Technical controls (not a certificate)
======================================

This document maps **implemented** technical controls to common HIPAA /
SOC 2 / ISO 27001 *themes*. It is **not** a HIPAA, SOC 2, or ISO
certificate and must not be presented as one.

NATS is the **untrusted broker**. Production end-to-end is **NPE / HPKE**.
**Passthrough** means destination (and subject) may be in the clear so
routers work; the **body is ciphertext**. Encrypted processing is used on
every NATS hop we control so a compromised broker cannot read PHI.

Access control
--------------

* ``PFC_REQUIRE_AUTH=1`` on the console. TOTP for hipaa cubes.
* Console login is a separate identity plane from Peergos Drive.
* Inspect is k-of-n officer **share names** (not Google accounts).
* Author cannot be an inspect officer.

Cryptography
------------

* Production: NPE HPKE (ChaCha20-Poly1305) via ``npe send``; fail-closed
  (never falls back to lab-xor when ``crypto.mode=npe`` or
  ``PFC_REQUIRE_NPE=1``).
* Lab bus: ``pfc-lab-xor`` with host PSK (``PFC_NATS_KEY``).
  ``PFC_FORBID_PLAIN=1`` refuses ``alg=plain``.
* Signed Ed25519 config wrapper; unsigned files rejected.
* Dual hash (SHA-256 + BLAKE2b/BLAKE3) on cube objects.

Audit and logging
-----------------

* Log-before-reveal on inspect.
* Admin-history cube: previous file, new file, unified diff, actor, hashes.
* ``verae.sm.log.summary``: codes + ``lookup_id`` + dest class — never
  ciphertext or recipient payload.
* Network Error Bundle: ``ct_sender`` (sender-only) + ``ct_system`` (ops).

Key custody
-----------

See the Custody chapter in this PDF. Lab PEMs are 0600 on the host.
Production is customer HSM / PKCS#11.

Integrity
---------

* Hash registry: first SHA-256 and first receipt win; copies keep original
  timestamp.
* Chain JSONL per cube; stamp unregistered hashes to the timestamp leaf.