marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
system-git-sync/TODO-With-User.MD
George Lambert c570dc10fb S15: Historical-Information, deploy-ns1, promote gate SHAs 
Continue-until-done instructions live in Historical-Information.MD.
run-review.sh now covers signed-config HTTP and catalog subjects.
deploy-ns1.sh never skips tests and does not set PFC_REQUIRE_NPE.
2026-09-15 22:41:39 -04:00

1.6 KiB
Raw Blame History

TODO-With-User

Blocks plus Guesses and Assumptions. Work continues around these.

Guesses and assumptions

  • Orgs in scope for code: marchon NATS/PFC repos. infra docs only. websites inventory only. verae org empty.
  • System key: generate lab Ed25519 signing key + X25519 system box key; private files gitignored; public keys in signed config payload.
  • Passthrough: NATS subject and to mailbox id are in the clear; ciphertext is HPKE (prod) or lab-xor (lab).
  • Lookup ID: HMAC-SHA256 of sender identity with a per-message nonce; not reversible from the broker.
  • Error bundle: two ciphertexts: ct_sender (NaCl/X25519 box to sender) and ct_system (box to system key) containing bounce metadata without recipient payload.
  • DataCube history: JSONL chain compatible with pfc.chain.Chain so a real cube can ingest it; lab can run without Peergos FUSE.
  • CI: Forgejo Actions (ubuntu-latest). If runners are missing, the YAML still documents the review gate.
  • ns1: green local run-review.sh is the promote gate; deploy-ns1.sh rsyncs after tests. Docs HTML lives under /opt/pfc/docs/html. PFC_REQUIRE_NPE=1 still unset.
  • Python comments: every executable line in secure_messaging/ has a trailing or preceding comment.
  • Go: in-process nats-server leaf to nats-a:7422 when SM_LEAF_HUB is set; otherwise in-memory only for tests.

Open blocks (workaround in place)

  • No HSM on the laptop — lab keys only.
  • Central Verae timestamp leaf may be down — local-dual receipts already used by PFC; same here for error timestamps.
  • Cannot rewrite 70 website repos meaningfully this round.