marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
system-git-sync/Historical-Information.MD
George Lambert 07f147fffb
Some checks are pending
review / inventory (push) Waiting to run
Details
S15: pfc-repl loopback health; public /health replication 200 
PFC_REPL_URL=http://127.0.0.1:18784. Ingest replicas do not bind HTTP.
2026-09-15 22:48:11 -04:00

5 KiB
Raw Blame History

Historical-Information.MD

Instruction to any later agent: Continue without user interruption until every open item below is done, revalidated, and tested. Do not ask the operator for information. Use guesses in TODO-With-User.MD. Deploy validated code to ns1 70.88.205.138, replacing processes only when the replacement is tested. After a context reset: read this file first, then System-Git-Sync.MD, TODO.md, UserReview.MD, INVENTORY.md.

This is not a HIPAA/SOC 2/ISO certificate.

Operator intent (compressed)

  1. Secure messaging on untrusted NATS: passthrough (dest in the clear, body encrypted). Sender cannot reopen ciphertext; lookup_id only.
  2. Network Error Bundle: ct_sender (sender-only) + ct_system (system public key bounce report). Never log recipient plaintext.
  3. Signed Ed25519 config wrapper; unsigned files rejected. Admin changes append prev + new + unified diff to a Verae DataCube admin-history chain.
  4. Python (readable, commented) + Go (in-process NATS + leaf).
  5. Catalog repo nats-service-endpoints. Hub system-git-sync.
  6. Scan every Forgejo org. Websites = inventory only. verae org empty.
  7. ns1 sequence was docs → code → test → CI → deploy. Deploy is now in scope. Do not enable PFC_REQUIRE_NPE=1 on the live console unless the npe sidecar is actually present (fail-closed would take down pfc).
  8. Keep going until synced and interoperable. Re-run tests after deploy.

Forgejo

  • Host: https://git.georgelambert.org (Forgejo 11)
  • SSH: ssh://git@git.georgelambert.org:2223/marchon/<repo>.git (also git@git.georgelambert.org:marchon/<repo>.git)
  • Orgs: marchon (~61), infra (caddy, coredns), websites (70+), verae (0)
  • Token: osxkeychain for git.georgelambert.org user marchon

Live ns1 (do not break the console)

  • pfc-py-admin :18780 → https://pfc.georgelambert.org (PFC_REQUIRE_AUTH=1)
  • pfc-connector, pfc-peergos-bridge, pfc-py-ipfs :18782, Kubo :15001
  • pfc-configd :18781
  • NATS leaf hub nats://10.10.10.21:7422 (also written nats-leaf://)
  • Docs: /opt/pfc/docs/html, https://docs.pfc.georgelambert.org
  • Secrets: /opt/pfc/etc/admin.env, /opt/pfc/etc/peergos-bridge.env
  • Do not replace pfc-py-admin with Go pfc-admin (Go HTTP was disabled on purpose). Add sm-leaf alongside.

Repos created this program

Design locks

See System-Git-Sync.MD table. Config keys: crypto.mode, routing.mode, admin.history_cube, crypto.system_key_id, logging.mode.

Open items (execute in order)

Update checkboxes in TODO.md as each is done.

  1. Historical file committed (this file)
  2. Expand sm-leaf health HTTP + sm subjects; linux/amd64 build
  3. cicd/deploy-ns1.sh: test then rsync; never skip tests
  4. Generate Ed25519 config keys on ns1; signed config + admin-history
  5. Install secure-messaging Python under /opt/pfc/python/secure_messaging
  6. systemd pfc-sm-leaf.service; loopback health
  7. Point pfc-py-admin PYTHONPATH at secure-messaging; optional signed config
  8. Caddy/docs: hub + endpoints HTML/PDF under docs.pfc
  9. Smoke: pfc health 200, sm-leaf health, signed config load, PFC tests
  10. Promote SHA in cicd/GATE.md
  11. Re-run cicd/run-review.sh; second doc sync (after ns1)
  12. NPE live: binary exists at /opt/pfc/bin/npe; PFC_REQUIRE_NPE left unset (bus still lab-xor; fail-closed would take down the console). Cutover remains UserReview.
  13. Websites org: no NATS code; inventory remains complete
  14. Push all git remotes; close S15

ns1 validation (2026-09-16)

  • Local review: PFC 25/25, SM 5/5, Go leaf OK, catalog subjects OK (twice).
  • Host: pfc-py-admin, pfc-sm-leaf, pfc-connector, pfc-peergos-bridge active.
  • GET http://127.0.0.1:18783/health → {"ok":true,"service":"sm-leaf"}
  • GET https://pfc.georgelambert.org/health → 200 (ipfs 200, replication 200 pfc-repl-go)
  • GET /v1/admin/config unauthenticated → 401
  • Signed wrapper crypto.mode=lab-xor routing.mode=passthrough verifies on host
  • Admin-history seq 0 actor deploy-ns1 has prev + new + unified diff
  • Host SM tests (signed/tamper, lab-xor, NPE fail-closed, error bundle, history) OK
  • Docs: /sync/index.html 200, /sync/Historical-Information.MD 200, /nats-service-endpoints/ 200 + PDF
  • Promoted SHAs: secure-messaging f4da7ff, peergos-for-compliance 2c45603, admin c46d494, nats-service-endpoints 1d01768, system-git-sync c570dc1/d9bd1fd

S15 closed. Remaining UserReview only: NPE cutover, HSM custody, optional sync.pfc hostname, website deep-links.

Go pfc-repl now serves loopback GET 127.0.0.1:18784/health; admin PFC_REPL_URL points there. Ingest replicas a/b do not bind HTTP.

Do not

  • Enable PFC_REQUIRE_NPE=1 if npe is missing
  • Expose 4222/7422/5001 on WAN
  • Commit private keys
  • Rewrite 70 website repos
  • Ask the operator questions