George Lambert
8c09abecae
Some checks are pending
review / inventory (push) Waiting to run
VARIABLES.md, MODULE writer, catalog review covers subjects.json, deploy rsyncs system HTML/PDF and SM docs.
102 lines
4.4 KiB
Markdown
102 lines
4.4 KiB
Markdown
# Remaining-Work — complete plan (S16+)
|
||
|
||
**Instruction:** Execute this file without operator interruption until every
|
||
checkbox is done, revalidated, and deployed to ns1 when tests pass. Do not
|
||
ask the operator questions. Record guesses in `TODO-With-User.MD`.
|
||
|
||
This is **not** a HIPAA / SOC 2 / ISO certificate.
|
||
|
||
S00–S15 are closed (see `TODO.md`). This round is **S16–S24**: per-repo
|
||
module docs, real NATS success/failure/logging, UI screenshots +
|
||
walkthroughs, thesaurus with code/doc occurrences, HTML+LaTeX for the
|
||
system and each module, CI/CD green, Go processes running on ns1.
|
||
|
||
## Scope (in) vs out
|
||
|
||
**In (code + docs + tests + CI + ns1):**
|
||
|
||
| Repo | Why |
|
||
|---|---|
|
||
| system-git-sync | Hub, gate, thesaurus, remaining-work, deploy |
|
||
| nats-service-endpoints | Canonical from/to/filter/timeout catalog |
|
||
| secure-messaging | Python spec + Go sm-leaf routes |
|
||
| peergos-for-compliance | subjects.json, lib, tests |
|
||
| peergos-for-compliance-admin | Console UI + signed config |
|
||
| peergos-for-compliance-ipfs | pin HTTP/NATS |
|
||
| peergos-for-compliance-replication | Python repl (lab); live is Go |
|
||
| peergos-compliance-go | pfc-repl, configd, leaf |
|
||
| peergos-compliance-docs | System HTML/PDF + screenshots |
|
||
| peergos-compliance-architecture | Architecture notes |
|
||
| peergos-compliance-config | Config TUI + SPA |
|
||
|
||
**Out (inventory only, do not rewrite):** `websites` org, `verae` org
|
||
(empty), AdamsMotor / research trees unrelated to NATS, 70 marketing sites.
|
||
|
||
## Per-repo then system-wide
|
||
|
||
1. Fix **each repo** in isolation: LICENSE, README (who calls it, messages
|
||
in/out, filters, errors, timeouts, variables), tests, CI.
|
||
2. Then **system pass**: catalog = subjects.json, thesaurus occurrences,
|
||
Sphinx HTML+LaTeX, UI walkthrough screenshots, NATS live smoke on ns1,
|
||
`cicd/run-review.sh`, promote, `deploy-ns1.sh`.
|
||
|
||
## Checkboxes
|
||
|
||
- [x] **S16** Document this plan in Historical-Information + TODO.md
|
||
- [x] **S17** `secure-messaging` router: success path, reject path, dead
|
||
letter, Network Error Bundle, `verae.sm.log.summary` (no ciphertext
|
||
in logs). Tests for correct and incorrect targeted messages.
|
||
- [x] **S18** Go `sm-leaf` implements the same reject/accept policy; Go
|
||
tests; linux rebuild; process running on ns1.
|
||
- [x] **S19** Expand `nats-service-endpoints` to every `subjects.json`
|
||
name with from/to/in/out/encryption/reject/dead/timeout.
|
||
- [x] **S20** MODULE.md (callers, data store, walkthrough links) + LICENSE
|
||
on every in-scope repo; README vocabulary matches thesaurus.
|
||
- [x] **S21** Thesaurus rebuilt with **file:line occurrences** in docs and
|
||
code. Certify no banned phrases in in-scope trees.
|
||
- [x] **S22** UI: Playwright screenshots of login, TOTP, cubes, catalog,
|
||
users, inspect, audit, catalog-card dialog, config SPA. Walkthrough
|
||
RST with capabilities / steps / why / outcomes / storage.
|
||
- [x] **S23** Rebuild HTML + LaTeX PDF for system docs, nats catalog,
|
||
secure-messaging, hub. Rsync to docs.pfc.
|
||
- [x] **S24** CI (`run-review.sh` + Forgejo workflows) includes route tests
|
||
+ catalog completeness. Promote SHA. Deploy. Live NATS smoke on ns1.
|
||
Revalidate health, signed config, docs, screenshots published.
|
||
|
||
## Variables (must be named and set or explicitly defaulted)
|
||
|
||
See `docs/VARIABLES.md`. Live ns1 lab:
|
||
|
||
- `crypto.mode=lab-xor` (signed wrapper)
|
||
- `routing.mode=passthrough`
|
||
- `logging.mode=summary`
|
||
- `PFC_REQUIRE_NPE` unset
|
||
- `PFC_REQUIRE_AUTH=1`
|
||
- `NATS_URL=nats://10.10.10.21:4222`
|
||
- `SM_LEAF_HUB=nats://10.10.10.21:7422`
|
||
- `SM_HTTP=127.0.0.1:18783`
|
||
- `PFC_REPL_URL=http://127.0.0.1:18784`
|
||
- `PFC_SIGNED_CONFIG` / `PFC_CONFIG_KEY_PEM` on host only
|
||
|
||
## NATS route test matrix (must all pass)
|
||
|
||
| Case | Subject | Expect |
|
||
|---|---|---|
|
||
| Good passthrough | `verae.sm.send` with `to` + `ct` | `accepted=true`, `lookup_id` |
|
||
| Missing dest | `verae.sm.send` no `to` | `accepted=false`, `SM-MISSING-TO`, dead + error + summary |
|
||
| Empty ciphertext | `alg=lab-xor` `ct=""` | `SM-EMPTY-CT`, failure path |
|
||
| Summary never has `ct` | `verae.sm.log.summary` | header codes only |
|
||
| Health | `GET /health` sm-leaf and pfc-repl | 200 |
|
||
|
||
## UI screens to capture
|
||
|
||
login, totp-enroll, cubes, catalog, users, inspect, audit, catalog-card
|
||
dialog, config SPA (`config.pfc` or local `web/index.html`).
|
||
|
||
## Do not
|
||
|
||
- Enable `PFC_REQUIRE_NPE=1` on live pfc
|
||
- Replace `pfc-py-admin` with Go `pfc-admin`
|
||
- Commit private keys
|
||
- Rewrite website org
|
||
- Claim HIPAA/SOC2/ISO certified
|