Console, workspace, and catalog
================================

Public UI: ``https://pfc.georgelambert.org`` (Caddy to ``127.0.0.1:18780``).

Two identity planes
-------------------

* **Peergos Drive** -- password plus TOTP/WebAuthn for cryptree. Google does not
  unwrap cubes.
* **PFC console** -- password plus TOTP (Google OIDC optional). Inspect remains
  k-of-n officer shares.

Workspace
---------

Each console user gets a primary DataCube ``<username>-ws`` (profile ``internal``,
kind ``workspace``). Other cubes are catalogued inside it like a library.

Creating an **internal** cube requires Client, Author, Subject, Title. Those
fields append to:

* ``cubes/<id>/catalog/card.json``
* the workspace catalog JSONL
* the **cube** chain and the **workspace** chain

Drag and drop
-------------

* Desktop files onto the drop zone or a cube row: prompt with that cube's
  catalog defaults. SHA-256 is hashed in the browser first.
* An object chip from another cube: keep this cube's catalog defaults, or edit
  for this item only. The original SHA-256 and timestamp receipt are never
  rewritten.

Copy into another cube appends a ``copy`` row (original ``created_ts``, source
cube/seq, receipt). Optional file bytes are re-wrapped on the dest cube.
HIPAA bytes still need an inspect session.

Hash registry and stamps
------------------------

Global registry: ``registry/hashes.jsonl``. First-seen ``created_ts`` and first
receipt win.

Every chain append (object, copy, catalog, comment, memo, link) queues
unregistered hashes (content SHA-256 and/or envelope SHA-256). A daemon thread
(``PFC_STAMP_SYNC``, default 15 seconds) flushes them through the NATS leaf
(``verae.ts.request``). Already registered document hashes are skipped.
New comments get a **new** envelope hash and a new timestamp.

Comments, memos, and chain links append on the local cube immediately; the
leaf batch only timestamps hashes that have no receipt yet.