TODO-With-User

Blocks plus Guesses and Assumptions. Work continues around these.

Guesses and assumptions

Orgs in scope for code: marchon NATS/PFC repos. infra docs only. websites inventory only. verae org empty.
System key: generate lab Ed25519 signing key + X25519 system box key; private files gitignored; public keys in signed config payload.
Passthrough: NATS subject and to mailbox id are in the clear; ciphertext is HPKE (prod) or lab-xor (lab).
Lookup ID: HMAC-SHA256 of sender identity with a per-message nonce; not reversible from the broker.
Error bundle: two ciphertexts: ct_sender (NaCl/X25519 box to sender) and ct_system (box to system key) containing bounce metadata without recipient payload.
DataCube history: JSONL chain compatible with pfc.chain.Chain so a real cube can ingest it; lab can run without Peergos FUSE.
CI: Forgejo Actions (ubuntu-latest). If runners are missing, the YAML still documents the review gate.
ns1: no binary deploy until a green CI run is recorded. Docs HTML may be copied to /opt/pfc/docs/ as documentation-only.
Python comments: every executable line in secure_messaging/ has a trailing or preceding comment.
Go: in-process nats-server leaf to nats-a:7422 when SM_LEAF_HUB is set; otherwise in-memory only for tests.

No HSM on the laptop — lab keys only.
Central Verae timestamp leaf may be down — local-dual receipts already used by PFC; same here for error timestamps.
Cannot rewrite 70 website repos meaningfully this round.