review / inventory (push) Waiting to run

Details

UserReview leftovers implemented without rewriting 70 website repos
and without fail-closing pfc-py-admin.

2026-09-15 23:19:44 -04:00

TODO-With-User

Blocks plus Guesses and Assumptions. Work continues around these.

Guesses and assumptions

Orgs in scope for code: marchon NATS/PFC repos. infra docs only. websites inventory only. verae org empty.
System key: generate lab Ed25519 signing key + X25519 system box key; private files gitignored; public keys in signed config payload.
Passthrough: NATS subject and to mailbox id are in the clear; ciphertext is HPKE (prod) or lab-xor (lab).
Lookup ID: HMAC-SHA256 of sender identity with a per-message nonce; not reversible from the broker.
Error bundle: two ciphertexts: ct_sender (NaCl/X25519 box to sender) and ct_system (box to system key) containing bounce metadata without recipient payload.
DataCube history: JSONL chain compatible with pfc.chain.Chain so a real cube can ingest it; lab can run without Peergos FUSE.
CI: Forgejo Actions (ubuntu-latest). If runners are missing, the YAML still documents the review gate.
ns1: green local run-review.sh is the promote gate; deploy-ns1.sh rsyncs after tests. Docs HTML lives under /opt/pfc/docs/html. PFC_REQUIRE_NPE=1 still unset.
Python comments: every executable line in secure_messaging/ has a trailing or preceding comment.
Go: in-process nats-server leaf to nats-a:7422 when SM_LEAF_HUB is set; otherwise in-memory only for tests.

No HSM on the laptop — lab keys only.
Central Verae timestamp leaf may be down — local-dual receipts already used by PFC; same here for error timestamps.
Cannot rewrite 70 website repos meaningfully this round. Deep-link page added at georgelambert.org/pfc/ only.