enigma-memory 0.1.10 → 0.1.12

package/deploy/SIMULATION.md

@@ -0,0 +1,152 @@
+# Enigma Memory — Local Production Simulation
+
+**CLAIM BOUNDARY:** This is a `local-simulation` environment. It uses
+self-signed TLS, bind-mounted file "secrets", a mocked KMS, and a mocked SIEM.
+It is **not** a production deployment and must not be used as go-live evidence.
+
+## Public-looking domain (local testing only)
+
+The simulation is configured to answer on `sim.enigmamemory.com` so that the
+hosted-backend live validator accepts the non-localhost HTTPS probe URLs. For
+real go-live evidence the operator must point the chosen public domain at the
+deployment's public IP address; the local simulation uses a hosts-file or local
+DNS trick instead.
+
+On the host running Docker, map the domain to the loopback interface:
+
+```text
+127.0.0.1 sim.enigmamemory.com relay.sim.enigmamemory.com gateway.sim.enigmamemory.com
+```
+
+On Linux/macOS add that line to `/etc/hosts`; on Windows add it to
+`C:\Windows\System32\drivers\etc\hosts`. Then the following commands work from
+the host:
+
+```bash
+curl -k https://sim.enigmamemory.com:8443/readyz
+curl -k https://sim.enigmamemory.com:9443/readyz
+```
+
+The tls-proxy service also declares `extra_hosts` entries for the same domain
+names so that containers can resolve them locally when needed.
+
+## Quick start
+
+1. Generate secrets and a self-signed TLS certificate:
+
+   ```bash
+   node scripts/simulate-production-env.mjs
+   ```
+
+   Files are written to `deploy/secrets-simulation/` (gitignored).
+
+2. Start the simulation:
+
+   ```bash
+   docker compose -f deploy/docker-compose.local-production-simulation.yml up --build -d
+   ```
+
+3. Wait for the backend to become ready:
+
+   ```bash
+   node scripts/wait-for-backend-ready.mjs
+   ```
+
+4. Inspect readiness over HTTPS:
+
+   ```bash
+   curl -k https://localhost:8443/readyz
+   curl -k https://localhost:9443/readyz
+   curl -k https://sim.enigmamemory.com:8443/readyz
+   curl -k https://sim.enigmamemory.com:9443/readyz
+   ```
+
+## Stop
+
+```bash
+docker compose -f deploy/docker-compose.local-production-simulation.yml down
+```
+
+To also remove the Postgres volume and mock event data:
+
+```bash
+docker compose -f deploy/docker-compose.local-production-simulation.yml down -v
+```
+
+## Ports and routes
+
+| Service | Public port | Internal port | Health route | Notes |
+|--------|-------------|---------------|--------------|-------|
+| relay  | `8443` (HTTPS, loopback) | `8787` | `/readyz`, `/livez` | TLS terminated by `tls-proxy`; also answers on `sim.enigmamemory.com` and `relay.sim.enigmamemory.com` |
+| gateway | `9443` (HTTPS, loopback) | `8797` | `/readyz`, `/livez` | TLS terminated by `tls-proxy`; also answers on `sim.enigmamemory.com` and `gateway.sim.enigmamemory.com` |
+| postgres | not exposed | `5432` | — | Used as the simulated durable store |
+| kms-mock | not exposed | `3000` | `/healthz` | Serves a generated Ed25519 key ref |
+| siem-mock | not exposed | `3000` | `/healthz` | Accepts `POST /events`, writes minimized metadata to `/data/siem-events.jsonl` |
+
+## Verify secret files
+
+```bash
+node scripts/simulate-production-env.mjs --check
+```
+
+This reports whether all required files in `deploy/secrets-simulation/` exist
+and are non-empty.
+
+## Simulation-only behavior
+
+- `ENIGMA_OPERATOR_ACCEPTANCE_DECISION` is set to `go` so the readiness
+  endpoints can turn green locally. This is **not** real operator acceptance.
+- `ENIGMA_DISABLE_LOCAL_DEMO_FALLBACK` is `true`, but the "external" storage,
+  KMS, and SIEM are local mocks.
+- The TLS certificate is self-signed; curl requires `-k`/`--insecure`.
+- The certificate SAN list includes `localhost`, `127.0.0.1`,
+  `sim.enigmamemory.com`, `relay.sim.enigmamemory.com`,
+  `gateway.sim.enigmamemory.com`, and `*.sim.enigmamemory.com`.
+
+## Collect hosted backend live evidence
+
+The simulation can be probed as if it were a public hosted deployment by
+using the public-looking domain `sim.enigmamemory.com`. Because the domain
+has no real DNS record, the collector resolves it to `127.0.0.1` locally and
+accepts the self-signed certificate.
+
+1. Build a simulation operator acceptance packet:
+
+   ```bash
+   node scripts/build-operator-acceptance-packet.mjs \
+     --complete-fixture --decision go --packet-id sim-operator-acceptance \
+     --tenant enigma-sim --deployment-mode hosted --environment local-simulation \
+     --target-regions local --requested-go-live-date 2026-06-25 \
+     --evidence-repository https://github.com/enigma-memory/evidence/sim \
+     --packet-owner "Simulation Owner" \
+     --last-updated 2026-06-25T00:00:00.000Z \
+     --owners-json .enigma/sim-owner-overrides.json \
+     --evidence-refs .enigma/sim-evidence-overrides.json \
+     --out .enigma/sim-operator-acceptance.json --validate
+   ```
+
+2. Collect and validate live evidence:
+
+   ```bash
+   node .enigma/collect-sim-evidence.mjs \
+     --relay-url https://sim.enigmamemory.com:8443 \
+     --gateway-url https://sim.enigmamemory.com:9443 \
+     --refs-json .enigma/sim-hosted-refs.json \
+     --domain sim.enigmamemory.com --environment-id local-simulation \
+     --cloud-provider local --region local --owner enigma-sim \
+     --operator-decision go \
+     --operator-packet-ref .enigma/sim-operator-acceptance.json \
+     --operator-approved-at <iso8601> --operator-approved-by enigma-sim \
+     --out .enigma/hosted-backend-live-collection.json \
+     --evidence-out .enigma/hosted-backend-live-simulated.json
+
+   node scripts/validate-hosted-backend-live.mjs \
+     --evidence .enigma/hosted-backend-live-simulated.json
+   ```
+
+The expected result is `status: accepted` with all four probes observed and no
+blockers. The wrapper does not mutate DNS or deploy infrastructure and never
+sends credentials.
+
+Never commit `deploy/secrets-simulation/` or `*.pem` files. Both are
+`.gitignore`d.

package/deploy/docker-compose.local-production-simulation.yml

@@ -0,0 +1,237 @@
+# Enigma Memory — local production simulation.
+# CLAIM BOUNDARY: This compose file is local-simulation only. It uses
+# self-signed TLS, bind-mounted file "secrets", a mocked KMS, and a mocked
+# SIEM. It is not a production deployment and does not prove hosted/BYOC
+# readiness.
+#
+# LOCAL DNS NOTE: From the host, map sim.enigmamemory.com (and optional
+# relay.sim.enigmamemory.com and gateway.sim.enigmamemory.com) to 127.0.0.1
+# via /etc/hosts or local DNS. This lets curl -k reach the tls-proxy container
+# whose ports are published on the loopback interface. For real validation the
+# operator must point the chosen public domain at the deployment's public IP.
+services:
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: enigma
+      POSTGRES_PASSWORD: enigma
+      POSTGRES_DB: enigma
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U enigma -d enigma"]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
+    restart: unless-stopped
+
+  kms-mock:
+    image: node:24-alpine
+    command: ["node", "/app/deploy/kms-mock.mjs"]
+    environment:
+      PORT: "3000"
+      KMS_KEY_REF_PATH: "/data/kms-key-ref.json"
+      KMS_KEY_ID: "local-simulation-kms-key"
+    volumes:
+      - ./kms-mock.mjs:/app/deploy/kms-mock.mjs:ro
+      - ./secrets-simulation:/app/secrets-simulation:ro
+      - kms-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 3s
+    restart: unless-stopped
+
+  siem-mock:
+    image: node:24-alpine
+    command: ["node", "/app/deploy/siem-mock.mjs"]
+    environment:
+      PORT: "3000"
+      SIEM_SINK_PATH: "/data/siem-events.jsonl"
+    volumes:
+      - ./siem-mock.mjs:/app/deploy/siem-mock.mjs:ro
+      - siem-data:/data
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 3s
+    restart: unless-stopped
+
+  relay:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    image: enigma-local:simulation
+    entrypoint: ["enigma-relay"]
+    command: ["serve", "--host", "0.0.0.0", "--port", "8787"]
+    secrets:
+      - relay_signing_key
+      - external_storage_dsn
+      - kms_key_ref
+      - backup_target_uri
+      - operator_acceptance_evidence_uri
+    environment:
+      NODE_ENV: production
+      ENIGMA_BACKEND_MODE: production
+      ENIGMA_REQUIRE_EXTERNAL_STORAGE: "true"
+      ENIGMA_REQUIRE_EXTERNAL_KMS: "true"
+      ENIGMA_DISABLE_LOCAL_DEMO_FALLBACK: "true"
+      ENIGMA_REQUIRE_OPERATOR_ACCEPTANCE_EVIDENCE: "true"
+      ENIGMA_READINESS_FAIL_CLOSED: "true"
+      ENIGMA_RELAY_BACKEND_HOST_REF: local-simulation-relay-backend-host-ref
+      ENIGMA_RELAY_DNS_TLS_REF: local-simulation-relay-dns-tls-ref
+      ENIGMA_RELAY_RUNTIME_AUTH_REF: local-simulation-relay-runtime-auth-ref
+      ENIGMA_RELAY_MONITORING_REF: local-simulation-relay-monitoring-ref
+      ENIGMA_SIEM_REF: local-simulation-siem-ref
+      ENIGMA_BACKUP_TARGET_URI_FILE: /run/secrets/backup_target_uri
+      ENIGMA_NETWORK_ACCESS_POLICY_REF: local-simulation-network-access-policy-ref
+      ENIGMA_KMS_CUSTODY_REF: local-simulation-kms-custody-ref
+      ENIGMA_KMS_KEY_REF: local-simulation-kms-key-ref
+      ENIGMA_TENANT_POLICY_APPROVAL_REF: local-simulation-tenant-policy-approval-ref
+      ENIGMA_USAGE_METERING_REF: local-simulation-usage-metering-ref
+      ENIGMA_SERVICE_SETTLEMENT_REF: local-simulation-service-settlement-ref
+      ENIGMA_MONITORING_ALERTING_REF: local-simulation-monitoring-alerting-ref
+      ENIGMA_PUBLIC_SITE_SECURITY_REF: local-simulation-public-site-security-ref
+      ENIGMA_SECURITY_THREAT_MODEL_REF: local-simulation-security-threat-model-ref
+      ENIGMA_LEGAL_COMPLIANCE_APPROVAL_REF: local-simulation-legal-compliance-approval-ref
+      ENIGMA_SUPPORT_SLA_REF: local-simulation-support-sla-ref
+      ENIGMA_INCIDENT_DRILL_REF: local-simulation-incident-drill-ref
+      ENIGMA_BACKUP_RESTORE_DRILL_REF: local-simulation-backup-restore-drill-ref
+      ENIGMA_OPERATOR_ACCEPTANCE_DECISION: go
+      ENIGMA_RELAY_SIGNING_KEY_FILE: /run/secrets/relay_signing_key
+      ENIGMA_EXTERNAL_STORAGE_DSN_FILE: /run/secrets/external_storage_dsn
+      ENIGMA_KMS_KEY_REF_FILE: /run/secrets/kms_key_ref
+      ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI_FILE: /run/secrets/operator_acceptance_evidence_uri
+    depends_on:
+      postgres:
+        condition: service_healthy
+    read_only: true
+    user: "1000:1000"
+    cap_drop: ["ALL"]
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"Promise.all([fetch('http://127.0.0.1:8787/livez'),fetch('http://127.0.0.1:8787/readyz')]).then(rs=>process.exit(rs.every(r=>r.ok)?0:1)).catch(()=>process.exit(1))\""]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+
+  gateway:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+    image: enigma-local:simulation
+    entrypoint: ["enigma-gateway"]
+    command: ["serve", "--host", "0.0.0.0", "--port", "8797"]
+    secrets:
+      - gateway_signing_key
+      - external_storage_dsn
+      - kms_key_ref
+      - siem_export_endpoint
+      - backup_target_uri
+      - operator_acceptance_evidence_uri
+    environment:
+      NODE_ENV: production
+      ENIGMA_BACKEND_MODE: production
+      ENIGMA_REQUIRE_EXTERNAL_STORAGE: "true"
+      ENIGMA_REQUIRE_EXTERNAL_KMS: "true"
+      ENIGMA_REQUIRE_SIEM_EXPORT: "true"
+      ENIGMA_DISABLE_LOCAL_DEMO_FALLBACK: "true"
+      ENIGMA_REQUIRE_OPERATOR_ACCEPTANCE_EVIDENCE: "true"
+      ENIGMA_READINESS_FAIL_CLOSED: "true"
+      ENIGMA_GATEWAY_BACKEND_HOST_REF: local-simulation-gateway-backend-host-ref
+      ENIGMA_GATEWAY_DNS_TLS_REF: local-simulation-gateway-dns-tls-ref
+      ENIGMA_GATEWAY_MONITORING_REF: local-simulation-gateway-monitoring-ref
+      ENIGMA_GATEWAY_STORAGE_REF: local-simulation-gateway-storage-ref
+      ENIGMA_SIEM_REF: local-simulation-siem-ref
+      ENIGMA_GATEWAY_ADMIN_AUTH_REF: local-simulation-gateway-admin-auth-ref
+      ENIGMA_GATEWAY_DATA_PLANE_AUTH_REF: local-simulation-gateway-data-plane-auth-ref
+      ENIGMA_BACKUP_TARGET_URI_FILE: /run/secrets/backup_target_uri
+      ENIGMA_NETWORK_ACCESS_POLICY_REF: local-simulation-network-access-policy-ref
+      ENIGMA_KMS_CUSTODY_REF: local-simulation-kms-custody-ref
+      ENIGMA_KMS_KEY_REF: local-simulation-kms-key-ref
+      ENIGMA_TENANT_POLICY_APPROVAL_REF: local-simulation-tenant-policy-approval-ref
+      ENIGMA_USAGE_METERING_REF: local-simulation-usage-metering-ref
+      ENIGMA_SERVICE_SETTLEMENT_REF: local-simulation-service-settlement-ref
+      ENIGMA_MONITORING_ALERTING_REF: local-simulation-monitoring-alerting-ref
+      ENIGMA_PUBLIC_SITE_SECURITY_REF: local-simulation-public-site-security-ref
+      ENIGMA_SECURITY_THREAT_MODEL_REF: local-simulation-security-threat-model-ref
+      ENIGMA_LEGAL_COMPLIANCE_APPROVAL_REF: local-simulation-legal-compliance-approval-ref
+      ENIGMA_SUPPORT_SLA_REF: local-simulation-support-sla-ref
+      ENIGMA_INCIDENT_DRILL_REF: local-simulation-incident-drill-ref
+      ENIGMA_BACKUP_RESTORE_DRILL_REF: local-simulation-backup-restore-drill-ref
+      ENIGMA_OPERATOR_ACCEPTANCE_DECISION: go
+      ENIGMA_GATEWAY_ADMIN_AUTH_BEARER_SHA256: sha256:6655800954551a39fc1cde811dbe44366ab67b369170b16f4f7c421b5b695870
+      ENIGMA_GATEWAY_DATA_PLANE_AUTH_BEARER_SHA256: sha256:21030e3332a199d4b729cd5a8035fdf43f0abdb541af9ee9917639ff67abdecb
+      ENIGMA_GATEWAY_SIGNING_KEY_FILE: /run/secrets/gateway_signing_key
+      ENIGMA_KMS_KEY_REF_FILE: /run/secrets/kms_key_ref
+      ENIGMA_SIEM_EXPORT_ENDPOINT_FILE: /run/secrets/siem_export_endpoint
+      ENIGMA_EXTERNAL_STORAGE_DSN_FILE: /run/secrets/external_storage_dsn
+      ENIGMA_OPERATOR_ACCEPTANCE_EVIDENCE_URI_FILE: /run/secrets/operator_acceptance_evidence_uri
+    depends_on:
+      postgres:
+        condition: service_healthy
+    read_only: true
+    user: "1000:1000"
+    cap_drop: ["ALL"]
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m
+    healthcheck:
+      test: ["CMD-SHELL", "node -e \"Promise.all([fetch('http://127.0.0.1:8797/livez'),fetch('http://127.0.0.1:8797/readyz')]).then(rs=>process.exit(rs.every(r=>r.ok)?0:1)).catch(()=>process.exit(1))\""]
+      interval: 15s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+
+  tls-proxy:
+    image: nginx:alpine
+    ports:
+      - "127.0.0.1:8443:8443"
+      - "127.0.0.1:9443:9443"
+    volumes:
+      - ./secrets-simulation/tls.crt:/etc/nginx/ssl/tls.crt:ro
+      - ./secrets-simulation/tls.key:/etc/nginx/ssl/tls.key:ro
+      - ./nginx.local-production-simulation.conf:/etc/nginx/conf.d/default.conf:ro
+    extra_hosts:
+      - "sim.enigmamemory.com:127.0.0.1"
+      - "relay.sim.enigmamemory.com:127.0.0.1"
+      - "gateway.sim.enigmamemory.com:127.0.0.1"
+    depends_on:
+      relay:
+        condition: service_healthy
+      gateway:
+        condition: service_healthy
+    restart: unless-stopped
+
+secrets:
+  relay_signing_key:
+    file: ./secrets-simulation/relay-signing-key
+  gateway_signing_key:
+    file: ./secrets-simulation/gateway-signing-key
+  external_storage_dsn:
+    file: ./secrets-simulation/external-storage-dsn
+  kms_key_ref:
+    file: ./secrets-simulation/kms-key-ref
+  backup_target_uri:
+    file: ./secrets-simulation/backup-target-uri
+  siem_export_endpoint:
+    file: ./secrets-simulation/siem-export-endpoint
+  operator_acceptance_evidence_uri:
+    file: ./secrets-simulation/operator-acceptance-evidence-uri
+
+volumes:
+  pgdata:
+  kms-data:
+  siem-data:

package/deploy/docker-compose.production.example.yml

@@ -3,6 +3,12 @@
 # backend availability. Provide real external storage, KMS/signing material,
 # SIEM export, backups, monitoring, ingress/TLS, and acceptance evidence first.
 
+# Network egress must be default-deny at the host or container-network layer.
+# Allow only the specific endpoints required for storage, KMS, SIEM, backups,
+# monitoring, and operator acceptance evidence. The loopback-only port bindings
+# below are not a public ingress; place an operator-managed reverse proxy or
+# API gateway in front for any public or private admin/data-plane routing.
+
 services:
   relay:
     image: ghcr.io/enigma-ai/enigma:operator-pinned-digest-required
@@ -64,6 +70,8 @@ services:
       retries: 3
       start_period: 10s
     restart: unless-stopped
+    networks:
+      - enigma-backend
 
   gateway:
     image: ghcr.io/enigma-ai/enigma:operator-pinned-digest-required
@@ -132,6 +140,8 @@ services:
       retries: 3
       start_period: 10s
     restart: unless-stopped
+    networks:
+      - enigma-backend
 
 secrets:
   relay_signing_key:
@@ -148,3 +158,12 @@ secrets:
     file: ./operator-secrets/siem-export-endpoint
   operator_acceptance_evidence_uri:
     file: ./operator-secrets/operator-acceptance-evidence-uri
+
+networks:
+  # Isolated backend bridge. Egress is not restricted by Docker Compose itself;
+  # the operator must enforce default-deny outbound policy at the host firewall
+  # or an egress proxy, allowing only the storage/KMS/SIEM/backup/monitoring
+  # endpoints declared by the secrets and refs above.
+  enigma-backend:
+    driver: bridge
+    internal: false

package/deploy/kms-mock.mjs

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+// Enigma Memory — local-simulation KMS mock.
+// CLAIM BOUNDARY: local-simulation only. This is not HSM-grade key custody.
+
+import { createServer } from 'node:http'
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { generateKeyPairSync } from 'node:crypto'
+
+const PORT = Number(process.env.PORT || '3000')
+const KEY_REF_PATH = process.env.KMS_KEY_REF_PATH || '/data/kms-key-ref.json'
+const KEY_ID = process.env.KMS_KEY_ID || 'local-simulation-kms-key'
+
+function ensureKeyRef() {
+  if (existsSync(KEY_REF_PATH)) {
+    return JSON.parse(readFileSync(KEY_REF_PATH, 'utf8'))
+  }
+  mkdirSync(dirname(KEY_REF_PATH), { recursive: true })
+  const pair = generateKeyPairSync('ed25519', {
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+  })
+  const ref = {
+    schema: 'enigma.local_simulation_kms_key_ref.v1',
+    key_id: KEY_ID,
+    alg: 'Ed25519',
+    public_key: pair.publicKey,
+    private_key: pair.privateKey,
+    claim_boundary: 'local-simulation only. This is not HSM-grade key custody.',
+  }
+  writeFileSync(KEY_REF_PATH, JSON.stringify(ref, null, 2))
+  return ref
+}
+
+const keyRef = ensureKeyRef()
+
+const server = createServer((req, res) => {
+  if (req.method === 'GET' && req.url === '/healthz') {
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: true, service: 'kms-mock', key_id: keyRef.key_id }))
+    return
+  }
+  if (req.method === 'GET' && req.url === '/') {
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(
+      JSON.stringify({
+        schema: keyRef.schema,
+        key_id: keyRef.key_id,
+        alg: keyRef.alg,
+        public_key: keyRef.public_key,
+        claim_boundary: keyRef.claim_boundary,
+      })
+    )
+    return
+  }
+  res.writeHead(404, { 'content-type': 'application/json; charset=utf-8' })
+  res.end(JSON.stringify({ ok: false, error: 'not found' }))
+})
+
+server.listen(PORT, '0.0.0.0', () => {
+  process.stdout.write(
+    `${JSON.stringify({ ok: true, service: 'kms-mock', listening: true, port: PORT, key_id: keyRef.key_id })}\n`
+  )
+})

package/deploy/nginx.local-production-simulation.conf

@@ -0,0 +1,33 @@
+# Enigma Memory — local-simulation TLS termination.
+# CLAIM BOUNDARY: local-simulation only. Uses the self-signed certificate
+# generated by scripts/simulate-production-env.mjs; not production TLS.
+
+server {
+  listen 8443 ssl;
+  server_name localhost sim.enigmamemory.com relay.sim.enigmamemory.com *.sim.enigmamemory.com;
+
+  ssl_certificate /etc/nginx/ssl/tls.crt;
+  ssl_certificate_key /etc/nginx/ssl/tls.key;
+
+  location / {
+    proxy_pass http://relay:8787;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_http_version 1.1;
+  }
+}
+
+server {
+  listen 9443 ssl;
+  server_name localhost sim.enigmamemory.com gateway.sim.enigmamemory.com *.sim.enigmamemory.com;
+
+  ssl_certificate /etc/nginx/ssl/tls.crt;
+  ssl_certificate_key /etc/nginx/ssl/tls.key;
+
+  location / {
+    proxy_pass http://gateway:8797;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_http_version 1.1;
+  }
+}

package/deploy/siem-mock.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// Enigma Memory — local-simulation SIEM audit-sink mock.
+// CLAIM BOUNDARY: local-simulation only. Stores minimized event metadata,
+// never raw memory plaintext.
+
+import { createServer } from 'node:http'
+import { createHash } from 'node:crypto'
+import { appendFileSync, mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+
+const PORT = Number(process.env.PORT || '3000')
+const SINK_PATH = process.env.SIEM_SINK_PATH || '/data/siem-events.jsonl'
+
+mkdirSync(dirname(SINK_PATH), { recursive: true })
+
+const server = createServer((req, res) => {
+  if (req.method === 'GET' && req.url === '/healthz') {
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: true, service: 'siem-mock' }))
+    return
+  }
+
+  if (req.method === 'POST' && req.url === '/events') {
+    const chunks = []
+    req.on('data', (chunk) => chunks.push(chunk))
+    req.on('end', () => {
+      const body = Buffer.concat(chunks)
+      const minimized = {
+        received_at: new Date().toISOString(),
+        source_ip: req.socket.remoteAddress,
+        path: req.url,
+        content_length: body.length,
+        content_hash: `sha256:${createHash('sha256').update(body).digest('hex')}`,
+      }
+      appendFileSync(SINK_PATH, `${JSON.stringify(minimized)}\n`)
+      res.writeHead(202, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: true, accepted: true }))
+    })
+    return
+  }
+
+  res.writeHead(404, { 'content-type': 'application/json; charset=utf-8' })
+  res.end(JSON.stringify({ ok: false, error: 'not found' }))
+})
+
+server.listen(PORT, '0.0.0.0', () => {
+  process.stdout.write(
+    `${JSON.stringify({ ok: true, service: 'siem-mock', listening: true, port: PORT, sink: SINK_PATH })}\n`
+  )
+})