# Thesaurus

Canonical term → where it lives. Use this to rename later.

| Term | Use this | Not this | Where |
|---|---|---|---|
| Untrusted broker | NATS | "secure bus" | nats-service-endpoints |
| Production E2E | NPE / HPKE | "TLS to NATS" | secure-messaging |
| Lab envelope | pfc-lab-xor | "xor cipher" alone | peergos-for-compliance |
| Dest in clear | passthrough | "plaintext message" | envelope.py |
| Sender handle | lookup_id | "from username on wire" | envelope.py |
| Config file | signed wrapper | raw JSON config | signed_config.py |
| Admin audit | DataCube admin-history | SQL log | admin_history.py |
| Failure to sender | ct_sender | "email bounce plaintext" | error_bundle.py |
| Ops bounce | ct_system / Network Error Bundle | "log the ciphertext body" | error_bundle.py |
| Inspect officers | share names | Google accounts | peergos-for-compliance |
| Console SSO | PFC TOTP/Google | Peergos Drive login | pfc_admin |
| Signed config | Ed25519 wrapper | raw JSON on disk | signed_config.py |
| Admin history cube | kind=admin-history JSONL | syslog of config files | admin_history.py |
| NPE sidecar | npe seal --to | HPKE in Python | npe_adapter.py |
| Review gate | cicd/GATE.md | auto-deploy to ns1 | system-git-sync |