# TODO-With-User

Blocks plus **Guesses and Assumptions**. Work continues around these.

## Guesses and assumptions

- **Orgs in scope for code:** `marchon` NATS/PFC repos. `infra` docs only. `websites` inventory only. `verae` org empty.
- **System key:** generate lab Ed25519 signing key + X25519 system box key; private files gitignored; public keys in signed config payload.
- **Passthrough:** NATS subject and `to` mailbox id are in the clear; ciphertext is HPKE (prod) or lab-xor (lab).
- **Lookup ID:** HMAC-SHA256 of sender identity with a per-message nonce; not reversible from the broker.
- **Error bundle:** two ciphertexts: `ct_sender` (NaCl/X25519 box to sender) and `ct_system` (box to system key) containing bounce metadata **without** recipient payload.
- **DataCube history:** JSONL chain compatible with `pfc.chain.Chain` so a real cube can ingest it; lab can run without Peergos FUSE.
- **CI:** Forgejo Actions (`ubuntu-latest`). If runners are missing, the YAML still documents the review gate.
- **ns1:** no binary deploy until a green CI run is recorded. Docs HTML may be copied to `/opt/pfc/docs/` as documentation-only.
- **Python comments:** every executable line in `secure_messaging/` has a trailing or preceding comment.
- **Go:** in-process `nats-server` leaf to `nats-a:7422` when `SM_LEAF_HUB` is set; otherwise in-memory only for tests.

## Open blocks (workaround in place)

- No HSM on the laptop — lab keys only.
- Central Verae timestamp leaf may be down — `local-dual` receipts already used by PFC; same here for error timestamps.
- Cannot rewrite 70 website repos meaningfully this round.