George Lambert
8c09abecae
Some checks are pending
review / inventory (push) Waiting to run
VARIABLES.md, MODULE writer, catalog review covers subjects.json, deploy rsyncs system HTML/PDF and SM docs.
31 lines
14 KiB
Markdown
31 lines
14 KiB
Markdown
# Thesaurus
|
||
|
||
Canonical term → where it lives. Occurrences are grepped from in-scope
|
||
repos (docs **and** code). Banned phrases must not be used as the name
|
||
of the thing.
|
||
|
||
This is **not** a HIPAA/SOC 2/ISO certificate.
|
||
|
||
| Term | Use this | Not this | Occurrences |
|
||
|---|---|---|---|
|
||
| Untrusted broker | NATS | secure bus | `system-git-sync/System-Git-Sync.MD:116:| Routing | **passthrough**: destination in the clear; body encrypted | Brokers are untrusted | `routing.mode = passthrou`<br>`system-git-sync/scripts/build_thesaurus.py:26: ("Untrusted broker", "NATS", "secure bus", "untrusted"),`<br>`system-git-sync/scripts/build_thesaurus.py:86: "NATS is the untrusted broker. Production E2E is NPE/HPKE.",`<br>`nats-service-endpoints/README.md:13:**body** is ciphertext. The broker is untrusted.`<br>`peergos-compliance-docs/source/walkthrough.rst:11:**lookup_id** is the sender handle; **NATS** is the untrusted broker;`<br>`nats-service-endpoints/source/index.rst:7:The NATS broker is **untrusted**. Production E2E is NPE (HPKE). Lab may use`<br>`system-git-sync/docs/VARIABLES.md:30:| `NATS_URL` | `nats://10.10.10.21:4222` | untrusted broker |`<br>`secure-messaging/python/secure_messaging/envelope.py:42: return { # allowed on the untrusted broker` |
|
||
| Production E2E | NPE / HPKE | TLS to NATS | `secure-messaging/README.md:17:Live ns1 lab uses `lab-xor` until `PFC_REQUIRE_NPE=1` is explicitly cut over.`<br>`system-git-sync/System-Git-Sync.MD:110:| Crypto production | NPE HPKE (ChaCha20-Poly1305) | Already the Verae production E2E; do not invent a second suite | `cr`<br>`system-git-sync/System-Git-Sync.MD:111:| Crypto lab | `pfc-lab-xor` or `plain-lab` | Lets tests run without NPE sidecar | `crypto.mode = lab-xor \| plain-lab` |`<br>`system-git-sync/System-Git-Sync.MD:146:- [x] **S14** NPE adapter fail-closed (live cutover still UserReview)`<br>`system-git-sync/System-Git-Sync.MD:147:- [x] **S15** Promote SHA + ns1 sm-leaf (NPE live cutover remains UserReview)`<br>`system-git-sync/System-Git-Sync.MD:159:- 2026-09-16 — S10–S14: PFC admin `GET/POST /v1/admin/config`; NPE fail-closed; cicd/run-review.sh **REVIEW PASS (no depl`<br>`system-git-sync/System-Git-Sync.MD:160:- 2026-09-16 — S15: `cicd/deploy-ns1.sh` (tests required), sm-leaf health + `verae.sm.*`, signed lab-xor config + admin-h`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:71: "encryption": "passthrough dest-in-clear; body pfc-lab-xor or NPE; Pattern A apps never` |
|
||
| Lab envelope | pfc-lab-xor | xor cipher | `secure-messaging/scripts/sign_config.py:23: "crypto": {"mode": "lab-xor", "system_key_id": "lab-system"},`<br>`secure-messaging/README.md:16:`crypto.mode`: `npe` | `lab-xor` | `plain-lab` (see signed payload).`<br>`secure-messaging/README.md:17:Live ns1 lab uses `lab-xor` until `PFC_REQUIRE_NPE=1` is explicitly cut over.`<br>`system-git-sync/System-Git-Sync.MD:111:| Crypto lab | `pfc-lab-xor` or `plain-lab` | Lets tests run without NPE sidecar | `crypto.mode = lab-xor \| plain-lab` |`<br>`system-git-sync/System-Git-Sync.MD:160:- 2026-09-16 — S15: `cicd/deploy-ns1.sh` (tests required), sm-leaf health + `verae.sm.*`, signed lab-xor config + admin-h`<br>`system-git-sync/scripts/build_thesaurus.py:28: ("Lab envelope", "pfc-lab-xor", "xor cipher", "lab-xor"),`<br>`secure-messaging/tests/test_sm.py:20: payload = {"crypto": {"mode": "lab-xor"}, "routing": {"mode": "passthrough"}}`<br>`secure-messaging/tests/test_sm.py:22: self.assertEqual(verify(signed.wrapper(), pub)["crypto"]["mode"], "lab-xor")` |
|
||
| Dest in clear | passthrough | plaintext message | `secure-messaging/scripts/sign_config.py:24: "routing": {"mode": "passthrough"},`<br>`system-git-sync/System-Git-Sync.MD:35:> the address is a passthrough make that clear, explain how encrypted`<br>`system-git-sync/System-Git-Sync.MD:116:| Routing | **passthrough**: destination in the clear; body encrypted | Brokers are untrusted | `routing.mode = passthrou`<br>`system-git-sync/System-Git-Sync.MD:138:- [x] **S06** `secure-messaging` Python (signed config, passthrough, error bundle, admin history)`<br>`system-git-sync/System-Git-Sync.MD:156:- 2026-09-16 — Locked Ed25519 signed config + DataCube admin-history + passthrough routing + system-key error bundles.`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:24: "verae.sm.send": "Deliver a passthrough secure message (dest in the clear, body ciphertext)",`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:45: return "passthrough dest/subject clear; reject missing to, empty ct, plaintext body, body-like `<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:71: "encryption": "passthrough dest-in-clear; body pfc-lab-xor or NPE; Pattern A apps never` |
|
||
| Sender handle | lookup_id | from username on wire | `system-git-sync/System-Git-Sync.MD:117:| After send | Sender cannot decrypt own ciphertext; **lookup_id** only | Operator rule | envelope `from_lookup_id` |`<br>`system-git-sync/System-Git-Sync.MD:121:| Logs | **summaries** only (codes, lookup_id, dest class) | No PHI / no body | `logging.mode = summary` |`<br>`secure-messaging/MODULE.md:24:- **From:** `verae.sm.send` envelopes (`to`, `from_lookup_id`, `alg`, `ct`).`<br>`secure-messaging/MODULE.md:25:- **To:** Mailbox dest (clear); ack `lookup_id`. Failures → `verae.sm.error`, `verae.sm.dead`, `verae.sm.log.summary`.`<br>`system-git-sync/scripts/build_thesaurus.py:30: ("Sender handle", "lookup_id", "from username on wire", "lookup_id"),`<br>`system-git-sync/scripts/write_modules.py:41: frm="`verae.sm.send` envelopes (`to`, `from_lookup_id`, `alg`, `ct`).",`<br>`system-git-sync/scripts/write_modules.py:42: to="Mailbox dest (clear); ack `lookup_id`. Failures → `verae.sm.error`, `verae.sm.dead`, `verae.sm.log.summa`<br>`secure-messaging/tests/test_sm.py:56: self.assertNotIn("alice", env.from_lookup_id)` |
|
||
| Config file | signed wrapper | raw JSON config | `nats-service-endpoints/scripts/import_pfc_subjects.py:49: return "unsigned wrappers rejected; empty actor rejected"`<br>`secure-messaging/README.md:13:Config must be a signed wrapper. Unsigned files are rejected. Admin changes`<br>`system-git-sync/scripts/build_thesaurus.py:31: ("Config file", "signed wrapper", "raw JSON config", "signed wrapper"),`<br>`peergos-for-compliance-admin/pfc_admin/server.py:693: return 200, {"configured": False, "hint": "set PFC_SIGNED_CONFIG to a signed wrapper"}`<br>`peergos-compliance-docs/source/walkthrough.rst:122:signed wrapper.** Admin ``POST /v1/admin/config`` signs and appends`<br>`peergos-for-compliance/tests/test_signed_config.py:1:"""Admin GET/POST /v1/admin/config with Ed25519 signed wrapper + history."""`<br>`nats-service-endpoints/catalog/endpoints.json:152: "out": "signed wrapper",`<br>`system-git-sync/docs/VARIABLES.md:4:live ns1 values live in the **signed wrapper** and systemd units, not git.` |
|
||
| Admin audit | DataCube admin-history | SQL log | `peergos-compliance-config/MODULE.md:29:Unsigned files rejected at load. Live changes append admin-history.`<br>`secure-messaging/scripts/sign_config.py:25: "admin": {"history_cube": "admin-history"},`<br>`secure-messaging/scripts/sign_config.py:52: hist = AdminHistory(ROOT / "examples" / "admin-history")`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:29: "verae.admin.history.append": "Append prev + new + unified diff to admin-history cube",`<br>`secure-messaging/README.md:14:append prev + new + unified diff to a `kind=admin-history` JSONL chain.`<br>`system-git-sync/System-Git-Sync.MD:114:| Admin history | Verae DataCube chain (JSONL) `kind=admin-history` | Matches existing cube append-only model | `admin.hi`<br>`system-git-sync/System-Git-Sync.MD:156:- 2026-09-16 — Locked Ed25519 signed config + DataCube admin-history + passthrough routing + system-key error bundles.`<br>`system-git-sync/System-Git-Sync.MD:160:- 2026-09-16 — S15: `cicd/deploy-ns1.sh` (tests required), sm-leaf health + `verae.sm.*`, signed lab-xor config + admin-h` |
|
||
| Failure to sender | ct_sender | email bounce plaintext | `nats-service-endpoints/scripts/import_pfc_subjects.py:26: "verae.sm.error": "Emit a Network Error Bundle (ct_sender + ct_system)",`<br>`system-git-sync/System-Git-Sync.MD:119:| Sender failure notice | Sealed to **sender** public key only | Only they can read status | error header `ct_sender` |`<br>`secure-messaging/MODULE.md:33:- **Errors:** Network Error Bundle: `ct_sender` (sender only) + `ct_system` (ops). Never log mail body.`<br>`system-git-sync/scripts/build_thesaurus.py:33: ("Failure to sender", "ct_sender", "email bounce plaintext", "ct_sender"),`<br>`nats-service-endpoints/source/tracing.rst:17: 4. Sender opens ct_sender; ops opens ct_system.`<br>`system-git-sync/scripts/write_modules.py:44: err="Network Error Bundle: `ct_sender` (sender only) + `ct_system` (ops). Never log mail body.",`<br>`nats-service-endpoints/source/endpoints.rst:14:* ``verae.sm.error`` -- emit bundle: ``ct_sender`` + ``ct_system``.`<br>`secure-messaging/source/index.rst:36:Network Error Bundle: ``ct_sender`` (sender-only status) and ``ct_system``` |
|
||
| Ops bounce | ct_system / Network Error Bundle | log the ciphertext body | `secure-messaging/MODULE.md:33:- **Errors:** Network Error Bundle: `ct_sender` (sender only) + `ct_system` (ops). Never log mail body.`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:26: "verae.sm.error": "Emit a Network Error Bundle (ct_sender + ct_system)",`<br>`system-git-sync/scripts/build_thesaurus.py:34: ("Ops bounce", "ct_system / Network Error Bundle", "log the ciphertext body", "ct_system"),`<br>`system-git-sync/scripts/write_modules.py:44: err="Network Error Bundle: `ct_sender` (sender only) + `ct_system` (ops). Never log mail body.",`<br>`secure-messaging/source/index.rst:36:Network Error Bundle: ``ct_sender`` (sender-only status) and ``ct_system```<br>`nats-service-endpoints/source/tracing.rst:17: 4. Sender opens ct_sender; ops opens ct_system.`<br>`nats-service-endpoints/source/endpoints.rst:14:* ``verae.sm.error`` -- emit bundle: ``ct_sender`` + ``ct_system``.`<br>`peergos-compliance-docs/source/walkthrough.rst:143:``ct_sender`` is sender-only; ``ct_system`` is the ops bounce report.` |
|
||
| Inspect officers | share names | Google accounts | `peergos-for-compliance-admin/HOWTOSTART.md:18:k-of-n officer presence.`<br>`peergos-compliance-architecture/README.md:10: Author HSM Officers (k-of-n WebAuthn)`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:33: "verae.inspect.open": "Start k-of-n inspect; log-before-reveal",`<br>`nats-service-endpoints/scripts/import_pfc_subjects.py:47: return "k-of-n officers; author cannot be officer; TOTP session; log-before-reveal"`<br>`system-git-sync/scripts/build_thesaurus.py:35: ("Inspect officers", "share names", "Google accounts", "k-of-n"),`<br>`peergos-for-compliance-admin/README.md:5:Creates cubes with fail-closed profiles, stores ciphertext objects, opens k-of-n inspect sessions, and **refuses bytes `<br>`system-git-sync/scripts/write_modules.py:63: filt="`PFC_REQUIRE_AUTH=1`; TOTP for hipaa; k-of-n inspect; unsigned config rejected.",`<br>`peergos-for-compliance/apps/inspect/peergos-app.json:5: "description": "k-of-n inspect via cryptree outbox. No NATS in the iframe.",` |
|
||
| Console SSO | PFC TOTP/Google | Peergos Drive login | `peergos-for-compliance-admin/HOWTOSTART.md:11:Production console (`https://pfc.georgelambert.org`) sets `PFC_REQUIRE_AUTH=1`.`<br>`peergos-compliance-docs/scripts/capture_ui.py:46: env["PFC_REQUIRE_AUTH"] = "1"`<br>`system-git-sync/scripts/build_thesaurus.py:36: ("Console SSO", "PFC TOTP/Google", "Peergos Drive login", "PFC_REQUIRE_AUTH"),`<br>`system-git-sync/scripts/write_modules.py:63: filt="`PFC_REQUIRE_AUTH=1`; TOTP for hipaa; k-of-n inspect; unsigned config rejected.",`<br>`peergos-for-compliance-admin/pfc_admin/server.py:43:REQUIRE_AUTH = os.environ.get("PFC_REQUIRE_AUTH", "0") == "1"`<br>`peergos-for-compliance-admin/MODULE.md:29:`PFC_REQUIRE_AUTH=1`; TOTP for hipaa; k-of-n inspect; unsigned config rejected.`<br>`peergos-compliance-docs/source/remaining.rst:12:* Open JSON cube APIs return 401 when ``PFC_REQUIRE_AUTH=1``.`<br>`peergos-compliance-docs/source/walkthrough.rst:6:with ``PFC_REQUIRE_AUTH=1``.` |
|
||
| NPE sidecar | npe seal --to | HPKE in Python | `system-git-sync/scripts/build_thesaurus.py:37: ("NPE sidecar", "npe seal --to", "HPKE in Python", "npe_adapter"),`<br>`secure-messaging/python/secure_messaging/envelope.py:79: from .npe_adapter import seal_npe # fail-closed import`<br>`secure-messaging/python/secure_messaging/__init__.py:6:from .npe_adapter import NpeRequired # fail-closed NPE`<br>`system-git-sync/docs/thesaurus.md:20:| NPE sidecar | npe seal --to | HPKE in Python | npe_adapter.py |` |
|
||
| Review gate | cicd/GATE.md | auto-deploy to ns1 | `system-git-sync/scripts/build_thesaurus.py:38: ("Review gate", "cicd/GATE.md", "auto-deploy to ns1", "GATE.md"),`<br>`system-git-sync/TODO.md:20:- [x] S13 CI-CD: Forgejo workflows + `cicd/run-review.sh` + GATE.md (REVIEW PASS, no deploy)`<br>`system-git-sync/TODO.md:22:- [x] S15 Promote SHAs in cicd/GATE.md; deploy sm-leaf + signed config to ns1 (NPE live cutover remains UserReview)`<br>`system-git-sync/docs/thesaurus.md:21:| Review gate | cicd/GATE.md | auto-deploy to ns1 | system-git-sync |`<br>`system-git-sync/docs/thesaurus.md:23:| Config promote | GATE.md SHA table then deploy-ns1.sh | unsigned JSON copy | cicd/ |`<br>`system-git-sync/Historical-Information.MD:71:10. [x] Promote SHA in `cicd/GATE.md`` |
|
||
| sm-leaf health | GET 127.0.0.1:18783/health | WAN NATS ports | `secure-messaging/README.md:8:* Loopback health: `SM_HTTP` default `127.0.0.1:18783` (`GET /health`)`<br>`secure-messaging/source/index.rst:11:* Loopback health: ``127.0.0.1:18783/health```<br>`secure-messaging/deploy/pfc-sm-leaf.service:7:Environment=SM_HTTP=127.0.0.1:18783`<br>`secure-messaging/deploy/pfc-sm-leaf.service:8:ExecStart=/opt/pfc/bin/sm-leaf -hub nats://10.10.10.21:7422 -http 127.0.0.1:18783`<br>`system-git-sync/scripts/build_thesaurus.py:39: ("sm-leaf health", "GET 127.0.0.1:18783/health", "WAN NATS ports", "18783"),`<br>`system-git-sync/cicd/deploy-ns1.sh:114:curl -sS -m 5 http://127.0.0.1:18783/health; echo`<br>`system-git-sync/docs/VARIABLES.md:35:| `SM_HTTP` | `127.0.0.1:18783` | sm-leaf health |`<br>`system-git-sync/Remaining-Work.MD:77:- `SM_HTTP=127.0.0.1:18783`` |
|
||
|
||
## Certification
|
||
|
||
In-scope documentation uses the **Use this** column. `passthrough`
|
||
means destination in the clear, not a plaintext message body.
|
||
NATS is the untrusted broker. Production E2E is NPE/HPKE.
|
||
|