Remaining items

This is not a HIPAA, SOC 2, or ISO certificate.

Done in the lab (ns1)

  • Fail-closed profiles, append-only cube chain, Shamir inspect wrap, log-before-reveal.

  • Console at https://pfc.georgelambert.org: session cookie, TOTP, optional Google SSO (button hidden until GOOGLE_CLIENT_ID).

  • Open JSON cube APIs return 401 when PFC_REQUIRE_AUTH=1.

  • Workspace cube <user>-ws and library catalog (Client, Author, Subject, Title).

  • Drag-and-drop from the desktop and cube-to-cube; catalog prompt; SHA-256 registry never replaces the first timestamp receipt.

  • Periodic leaf stamp sync (default 15s): only unregistered hashes go to verae.ts.request (local-dual if the central TS is down).

  • Pattern A PFC Inspect installed for Drive user peergos; OrgTool bridge copies cryptree outbox to /opt/pfc/bridge.

  • Let’s Encrypt for pfc / config.pfc / docs.pfc.georgelambert.org.

Still later

  • WebAuthn on the console.

  • PFC_REQUIRE_NPE=1 and the Go NPE sidecar (lab still uses pfc-lab-xor / plain).

  • Customer HSM (lab uses lab_hsm_stub).

  • Mode-A exam zip / verae.cube.export ISO packager.

  • nsc JWT on nats-a/b/c; BAAs; pentest; SOC 2 Type I/II; ISO ISMS.

Do not expose NATS 4222 / 7422 or Kubo 5001 on the WAN.