Three-node NATS JetStream cluster on Proxmox LXC

modules/overview/NATS.md

@@ -0,0 +1,3 @@
+# NATS — overview
+
+Documentation only. Describes the central 3-server cluster. Zapier never connects.

modules/overview/SUMMARY.md

@@ -0,0 +1,3 @@
+# overview
+
+High-level system map, 3-node NATS cluster, uptime, network failure, address routing. Repo: `overview`.

modules/verae-access-api/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-api
+
+Plane `api`. Statement and jobs.watch after authz. No credits, no archive.

modules/verae-access-api/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-api
+
+Direct customer API (`x-api-key`). Separate from Zapier Platform.

modules/verae-access-authz/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-authz
+
+`verae.access.authz.check` request-reply. Queue `access-authz`. Fail closed.

modules/verae-access-authz/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-authz
+
+Default-deny authorization step on the NATS address path. Planes: zapier, web, api, leaf, staff.

modules/verae-access-leaf/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-leaf
+
+`verae.access.leaf.in` → authz.check → `verae.archive.*` / jobs.*. Denied: billing.

modules/verae-access-leaf/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-leaf
+
+Server-to-server NATS leaf ingress. Archive and jobs only. Never billing.

modules/verae-access-staff/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-staff
+
+Plane `staff`. Authz then billing statement/adjust.

modules/verae-access-staff/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-staff
+
+Staff plane for credits and statement review.

modules/verae-access-web/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-web
+
+Plane `web`. Authz then `verae.billing.statement.get` / `balance.adjust` kind=reload.

modules/verae-access-web/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-web
+
+Direct customer web plane. Not Zapier. Statement + reload only after authz.

modules/verae-access-zapier/NATS.md

@@ -0,0 +1,3 @@
+# NATS — verae-access-zapier
+
+Plane `zapier`. Authz then jobs.watch / usage.recorded. Zapier cloud never connects to NATS.

modules/verae-access-zapier/SUMMARY.md

@@ -0,0 +1,3 @@
+# verae-access-zapier
+
+Zapier Platform HTTPS plane only. No portal, no admin, no leaf.

modules/verae-activate/NATS.md

@@ -0,0 +1,10 @@
+# NATS — verae-activate
+
+This Zapier Platform app **does not use NATS**.
+
+| Direction | Address | Peer | Body |
+|-----------|---------|------|------|
+| IN | Zapier UI / runtime | user Zap | `number1`, `number2`, `text`, `data` / `sha256` |
+| OUT HTTPS (optional) | zappier-edge `/v1/add` or `/v1/timestamp` | only if `api_base` + `api_key` set | JSON |
+
+Blank connection fields → local compute only.

modules/verae-activate/SUMMARY.md

@@ -0,0 +1,11 @@
+# verae-activate (Zapier Platform app)
+
+**Job:** Private Zapier integration you push first. Actions run in Zapier cloud.
+
+**Expects:** User connection (API key optional).
+
+**Sends:** nothing if fields blank (Add Numbers / Echo / SHA256 / Create Timestamp local mock). If `api_base` + `api_key`, HTTPS to zappier-edge.
+
+**Does not** speak NATS.
+
+**Test:** `npm test`; `zapier-platform validate`.

modules/verae-archive-aggregator/NATS.md

@@ -0,0 +1,8 @@
+# NATS — verae-archive-aggregator
+
+| Direction | Address | Peer | Body |
+|-----------|---------|------|------|
+| OUT | `verae.archive.query` | all WORM | `{ correlationId, sha256, tenantId, kinds[], traceId }` |
+| IN | `verae.archive.reply.<correlationId>` | WORM hits | `{ archiveId, sha256, records[] }` |
+
+Stop collecting at `WAIT_ARCHIVE_MS`. Silent archives are listed in `silent[]`, not errors.

modules/verae-archive-aggregator/SUMMARY.md

@@ -0,0 +1,11 @@
+# verae-archive-aggregator
+
+**Job:** If `includeAttached`, fan out archive query and merge replies into the job JSON.
+
+**Expects:** wait-path flag from middleware-http; replies on `verae.archive.reply.<correlationId>`.
+
+**Sends:** `verae.archive.query` to all WORM nodes.
+
+**Timeout:** missing archives omit slices; chain receipt still succeeds.
+
+**Test:** `npm test` — one silent bloom miss + one hit; merge seal + metadata-attach.

modules/verae-archive-worm/NATS.md

@@ -0,0 +1,9 @@
+# NATS — verae-archive-worm
+
+| Direction | Address | From / to | Body |
+|-----------|---------|-----------|------|
+| IN | `verae.archive.put` | splitter | `{ sha256, tenantId, kind, record, traceId }` |
+| IN | `verae.archive.query` | aggregator (broadcast) | `{ correlationId, sha256, tenantId, kinds[], traceId }` |
+| OUT | `verae.archive.reply.<correlationId>` | aggregator | `{ archiveId, sha256, records[], traceId }` **only if bloom.mightHave(sha256)** |
+
+Subscribe to query **without** a shared queue group so every archive sees every query.

modules/verae-archive-worm/SUMMARY.md

@@ -0,0 +1,14 @@
+# verae-archive-worm
+
+**Job:** Append-only WORM store of metadata and files. Bloom filter: miss → stay silent on NATS.
+
+**Expects:**
+- `verae.archive.put` — append record, add sha256 to bloom
+- `verae.archive.query` — `{ correlationId, sha256, tenantId, kinds[] }` (every node sees this; **not** a shared queue group)
+
+**Sends:**
+- `verae.archive.reply.<correlationId>` **only on bloom hit** — `{ archiveId, sha256, records[] }`
+
+**Does not** write to the blockchain.
+
+**Test:** `npm test` — miss is `null`; put then query returns records.