a437feb8ab
openpay/
compliance/ PCI-DSS readiness package (scope-map,
pci-zero-architecture, hsm-kms-guidance,
qsa-checklist), citing PCI-DSS v4.0.1
requirements. (#1)
examples/pci-zero/ Runnable example demonstrating a deployment
where merchant code never touches a PAN. (#1)
crates/op-core/ Tokenized<Card> typestate + NetworkToken
+ CardNetwork + Cryptogram. (#2)
crates/op-rails-card/network_token/
NetworkTokenProvider trait + VTS adapter
+ MDES adapter, with deterministic stubs
behind a 'live' feature flag. (#2)
crates/op-driver-sdk/conformance/network_token.rs
Conformance harness for third-party
NetworkTokenProvider implementations. (#2)
crates/op-cli/src/ledger/ 'openpay ledger as-of' subcommand for
bi-temporal queries. (#3)
crates/op-orchestrator/src/telemetry.rs
OpenTelemetry span emission per
Payment<S> transition with semantic-
conventions tags. (#3)
docs/observability/ Grafana dashboard JSON + wiring guide
for the bi-temporal ledger lens. (#3)
smart-byte/
smart-byte-rs/ Rust reference implementation: envelope
encode/decode (canonical CBOR + BLAKE3
content addressing), Ed25519 sign +
verify, lockstep BFT commit MVP, Iroh
transport scaffold, CLI. (#4)
spec/identity_and_key_rotation.md
Adopts KERI SAIDs + key-event log
format; explicitly does not adopt ACDC
chaining wholesale. (#5)
conformance/v1/ 21 test vectors covering canonicalisation,
SAID computation, signature verification,
lockstep commit, gossip propagation.
CI gate enforces spec/vector coupling. (#6)
eoc/
eoc-rs/ Rust + WASM reference implementation:
4-stage cascade (cache -> kv -> graph ->
neural), joule counters via RAPL / NVML /
powermetrics, CLI, wasm-bindgen surface.
18 tests pass. (#7)
eoc-bench/ Benchmark harness, MT-Bench and Router
case sets, 'joules per MT-Bench point'
metric, 'eoc-bench run | compare' CLI. (#8)
standards/sci-for-ai-submission.md
Submission proposal mapping EOC's
receipt schema to GSF SCI-for-AI. (#9)
cookbook/ HuggingFace-style cookbook (markdown +
runnable Python) demonstrating EOC's
cascade with HF AI Energy Score. (#9)
docs/bench-v0.md Reproducibility doc for eoc-bench.
Workspace state:
- openpay clippy -- -D warnings: clean across all touched crates
- smart-byte-rs cargo test --workspace + clippy: clean
- eoc-rs cargo test --workspace + clippy: clean (18 tests)
- eoc-bench cargo check --workspace + clippy + 15 tests: clean
Rust 1.95.0 edition 2024 pinned at the open-standards root via
rust-toolchain.toml; every workspace inherits.
Closes #1 #2 #3 #4 #5 #6 #7 #8 #9.
2 KiB
2 KiB
OpenPay PCI-DSS Readiness Package
This directory is the PCI-DSS v4.0.1 readiness package for an OpenPay deployment. It maps the cardholder-data (CHD) and sensitive-authentication-data (SAD) handling of every crate in this workspace onto the twelve PCI-DSS v4.0.1 requirements, describes a deployment topology where merchant application servers never touch a primary account number (PAN), gives integration guidance for AWS KMS, GCP KMS, HashiCorp Vault, and Fortanix DSM, and provides a checklist a Qualified Security Assessor (QSA) can run against an OpenPay deployment before formal assessment. None of this material has been blessed by the PCI Security Standards Council, a card scheme, or a QSA; it is an engineering self-assessment intended to make a real assessment short.
Files
compliance/
├── README.md this file
├── scope-map.md per-crate PCI-DSS scope table; how the
│ op-core `pci-scope` feature gates raw-PAN
│ handling at the code-of-the-stack boundary
├── pci-zero-architecture.md deployment topology where merchant servers
│ never see PAN; references examples/pci-zero
├── hsm-kms-guidance.md AWS KMS / GCP KMS / HashiCorp Vault /
│ Fortanix DSM integration, modelled on the
│ existing op-rails-crypto::EvmSigner trait
└── qsa-checklist.md pre-assessment checklist mapping the twelve
PCI-DSS v4.0.1 requirements to artifacts
in this repository
Companion code
examples/pci-zero/ runnable example: vault tokenization →
orchestrator → card rail with no raw PAN
crossing process boundaries on the merchant
application server