135 lines
6.9 KiB
Markdown
135 lines
6.9 KiB
Markdown
# Historical-Information.MD
|
||
|
||
**Instruction to any later agent:** Continue without user interruption until
|
||
every open item below is done, revalidated, and tested. Do not ask the
|
||
operator for information. Use guesses in `TODO-With-User.MD`. Deploy
|
||
validated code to **ns1 `70.88.205.138`**, replacing processes only when
|
||
the replacement is tested. After a context reset: read **this file first**,
|
||
then `System-Git-Sync.MD`, `TODO.md`, `UserReview.MD`, `INVENTORY.md`.
|
||
|
||
This is **not** a HIPAA/SOC 2/ISO certificate.
|
||
|
||
## Operator intent (compressed)
|
||
|
||
1. Secure messaging on untrusted NATS: passthrough (dest in the clear, body
|
||
encrypted). Sender cannot reopen ciphertext; **lookup_id** only.
|
||
2. Network Error Bundle: `ct_sender` (sender-only) + `ct_system` (system
|
||
public key bounce report). Never log recipient plaintext.
|
||
3. Signed Ed25519 config wrapper; unsigned files rejected. Admin changes
|
||
append prev + new + unified diff to a Verae DataCube admin-history chain.
|
||
4. Python (readable, commented) + Go (in-process NATS + leaf).
|
||
5. Catalog repo `nats-service-endpoints`. Hub `system-git-sync`.
|
||
6. Scan every Forgejo org. Websites = inventory only. `verae` org empty.
|
||
7. ns1 sequence was docs → code → test → CI → **deploy**. Deploy is now in
|
||
scope. Do not enable `PFC_REQUIRE_NPE=1` on the live console unless the
|
||
`npe` sidecar is actually present (fail-closed would take down pfc).
|
||
8. Keep going until synced and interoperable. Re-run tests after deploy.
|
||
|
||
## Forgejo
|
||
|
||
- Host: https://git.georgelambert.org (Forgejo 11)
|
||
- SSH: `ssh://git@git.georgelambert.org:2223/marchon/<repo>.git` (also
|
||
`git@git.georgelambert.org:marchon/<repo>.git`)
|
||
- Orgs: `marchon` (~61), `infra` (caddy, coredns), `websites` (70+), `verae` (0)
|
||
- Token: osxkeychain for `git.georgelambert.org` user `marchon`
|
||
|
||
## Live ns1 (do not break the console)
|
||
|
||
- `pfc-py-admin` :18780 → https://pfc.georgelambert.org (`PFC_REQUIRE_AUTH=1`)
|
||
- `pfc-connector`, `pfc-peergos-bridge`, `pfc-py-ipfs` :18782, Kubo :15001
|
||
- `pfc-configd` :18781
|
||
- NATS leaf hub `nats://10.10.10.21:7422` (also written `nats-leaf://`)
|
||
- Docs: `/opt/pfc/docs/html`, https://docs.pfc.georgelambert.org
|
||
- Secrets: `/opt/pfc/etc/admin.env`, `/opt/pfc/etc/peergos-bridge.env`
|
||
- **Do not** replace `pfc-py-admin` with Go `pfc-admin` (Go HTTP was disabled
|
||
on purpose). Add `sm-leaf` alongside.
|
||
|
||
## Repos created this program
|
||
|
||
- https://git.georgelambert.org/marchon/system-git-sync
|
||
- https://git.georgelambert.org/marchon/nats-service-endpoints
|
||
- https://git.georgelambert.org/marchon/secure-messaging
|
||
|
||
## Design locks
|
||
|
||
See `System-Git-Sync.MD` table. Config keys: `crypto.mode`, `routing.mode`,
|
||
`admin.history_cube`, `crypto.system_key_id`, `logging.mode`.
|
||
|
||
## Open items (execute in order)
|
||
|
||
Update checkboxes in `TODO.md` as each is done.
|
||
|
||
1. [x] Historical file committed (this file)
|
||
2. [x] Expand `sm-leaf` health HTTP + sm subjects; linux/amd64 build
|
||
3. [x] `cicd/deploy-ns1.sh`: test then rsync; never skip tests
|
||
4. [x] Generate Ed25519 config keys **on ns1**; signed config + admin-history
|
||
5. [x] Install secure-messaging Python under `/opt/pfc/python/secure_messaging`
|
||
6. [x] systemd `pfc-sm-leaf.service`; loopback health
|
||
7. [x] Point `pfc-py-admin` PYTHONPATH at secure-messaging; optional signed config
|
||
8. [x] Caddy/docs: hub + endpoints HTML/PDF under docs.pfc
|
||
9. [x] Smoke: pfc health 200, sm-leaf health, signed config load, PFC tests
|
||
10. [x] Promote SHA in `cicd/GATE.md`
|
||
11. [x] Re-run `cicd/run-review.sh`; second doc sync (after ns1)
|
||
12. [x] NPE live: binary exists at `/opt/pfc/bin/npe`; **`PFC_REQUIRE_NPE` left unset** (bus still lab-xor; fail-closed would take down the console). Cutover remains UserReview.
|
||
13. [x] Websites org: no NATS code; inventory remains complete
|
||
14. [x] Push all git remotes; close S15
|
||
|
||
## ns1 validation (2026-09-16)
|
||
|
||
- Local review: PFC 25/25, SM 5/5, Go leaf OK, catalog subjects OK (twice).
|
||
- Host: `pfc-py-admin`, `pfc-sm-leaf`, `pfc-connector`, `pfc-peergos-bridge` active.
|
||
- `GET http://127.0.0.1:18783/health` → `{"ok":true,"service":"sm-leaf"}`
|
||
- `GET https://pfc.georgelambert.org/health` → 200 (ipfs 200, replication 200 `pfc-repl-go`)
|
||
- `GET /v1/admin/config` unauthenticated → 401
|
||
- Signed wrapper `crypto.mode=lab-xor` `routing.mode=passthrough` verifies on host
|
||
- Admin-history seq 0 actor `deploy-ns1` has prev + new + unified diff
|
||
- Host SM tests (signed/tamper, lab-xor, NPE fail-closed, error bundle, history) OK
|
||
- Docs: `/sync/index.html` 200, `/sync/Historical-Information.MD` 200, `/nats-service-endpoints/` 200 + PDF
|
||
- Promoted SHAs: secure-messaging `f4da7ff`, peergos-for-compliance `2c45603`,
|
||
admin `c46d494`, nats-service-endpoints `1d01768`, system-git-sync `c570dc1`/`d9bd1fd`
|
||
|
||
**S15 closed.** Remaining UserReview only: NPE cutover, HSM custody, optional `sync.pfc` hostname, website deep-links.
|
||
|
||
## S16–S24 (this round)
|
||
|
||
Continue-until-done plan: `Remaining-Work.MD`. Per-repo `MODULE.md` (who
|
||
calls, from/to, filters, errors/timeouts, storage). Catalog 44/44
|
||
subjects.json with `timeout_sec` + `filter`. Python+Go success/failure
|
||
NATS send tests. UI screenshots in peergos-compliance-docs
|
||
`source/_static/screens/` + `walkthrough.rst`. HTML+PDF rebuilt.
|
||
`cicd/run-review.sh` REVIEW PASS (PFC 25, SM 8 including router,
|
||
Go leaf reject paths, catalog covers subjects.json).
|
||
|
||
After a context reset: read this file, then `Remaining-Work.MD`.
|
||
|
||
## S25 (UserReview leftovers)
|
||
|
||
- HSM custody: `docs/HSM-CUSTODY.md` + `rotate_config_key.py`. Private keys stay on host.
|
||
- NPE: adapter uses real `npe send|keygen` CLI. `GET /v1/npe` probe. **`PFC_REQUIRE_NPE` remains unset.**
|
||
- `sync.pfc.georgelambert.org` Caddy (DNS already pointed at 138).
|
||
- Deep links: console footer, hub `links.html`, `https://georgelambert.org/pfc/` (one page; 70 website repos not rewritten).
|
||
|
||
## S26 (certification-ready controls, still not a certificate)
|
||
|
||
- NATS remains **untrusted**. Bodies: `pfc-lab-xor` with host PSK (`PFC_NATS_KEY` + `PFC_FORBID_PLAIN=1`). Python and Go envelopes round-trip the same vector. Production E2E remains NPE/HPKE (`PFC_REQUIRE_NPE` still unset).
|
||
- PDFs link to **sibling PDFs** (`nats-service-endpoints.pdf`, `secure-messaging.pdf`, `peergos-for-compliance.pdf`) — no `.md` hrefs.
|
||
- Controls / custody / variables chapters in the system PDF.
|
||
|
||
## S27 NPE/HPKE content + public-key directory
|
||
|
||
- Content: HPKE-Base only. sm-leaf rejects ``lab-xor`` / ``plain-lab``.
|
||
- Directory: ``/opt/pfc/etc/npe-dir`` public JSON + private 0600.
|
||
``GET /v1/npe/keys`` lists public keys for every E2E service.
|
||
- Clear on NATS: routing + error codes only. Content never in JSON.
|
||
- WAN NATS 4222 remains token-gated public-edge (not open). PFC uses
|
||
internal ``10.10.10.21:4222``.
|
||
|
||
Go `pfc-repl` now serves loopback `GET 127.0.0.1:18784/health`; admin `PFC_REPL_URL` points there. Ingest replicas a/b do not bind HTTP.
|
||
|
||
## Do not
|
||
|
||
- Enable `PFC_REQUIRE_NPE=1` if `npe` is missing
|
||
- Expose 4222/7422/5001 on WAN
|
||
- Commit private keys
|
||
- Rewrite 70 website repos
|
||
- Ask the operator questions
|