secure-messaging/README.md

secure-messaging

Passthrough NATS envelopes, Ed25519 signed configuration, DataCube admin history, and Network Error Bundles.

• Python spec: python/secure_messaging/ (line comments)
• Go leaf: go/cmd/sm-leaf (in-process NATS + optional SM_LEAF_HUB)
• Catalog: https://git.georgelambert.org/marchon/nats-service-endpoints
• Hub: https://git.georgelambert.org/marchon/system-git-sync

Config must be a signed wrapper. Unsigned files are rejected. Admin changes append prev + new + unified diff to a kind=admin-history JSONL chain.

crypto.mode: npe | lab-xor | plain-lab (see signed payload).

Not a HIPAA/SOC 2/ISO certificate. ns1: no deploy until CI review.