S00-S04: hub inventory, signed-config design, prompts saved

TODO-With-User.MD

@@ -0,0 +1,22 @@
+# TODO-With-User
+
+Blocks plus **Guesses and Assumptions**. Work continues around these.
+
+## Guesses and assumptions
+
+- **Orgs in scope for code:** `marchon` NATS/PFC repos. `infra` docs only. `websites` inventory only. `verae` org empty.
+- **System key:** generate lab Ed25519 signing key + X25519 system box key; private files gitignored; public keys in signed config payload.
+- **Passthrough:** NATS subject and `to` mailbox id are in the clear; ciphertext is HPKE (prod) or lab-xor (lab).
+- **Lookup ID:** HMAC-SHA256 of sender identity with a per-message nonce; not reversible from the broker.
+- **Error bundle:** two ciphertexts: `ct_sender` (NaCl/X25519 box to sender) and `ct_system` (box to system key) containing bounce metadata **without** recipient payload.
+- **DataCube history:** JSONL chain compatible with `pfc.chain.Chain` so a real cube can ingest it; lab can run without Peergos FUSE.
+- **CI:** Forgejo Actions (`ubuntu-latest`). If runners are missing, the YAML still documents the review gate.
+- **ns1:** no binary deploy until a green CI run is recorded. Docs HTML may be copied to `/opt/pfc/docs/` as documentation-only.
+- **Python comments:** every executable line in `secure_messaging/` has a trailing or preceding comment.
+- **Go:** in-process `nats-server` leaf to `nats-a:7422` when `SM_LEAF_HUB` is set; otherwise in-memory only for tests.
+
+## Open blocks (workaround in place)
+
+- No HSM on the laptop — lab keys only.
+- Central Verae timestamp leaf may be down — `local-dual` receipts already used by PFC; same here for error timestamps.
+- Cannot rewrite 70 website repos meaningfully this round.