julian c142166972 docs(wiki): ATECC608 is upcoming — retag ledger signing to the on-host reality ...

No secure element is on-site: event signing runs on the software HMAC
(EVENT_SIGNING_KEY, an env var on the host disk), so the ledger is
tamper-EVIDENT but forgeable by anyone who owns the host. Several pages
overstated it as present-tense "ATECC608-signed / unforgeable"; correct them.

- NEW concepts/hardware-signer-options.md: four options for a non-extractable
  signing key (USB HSM / YubiKey / reuse the TPM / plain-dongle trap) + the
  recommendation (TPM interim → USB-HSM target; ATECC608 stays for the embedded
  ESP32, wrong part for a PC host).
- entities/atecc608.md: UPCOMING-not-present status banner + PC-vs-embedded.
- disk-os-hardening.md: fix the live-USB row (BIOS boot-order password is
  load-bearing, not Secure Boot — a signed live USB runs); add a physical-tamper
  chain (Dell 7070 CMOS-reset → live-USB → PCR-7 same-signer unseal) + accepted
  risks (that unseal, unsigned-initramfs evil-maid, operator-USB read TODO).
- open-questions #6 reframed; standing-decisions / overview / threat-model /
  index de-overstated; log query entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

2026-07-04 13:41:11 +02:00

..

anti-passback.md

feat(subscription): rename permit→subscription + monthly pricing

2026-06-18 13:15:04 +02:00

app-logs.md

feat(logs): app log store — backend pino DB sink + frontend error collection

2026-06-19 12:54:22 +02:00

append-only-event-chain.md

feat(desktop): Tauri v2 kiosk shell — maximized window, prod right-click block, auto-update + code-signing

2026-06-21 12:21:49 +02:00

backup-recovery.md

docs(wiki): record backup deploy gotchas (compose allowlist + host mount)

2026-06-29 17:38:24 +02:00

barrier-not-a-door.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

booth-console.md

docs(wiki): catch concept pages up to the booth-UX/shift/font-scale work

2026-06-29 11:43:12 +02:00

booth-exit-flow.md

docs(wiki): record session findings — snapshot fix, booth rework, db reset

2026-06-30 17:58:43 +02:00

button-light-indicator.md

feat(booth): blink the Entry/Exit lights on radar presence (mirror relay 3)

2026-06-28 11:48:12 +02:00

capacity-occupancy.md

feat(entry): operator-issued entry + exit plate-swap reconciliation

2026-07-01 12:17:52 +02:00

card-payments.md

feat(booth): disable card tender until a P2PE POS is on-site (cash-only)

2026-07-01 09:57:03 +02:00

challenge-response-auth.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

clock-integrity.md

wiki: design the business layer (session, tariff, permit, vision, shift, ops)

2026-06-15 17:41:38 +02:00

device-adapter-pattern.md

devices: pool-of-spaces model — drop lane, per-relay direction

2026-06-16 20:29:38 +02:00

device-discovery.md

devices: pool-of-spaces model — drop lane, per-relay direction

2026-06-16 20:29:38 +02:00

device-events.md

feat(logs): app log store — backend pino DB sink + frontend error collection

2026-06-19 12:54:22 +02:00

device-input-flow.md

devices: pool-of-spaces model — drop lane, per-relay direction

2026-06-16 20:29:38 +02:00

device-registry.md

devices: pool-of-spaces model — drop lane, per-relay direction

2026-06-16 20:29:38 +02:00

device-status-monitoring.md

fix(reader): correct the QR reader's identity — Dingtian DT-008, not "GEE"

2026-06-28 17:39:15 +02:00

disk-os-hardening.md

docs(wiki): settle on-site encrypted backup + disaster-recovery design

2026-06-29 11:43:23 +02:00

entry-double-press.md

refactor(setup): unify controller I/O — event-driven relays[] + generic inputs[]

2026-06-28 11:23:15 +02:00

entry-exit-points.md

feat(entry): operator-issued entry + exit plate-swap reconciliation

2026-07-01 12:17:52 +02:00

entry-exit-readers.md

fix(reader): correct the QR reader's identity — Dingtian DT-008, not "GEE"

2026-06-28 17:39:15 +02:00

event-log-ingestion.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

fail-state-safety.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

first-run-setup.md

docs(wiki): note log:read perm + entry presence/cooldown guard in reference pages

2026-06-19 12:59:06 +02:00

hardware-signer-options.md

docs(wiki): ATECC608 is upcoming — retag ledger signing to the on-host reality

2026-07-04 13:41:11 +02:00

i18n.md

docs(wiki): catch concept pages up to the booth-UX/shift/font-scale work

2026-06-29 11:43:12 +02:00

lane-presence-and-anpr-entry.md

feat(anpr): per-camera auto-open toggle (anprAutoTrigger) for shared lanes

2026-06-27 23:52:16 +02:00

local-dev-workflow.md

docs(wiki): record session findings — snapshot fix, booth rework, db reset

2026-06-30 17:58:43 +02:00

network-isolation.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

offline-first.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

operator-issued-entry.md

feat(entry): operator-issued entry + exit plate-swap reconciliation

2026-07-01 12:17:52 +02:00

parking-session.md

feat(booth): disable card tender until a P2PE POS is on-site (cash-only)

2026-07-01 09:57:03 +02:00

plate-reconciliation.md

feat(entry): operator-issued entry + exit plate-swap reconciliation

2026-07-01 12:17:52 +02:00

printer-roles-failover.md

devices: pool-of-spaces model — drop lane, per-relay direction

2026-06-16 20:29:38 +02:00

printer-status-monitoring.md

fix(devices): Cashino printer — ping-only driver (no false status) + Albanian role wording

2026-06-18 20:00:42 +02:00

printer-usb-transport.md

docs(wiki): printer USB transport + open-question for the provisioning

2026-06-24 20:32:24 +02:00

reconciliation.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

reporting-analytics.md

refactor(reports): top-level /reports section in the header, not a Setup tab

2026-06-22 00:20:30 +02:00

shift.md

feat(drawer): operator records cash movements, admin reviews after (own /drawer route)

2026-07-01 11:17:20 +02:00

site-metadata.md

ticket: site metadata header + scannable Albanian ticket; widen barcode

2026-06-17 12:17:21 +02:00

soft-delete.md

feat(recycle-bin): soft delete + restore for master data

2026-06-22 09:33:54 +02:00

tariff-time-tiers.md

feat(tariff): V2 — legacy-parity pricing (time-of-day, category, seasonal, flat)

2026-06-18 20:00:13 +02:00

tariff.md

feat: subscription v2 — quantity pricing, plan timeframes (tariff bridge), reserved spots

2026-06-20 18:22:50 +02:00

threat-model.md

docs(wiki): ATECC608 is upcoming — retag ledger signing to the on-host reality

2026-07-04 13:41:11 +02:00

ticket-encoding.md

fix(reader): correct the QR reader's identity — Dingtian DT-008, not "GEE"

2026-06-28 17:39:15 +02:00

tpm.md

feat(desktop): Tauri v2 kiosk shell — maximized window, prod right-click block, auto-update + code-signing

2026-06-21 12:21:49 +02:00

trust-boundary.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

uhppote-udp-protocol.md

Initial scaffold: Turborepo monorepo + design wiki

2026-06-14 00:34:11 +02:00

uhppote-vs-esp32.md

Remove UHPPOTE/ZKTeco; Dingtian is the only access driver

2026-06-14 14:28:52 +02:00

valet-overcapacity.md

wiki: valet / over-capacity mode; 'full' is a soft operator policy

2026-06-15 18:32:40 +02:00

validation-discounts.md

docs(wiki): tariff research — legacy ParkSQL2017 schema, time-tiers & validation/sponsorship design

2026-06-18 10:59:21 +02:00

validation-sponsorship.md

feat(subscription): rename permit→subscription + monthly pricing

2026-06-18 13:15:04 +02:00

wsl-dev-networking.md

Permanent WSL2 dev fix for multi-subnet source-address trap

2026-06-15 16:17:59 +02:00