (line comments)
Go leaf: go/cmd/sm-leaf (in-process NATS + optional SM_LEAF_HUB)
Loopback health: SM_HTTP default 127.0.0.1:18783 (GET /health)
systemd: deploy/pfc-sm-leaf.service (does not replace pfc-py-admin)
Catalog: https://git.georgelambert.org/marchon/nats-service-endpoints
Hub: https://git.georgelambert.org/marchon/system-git-sync

Config must be a signed wrapper. Unsigned files are rejected. Admin changes append prev + new + unified diff to a kind=admin-history JSONL chain.

crypto.mode: npe | lab-xor | plain-lab (see signed payload). Live ns1 lab uses lab-xor until PFC_REQUIRE_NPE=1 is explicitly cut over.

Not a HIPAA/SOC 2/ISO certificate.