julian
c142166972
No secure element is on-site: event signing runs on the software HMAC (EVENT_SIGNING_KEY, an env var on the host disk), so the ledger is tamper-EVIDENT but forgeable by anyone who owns the host. Several pages overstated it as present-tense "ATECC608-signed / unforgeable"; correct them. - NEW concepts/hardware-signer-options.md: four options for a non-extractable signing key (USB HSM / YubiKey / reuse the TPM / plain-dongle trap) + the recommendation (TPM interim → USB-HSM target; ATECC608 stays for the embedded ESP32, wrong part for a PC host). - entities/atecc608.md: UPCOMING-not-present status banner + PC-vs-embedded. - disk-os-hardening.md: fix the live-USB row (BIOS boot-order password is load-bearing, not Secure Boot — a signed live USB runs); add a physical-tamper chain (Dell 7070 CMOS-reset → live-USB → PCR-7 same-signer unseal) + accepted risks (that unseal, unsigned-initramfs evil-maid, operator-USB read TODO). - open-questions #6 reframed; standing-decisions / overview / threat-model / index de-overstated; log query entry. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
2.6 KiB
2.6 KiB
type, tags, sources, updated, status
| type | tags | sources | updated | status | |||
|---|---|---|---|---|---|---|---|
| decision |
|
|
2026-06-21 | settled |
Standing Decisions (settled)
The decisions treated as settled in the design notes. (See parking-system-architecture "Summary of standing decisions".)
- Stack: turborepo · fastify (Node) · react-vite-spa · sqlite +
drizzle-orm · local-jwt-auth. All MIT/Apache/BSD — no vendor lock, no rug-pull
risk (see payload-cms). Full table in technology-stack.
- Scoped exception (2026-06-15): the opencv-anpr-service — a separate local process, not linked into the app — may use AGPL components (plate/vehicle models). The exception is bounded to that process; the Node/React app stays strictly MIT/Apache/BSD. See vision-service.
- Platform: a dedicated, hardened Linux appliance (LUKS + GRUB password + Secure Boot), not Windows/WSL — see disk-os-hardening.
- Desktop shell: the operator UI ships as a desktop-shell-tauri kiosk wrapper (chosen over Electron, 2026-06-21) — small footprint, no bundled Chromium to patch, and a deny-by-default native surface that fits threat-model. The shell stays thin: all privileged logic remains in fastify. One open dependency — the appliance's WebKitGTK version (see open-questions #11).
- Integrity: append-only, hash-chained, software-signed event log (append-only-event-chain) — hardware-backed signing (a non-extractable key in the tpm or a USB HSM; the atecc608 is open-questions) is the target that makes it unforgeable by a host owner (hardware-signer-options). reconciliation is the anti-fraud control; encryption protects only at-rest (see threat-model).
- Access control: the dingtian-relay relay+input controller, on an isolated VLAN (network-isolation). Chosen because its inputs are decoupled from its relays, enabling host-in-the-loop ticket-first entry — the resolution to access-controller-button-flow. (The uhppote-controller and zkteco-controller were evaluated and rejected — kept as historical record. The esp32-custom-controller remains the documented prevention-grade alternative — the trust-boundary fork.)
- Readers: prefer wiegand-into-controller for permit holders (autonomous); host-in-the-loop for lpr-camera/QR/pure-network readers; both can share a relay (see entry-exit-readers).
Unsettled items live in open-questions.