marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
system-git-sync/Historical-Information.MD
George Lambert 548d9967d5
Some checks are pending
review / inventory (push) Waiting to run
Details
S27: deploy creates npe-dir endpoint keys and systemd KEYDIR
2026-09-15 23:43:11 -04:00

6.9 KiB
Raw Permalink Blame History

Historical-Information.MD

Instruction to any later agent: Continue without user interruption until every open item below is done, revalidated, and tested. Do not ask the operator for information. Use guesses in TODO-With-User.MD. Deploy validated code to ns1 70.88.205.138, replacing processes only when the replacement is tested. After a context reset: read this file first, then System-Git-Sync.MD, TODO.md, UserReview.MD, INVENTORY.md.

This is not a HIPAA/SOC 2/ISO certificate.

Operator intent (compressed)

  1. Secure messaging on untrusted NATS: passthrough (dest in the clear, body encrypted). Sender cannot reopen ciphertext; lookup_id only.
  2. Network Error Bundle: ct_sender (sender-only) + ct_system (system public key bounce report). Never log recipient plaintext.
  3. Signed Ed25519 config wrapper; unsigned files rejected. Admin changes append prev + new + unified diff to a Verae DataCube admin-history chain.
  4. Python (readable, commented) + Go (in-process NATS + leaf).
  5. Catalog repo nats-service-endpoints. Hub system-git-sync.
  6. Scan every Forgejo org. Websites = inventory only. verae org empty.
  7. ns1 sequence was docs → code → test → CI → deploy. Deploy is now in scope. Do not enable PFC_REQUIRE_NPE=1 on the live console unless the npe sidecar is actually present (fail-closed would take down pfc).
  8. Keep going until synced and interoperable. Re-run tests after deploy.

Forgejo

  • Host: https://git.georgelambert.org (Forgejo 11)
  • SSH: ssh://git@git.georgelambert.org:2223/marchon/<repo>.git (also git@git.georgelambert.org:marchon/<repo>.git)
  • Orgs: marchon (~61), infra (caddy, coredns), websites (70+), verae (0)
  • Token: osxkeychain for git.georgelambert.org user marchon

Live ns1 (do not break the console)

  • pfc-py-admin :18780 → https://pfc.georgelambert.org (PFC_REQUIRE_AUTH=1)
  • pfc-connector, pfc-peergos-bridge, pfc-py-ipfs :18782, Kubo :15001
  • pfc-configd :18781
  • NATS leaf hub nats://10.10.10.21:7422 (also written nats-leaf://)
  • Docs: /opt/pfc/docs/html, https://docs.pfc.georgelambert.org
  • Secrets: /opt/pfc/etc/admin.env, /opt/pfc/etc/peergos-bridge.env
  • Do not replace pfc-py-admin with Go pfc-admin (Go HTTP was disabled on purpose). Add sm-leaf alongside.

Repos created this program

Design locks

See System-Git-Sync.MD table. Config keys: crypto.mode, routing.mode, admin.history_cube, crypto.system_key_id, logging.mode.

Open items (execute in order)

Update checkboxes in TODO.md as each is done.

  1. Historical file committed (this file)
  2. Expand sm-leaf health HTTP + sm subjects; linux/amd64 build
  3. cicd/deploy-ns1.sh: test then rsync; never skip tests
  4. Generate Ed25519 config keys on ns1; signed config + admin-history
  5. Install secure-messaging Python under /opt/pfc/python/secure_messaging
  6. systemd pfc-sm-leaf.service; loopback health
  7. Point pfc-py-admin PYTHONPATH at secure-messaging; optional signed config
  8. Caddy/docs: hub + endpoints HTML/PDF under docs.pfc
  9. Smoke: pfc health 200, sm-leaf health, signed config load, PFC tests
  10. Promote SHA in cicd/GATE.md
  11. Re-run cicd/run-review.sh; second doc sync (after ns1)
  12. NPE live: binary exists at /opt/pfc/bin/npe; PFC_REQUIRE_NPE left unset (bus still lab-xor; fail-closed would take down the console). Cutover remains UserReview.
  13. Websites org: no NATS code; inventory remains complete
  14. Push all git remotes; close S15

ns1 validation (2026-09-16)

  • Local review: PFC 25/25, SM 5/5, Go leaf OK, catalog subjects OK (twice).
  • Host: pfc-py-admin, pfc-sm-leaf, pfc-connector, pfc-peergos-bridge active.
  • GET http://127.0.0.1:18783/health → {"ok":true,"service":"sm-leaf"}
  • GET https://pfc.georgelambert.org/health → 200 (ipfs 200, replication 200 pfc-repl-go)
  • GET /v1/admin/config unauthenticated → 401
  • Signed wrapper crypto.mode=lab-xor routing.mode=passthrough verifies on host
  • Admin-history seq 0 actor deploy-ns1 has prev + new + unified diff
  • Host SM tests (signed/tamper, lab-xor, NPE fail-closed, error bundle, history) OK
  • Docs: /sync/index.html 200, /sync/Historical-Information.MD 200, /nats-service-endpoints/ 200 + PDF
  • Promoted SHAs: secure-messaging f4da7ff, peergos-for-compliance 2c45603, admin c46d494, nats-service-endpoints 1d01768, system-git-sync c570dc1/d9bd1fd

S15 closed. Remaining UserReview only: NPE cutover, HSM custody, optional sync.pfc hostname, website deep-links.

S16–S24 (this round)

Continue-until-done plan: Remaining-Work.MD. Per-repo MODULE.md (who calls, from/to, filters, errors/timeouts, storage). Catalog 44/44 subjects.json with timeout_sec + filter. Python+Go success/failure NATS send tests. UI screenshots in peergos-compliance-docs source/_static/screens/ + walkthrough.rst. HTML+PDF rebuilt. cicd/run-review.sh REVIEW PASS (PFC 25, SM 8 including router, Go leaf reject paths, catalog covers subjects.json).

After a context reset: read this file, then Remaining-Work.MD.

S25 (UserReview leftovers)

  • HSM custody: docs/HSM-CUSTODY.md + rotate_config_key.py. Private keys stay on host.
  • NPE: adapter uses real npe send|keygen CLI. GET /v1/npe probe. PFC_REQUIRE_NPE remains unset.
  • sync.pfc.georgelambert.org Caddy (DNS already pointed at 138).
  • Deep links: console footer, hub links.html, https://georgelambert.org/pfc/ (one page; 70 website repos not rewritten).

S26 (certification-ready controls, still not a certificate)

  • NATS remains untrusted. Bodies: pfc-lab-xor with host PSK (PFC_NATS_KEY + PFC_FORBID_PLAIN=1). Python and Go envelopes round-trip the same vector. Production E2E remains NPE/HPKE (PFC_REQUIRE_NPE still unset).
  • PDFs link to sibling PDFs (nats-service-endpoints.pdf, secure-messaging.pdf, peergos-for-compliance.pdf) — no .md hrefs.
  • Controls / custody / variables chapters in the system PDF.

S27 NPE/HPKE content + public-key directory

  • Content: HPKE-Base only. sm-leaf rejects lab-xor / plain-lab.
  • Directory: /opt/pfc/etc/npe-dir public JSON + private 0600. GET /v1/npe/keys lists public keys for every E2E service.
  • Clear on NATS: routing + error codes only. Content never in JSON.
  • WAN NATS 4222 remains token-gated public-edge (not open). PFC uses internal 10.10.10.21:4222.

Go pfc-repl now serves loopback GET 127.0.0.1:18784/health; admin PFC_REPL_URL points there. Ingest replicas a/b do not bind HTTP.

Do not

  • Enable PFC_REQUIRE_NPE=1 if npe is missing
  • Expose 4222/7422/5001 on WAN
  • Commit private keys
  • Rewrite 70 website repos
  • Ask the operator questions