Rebrand SooSeF to FieldWitness

Complete project rebrand for better positioning in the press freedom and digital security space. FieldWitness communicates both field deployment and evidence testimony — appropriate for the target audience of journalists, NGOs, and human rights organizations. Rename mapping: - soosef → fieldwitness (package, CLI, all imports) - soosef.stegasoo → fieldwitness.stego - soosef.verisoo → fieldwitness.attest - ~/.soosef/ → ~/.fwmetadata/ (innocuous data dir name) - SOOSEF_DATA_DIR → FIELDWITNESS_DATA_DIR - SoosefConfig → FieldWitnessConfig - SoosefError → FieldWitnessError Also includes: - License switch from MIT to GPL-3.0 - C2PA bridge module (Phase 0-2 MVP): cert.py, export.py, vendor_assertions.py - README repositioned to lead with provenance/federation, stego backgrounded - Threat model skeleton at docs/security/threat-model.md - Planning docs: docs/planning/c2pa-integration.md, docs/planning/gtm-feasibility.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-02 15:05:13 -04:00
parent 6325e86873
commit 490f9d4a1d
188 changed files with 4588 additions and 2017 deletions
--- a/docs/training/admin-operations-guide.md
+++ b/docs/training/admin-operations-guide.md
@@ -1,7 +1,7 @@
-# SooSeF Admin Operations Guide
+# FieldWitness Admin Operations Guide

 **Audience**: IT administrators, system operators, and technically competent journalists
-responsible for deploying, configuring, and maintaining SooSeF instances for their
+responsible for deploying, configuring, and maintaining FieldWitness instances for their
 organization.

 **Prerequisites**: Familiarity with Linux command line, Docker basics, and SSH. For Tier 1
@@ -15,9 +15,9 @@ This guide covers the operational tasks an admin performs after initial deployme
 installation and deployment, see [deployment.md](../deployment.md). For architecture
 details, see [docs/architecture/](../architecture/).

-Your responsibilities as a SooSeF admin:
+Your responsibilities as a FieldWitness admin:

-1. Deploy and maintain SooSeF instances (Tier 1 USB, Tier 2 server, Tier 3 relay)
+1. Deploy and maintain FieldWitness instances (Tier 1 USB, Tier 2 server, Tier 3 relay)
 2. Manage user accounts and access
 3. Configure threat level presets for your environment
 4. Manage the source drop box
@@ -42,7 +42,7 @@ Each user has:

 From the admin panel, issue a temporary password for a locked-out user. The user should
 change it on next login. All password resets are recorded in the audit log
-(`~/.soosef/audit.jsonl`).
+(`~/.fwmetadata/audit.jsonl`).

 ### Account Lockout

@@ -54,7 +54,7 @@ For persistent lockout (e.g., a compromised account), delete the user from the a

 ### Audit Trail

-All admin actions are logged to `~/.soosef/audit.jsonl` in JSON-lines format:
+All admin actions are logged to `~/.fwmetadata/audit.jsonl` in JSON-lines format:

 ```json
 {"timestamp": "2026-04-01T12:00:00+00:00", "actor": "admin", "action": "user.create", "target": "user:reporter1", "outcome": "success", "source": "web"}
@@ -70,13 +70,13 @@ Actions logged: `user.create`, `user.delete`, `user.password_reset`,

 ## 2. Threat Level Configuration

-SooSeF ships four presets at `deploy/config-presets/`. Select based on your operational
+FieldWitness ships four presets at `deploy/config-presets/`. Select based on your operational
 environment.

 ### Applying a Preset

 ```bash
-$ cp deploy/config-presets/high-threat.json ~/.soosef/config.json
+$ cp deploy/config-presets/high-threat.json ~/.fwmetadata/config.json
 ```

 Restart the server to apply.
@@ -92,7 +92,7 @@ Restart the server to apply.

 ### Custom Configuration

-Edit `~/.soosef/config.json` directly. All fields have defaults. Key fields for security:
+Edit `~/.fwmetadata/config.json` directly. All fields have defaults. Key fields for security:

 | Field | What It Controls |
 |---|---|
@@ -104,7 +104,7 @@ Edit `~/.soosef/config.json` directly. All fields have defaults. Key fields for
 | `deadman_grace_hours` | Grace period after missed check-in before auto-purge |
 | `deadman_warning_webhook` | URL to POST a JSON warning during grace period |
 | `cover_name` | CN for the self-signed TLS certificate (cover/duress mode) |
-| `backup_reminder_days` | Days before `soosef status` warns about overdue backups |
+| `backup_reminder_days` | Days before `fieldwitness status` warns about overdue backups |

 > **Warning**: Setting `auth_enabled: false` disables all login requirements. Never
 > do this on a network-accessible instance.
@@ -136,14 +136,14 @@ Share the URL over an already-secure channel only:

 ### What Happens When a Source Uploads

-1. The source opens the URL in any browser (no account needed, no SooSeF branding)
+1. The source opens the URL in any browser (no account needed, no FieldWitness branding)
 2. Their browser computes SHA-256 hashes client-side before upload (SubtleCrypto)
 3. Files are uploaded and processed:
   - EXIF metadata is extracted (evidentiary fields: GPS, timestamp)
   - All metadata is stripped from the stored copy (protects source device info)
   - The original bytes are attested (signed) before stripping
 4. The source receives a receipt code (HMAC of file hash + token)
-5. Files are stored in `~/.soosef/temp/dropbox/` with mode 0700
+5. Files are stored in `~/.fwmetadata/temp/dropbox/` with mode 0700

 ### Revoking Tokens

@@ -157,16 +157,16 @@ their receipt code. This returns the filename, SHA-256, and reception timestamp.

 ### Operational Security

- The upload page has no SooSeF branding -- it is a minimal HTML form
+- The upload page has no FieldWitness branding -- it is a minimal HTML form
 - No external resources are loaded (no CDN, fonts, analytics) -- Tor Browser compatible
- SooSeF does not log source IP addresses
+- FieldWitness does not log source IP addresses
 - If using a reverse proxy (nginx, Caddy), disable access logging for `/dropbox/upload/`
 - Tokens auto-expire and are cleaned up on every admin page load
- For maximum source protection, run SooSeF as a Tor hidden service
+- For maximum source protection, run FieldWitness as a Tor hidden service

 ### Storage Management

-Uploaded files accumulate in `~/.soosef/temp/dropbox/`. Periodically review and process
+Uploaded files accumulate in `~/.fwmetadata/temp/dropbox/`. Periodically review and process
 submissions, then remove them from the temp directory. The files are not automatically
 cleaned up (they persist until you act on them or the killswitch fires).

@@ -176,34 +176,34 @@ cleaned up (they persist until you act on them or the killswitch fires).

 ### Two Key Domains

-SooSeF manages two independent key types:
+FieldWitness manages two independent key types:

 | Key | Algorithm | Location | Purpose |
 |---|---|---|---|
-| **Identity key** | Ed25519 | `~/.soosef/identity/` | Sign attestations, chain records |
-| **Channel key** | AES-256-GCM (Argon2id-derived) | `~/.soosef/stegasoo/channel.key` | Steganographic encoding |
+| **Identity key** | Ed25519 | `~/.fwmetadata/identity/` | Sign attestations, chain records |
+| **Channel key** | AES-256-GCM (Argon2id-derived) | `~/.fwmetadata/stego/channel.key` | Steganographic encoding |

 These are never merged. Rotating one does not affect the other.

 ### Key Rotation

 **Identity rotation** archives the old keypair and generates a new one. If the chain is
-enabled, a `soosef/key-rotation-v1` record is signed by the OLD key, creating a
+enabled, a `fieldwitness/key-rotation-v1` record is signed by the OLD key, creating a
 verifiable trust chain.

 ```bash
-$ soosef keys rotate-identity
+$ fieldwitness keys rotate-identity
 ```

 After rotating, immediately:
-1. Take a fresh backup (`soosef keys export`)
+1. Take a fresh backup (`fieldwitness keys export`)
 2. Notify all collaborators of the new fingerprint
 3. Update trusted-key lists at partner organizations

 **Channel rotation** archives the old key and generates a new one:

 ```bash
-$ soosef keys rotate-channel
+$ fieldwitness keys rotate-channel
 ```

 After rotating, share the new channel key with all stego correspondents.
@@ -214,7 +214,7 @@ Import collaborator public keys so you can verify their attestations and accept
 federation bundles:

 ```bash
-$ soosef keys trust --import /media/usb/partner-pubkey.pem
+$ fieldwitness keys trust --import /media/usb/partner-pubkey.pem
 ```

 Always verify fingerprints out-of-band (in person or over a known-secure voice channel).
@@ -222,25 +222,25 @@ Always verify fingerprints out-of-band (in person or over a known-secure voice c
 List trusted keys:

 ```bash
-$ soosef keys show
+$ fieldwitness keys show
 ```

 Remove a trusted key:

 ```bash
-$ soosef keys untrust <fingerprint>
+$ fieldwitness keys untrust <fingerprint>
 ```

 ### Backup Schedule

-SooSeF warns when backups are overdue (configurable via `backup_reminder_days`).
+FieldWitness warns when backups are overdue (configurable via `backup_reminder_days`).

 ```bash
 # Create encrypted backup
-$ soosef keys export -o /media/usb/backup.enc
+$ fieldwitness keys export -o /media/usb/backup.enc

 # Check backup status
-$ soosef status
+$ fieldwitness status
 ```

 Store backups on separate physical media, in a different location from the device.
@@ -249,7 +249,7 @@ Store backups on separate physical media, in a different location from the devic

 ## 5. Federation Setup

-Federation allows multiple SooSeF instances to exchange attestation records.
+Federation allows multiple FieldWitness instances to exchange attestation records.

 ### Adding Federation Peers

@@ -266,19 +266,19 @@ and Ed25519 fingerprint.

 Before two organizations can federate, exchange public keys:

-1. Export your public key: `cp ~/.soosef/identity/public.pem /media/usb/our-pubkey.pem`
+1. Export your public key: `cp ~/.fwmetadata/identity/public.pem /media/usb/our-pubkey.pem`
 2. Give it to the partner organization (physical handoff or secure channel)
-3. Import their key: `soosef keys trust --import /media/usb/their-pubkey.pem`
+3. Import their key: `fieldwitness keys trust --import /media/usb/their-pubkey.pem`
 4. Verify fingerprints out-of-band

 ### Exporting Attestation Bundles

 ```bash
 # Export all records
-$ soosef chain export --output /media/usb/bundle.zip
+$ fieldwitness chain export --output /media/usb/bundle.zip

 # Export a specific range
-$ soosef chain export --start 100 --end 200 --output /media/usb/bundle.zip
+$ fieldwitness chain export --start 100 --end 200 --output /media/usb/bundle.zip

 # Export filtered by investigation
 # (investigation tag is set during attestation)
@@ -296,7 +296,7 @@ On the receiving instance, imported records are:

 If the Tier 2 server and Tier 3 relay have network connectivity, gossip sync runs
 automatically at the configured interval (default: 60 seconds, set via
-`VERISOO_GOSSIP_INTERVAL` environment variable).
+`FIELDWITNESS_GOSSIP_INTERVAL` environment variable).

 Gossip flow:
 1. Nodes exchange Merkle roots
@@ -326,7 +326,7 @@ No network connectivity is required at any point.
 Verify the full chain periodically:

 ```bash
-$ soosef chain verify
+$ fieldwitness chain verify
 ```

 This checks all hash linkage and Ed25519 signatures. It also verifies key rotation
@@ -338,10 +338,10 @@ Anchor the chain head to prove it existed before a given time:

 ```bash
 # Automated (requires network)
-$ soosef chain anchor --tsa https://freetsa.org/tsr
+$ fieldwitness chain anchor --tsa https://freetsa.org/tsr

 # Manual (prints hash for external submission)
-$ soosef chain anchor
+$ fieldwitness chain anchor
 ```

 A single anchor implicitly timestamps every prior record (the chain is append-only).
@@ -358,7 +358,7 @@ For legal discovery or court orders, produce a proof showing specific records wh
 keeping others redacted:

 ```bash
-$ soosef chain disclose -i 42,43,44 -o disclosure.json
+$ fieldwitness chain disclose -i 42,43,44 -o disclosure.json
 ```

 The output includes full records for selected indices and hash-only entries for everything
@@ -370,7 +370,7 @@ else. A third party can verify the selected records are part of an unbroken chai

 ### Evidence Packages

-For handing evidence to lawyers, courts, or organizations without SooSeF:
+For handing evidence to lawyers, courts, or organizations without FieldWitness:

 Self-contained ZIP containing original images, attestation records, chain data, your
 public key, a standalone `verify.py`, and a README. The recipient verifies with:
@@ -413,7 +413,7 @@ Returns capabilities (stego-lsb, stego-dct, attest, fieldkit, chain).
 ### System Status

 ```bash
-$ soosef status --json
+$ fieldwitness status --json
 ```

 Checks: identity key, channel key, chain integrity, dead man's switch state, backup
@@ -440,7 +440,7 @@ The Docker images include `HEALTHCHECK` directives that poll `/health` every 30

 ### Device Seizure (Imminent)

-1. Trigger killswitch: `soosef fieldkit purge --confirm CONFIRM-PURGE`
+1. Trigger killswitch: `fieldwitness fieldkit purge --confirm CONFIRM-PURGE`
 2. For Tier 1 USB: pull the USB stick and destroy it physically if possible
 3. Verify with a separate device that federation copies are intact

@@ -465,8 +465,8 @@ The Docker images include `HEALTHCHECK` directives that poll `/health` every 30
 Data is gone. Restore from the most recent backup:

 ```bash
-$ soosef init
-$ soosef keys import -b /media/usb/backup.enc
+$ fieldwitness init
+$ fieldwitness keys import -b /media/usb/backup.enc
 ```

 Federation copies of attestation data are unaffected. Local attestations created since
@@ -480,22 +480,22 @@ the last federation sync or backup are lost.

 | Task | Frequency | Command |
 |---|---|---|
-| Check system status | Daily | `soosef status` |
-| Check in (if deadman armed) | Per interval | `soosef fieldkit checkin` |
-| Backup keys | Per `backup_reminder_days` | `soosef keys export` |
-| Verify chain integrity | Weekly | `soosef chain verify` |
-| Anchor chain | Weekly | `soosef chain anchor` |
+| Check system status | Daily | `fieldwitness status` |
+| Check in (if deadman armed) | Per interval | `fieldwitness fieldkit checkin` |
+| Backup keys | Per `backup_reminder_days` | `fieldwitness keys export` |
+| Verify chain integrity | Weekly | `fieldwitness chain verify` |
+| Anchor chain | Weekly | `fieldwitness chain anchor` |
 | Review drop box submissions | As needed | `/dropbox/admin` |
-| Clean temp files | Monthly | Remove processed files from `~/.soosef/temp/` |
+| Clean temp files | Monthly | Remove processed files from `~/.fwmetadata/temp/` |
 | Create cold archive | Monthly | Export via CLI or web |
-| Update SooSeF | As releases are available | `pip install --upgrade soosef` |
+| Update FieldWitness | As releases are available | `pip install --upgrade fieldwitness` |

 ### Docker Volume Backup

 ```bash
 $ docker compose stop server
 $ docker run --rm -v server-data:/data -v /backup:/backup \
-    busybox tar czf /backup/soosef-$(date +%Y%m%d).tar.gz -C /data .
+    busybox tar czf /backup/fieldwitness-$(date +%Y%m%d).tar.gz -C /data .
 $ docker compose start server
 ```

@@ -505,8 +505,8 @@ $ docker compose start server
 periodically. The audit log is append-only; truncate by copying the tail:

 ```bash
-$ tail -n 10000 ~/.soosef/audit.jsonl > ~/.soosef/audit.jsonl.tmp
-$ mv ~/.soosef/audit.jsonl.tmp ~/.soosef/audit.jsonl
+$ tail -n 10000 ~/.fwmetadata/audit.jsonl > ~/.fwmetadata/audit.jsonl.tmp
+$ mv ~/.fwmetadata/audit.jsonl.tmp ~/.fwmetadata/audit.jsonl
 ```

 > **Warning**: Truncating the audit log removes historical records. Archive the full
--- a/docs/training/admin-reference.md
+++ b/docs/training/admin-reference.md
@@ -1,7 +1,7 @@
 # Administrator Quick Reference

 **Audience**: IT staff and technical leads responsible for deploying and maintaining
-SooSeF instances.
+FieldWitness instances.

 ---

@@ -47,23 +47,23 @@ Exposes port 8001 (federation API only).
 ### Kubernetes

 ```bash
-$ docker build -t soosef-server --target server -f deploy/docker/Dockerfile .
-$ docker build -t soosef-relay --target relay -f deploy/docker/Dockerfile .
+$ docker build -t fieldwitness-server --target server -f deploy/docker/Dockerfile .
+$ docker build -t fieldwitness-relay --target relay -f deploy/docker/Dockerfile .
 $ kubectl apply -f deploy/kubernetes/namespace.yaml
 $ kubectl apply -f deploy/kubernetes/server-deployment.yaml
 $ kubectl apply -f deploy/kubernetes/relay-deployment.yaml
 ```

-Single-replica only. SooSeF uses SQLite -- do not scale horizontally.
+Single-replica only. FieldWitness uses SQLite -- do not scale horizontally.

 ---

 ## Threat Level Presets

-Copy the appropriate preset to configure SooSeF for the operational environment:
+Copy the appropriate preset to configure FieldWitness for the operational environment:

 ```bash
-$ cp deploy/config-presets/<level>-threat.json ~/.soosef/config.json
+$ cp deploy/config-presets/<level>-threat.json ~/.fwmetadata/config.json
 ```

 | Level | Session | Killswitch | Dead Man | Cover Name |
@@ -81,45 +81,45 @@ $ cp deploy/config-presets/<level>-threat.json ~/.soosef/config.json

 | Command | Description |
 |---|---|
-| `soosef init` | Create directory structure, generate keys, write default config |
-| `soosef serve --host 0.0.0.0` | Start web UI (LAN-accessible) |
-| `soosef status` | Pre-flight check: keys, chain, deadman, backup, geofence |
-| `soosef status --json` | Machine-readable status output |
+| `fieldwitness init` | Create directory structure, generate keys, write default config |
+| `fieldwitness serve --host 0.0.0.0` | Start web UI (LAN-accessible) |
+| `fieldwitness status` | Pre-flight check: keys, chain, deadman, backup, geofence |
+| `fieldwitness status --json` | Machine-readable status output |

 ### Keys

 | Command | Description |
 |---|---|
-| `soosef keys show` | Display current key info and fingerprints |
-| `soosef keys export -o backup.enc` | Export encrypted key bundle |
-| `soosef keys import -b backup.enc` | Import key bundle from backup |
-| `soosef keys rotate-identity` | Rotate Ed25519 identity (records in chain) |
-| `soosef keys rotate-channel` | Rotate AES-256-GCM channel key |
-| `soosef keys trust --import pubkey.pem` | Trust a collaborator's public key |
+| `fieldwitness keys show` | Display current key info and fingerprints |
+| `fieldwitness keys export -o backup.enc` | Export encrypted key bundle |
+| `fieldwitness keys import -b backup.enc` | Import key bundle from backup |
+| `fieldwitness keys rotate-identity` | Rotate Ed25519 identity (records in chain) |
+| `fieldwitness keys rotate-channel` | Rotate AES-256-GCM channel key |
+| `fieldwitness keys trust --import pubkey.pem` | Trust a collaborator's public key |

 ### Fieldkit

 | Command | Description |
 |---|---|
-| `soosef fieldkit status` | Show fieldkit state (deadman, geofence, USB, tamper) |
-| `soosef fieldkit checkin` | Reset dead man's switch timer |
-| `soosef fieldkit check-deadman` | Check if deadman timer expired (for cron) |
-| `soosef fieldkit purge --confirm CONFIRM-PURGE` | Activate killswitch |
-| `soosef fieldkit geofence set --lat X --lon Y --radius M` | Set GPS boundary |
-| `soosef fieldkit usb snapshot` | Record USB whitelist baseline |
-| `soosef fieldkit tamper baseline` | Record file integrity baseline |
+| `fieldwitness fieldkit status` | Show fieldkit state (deadman, geofence, USB, tamper) |
+| `fieldwitness fieldkit checkin` | Reset dead man's switch timer |
+| `fieldwitness fieldkit check-deadman` | Check if deadman timer expired (for cron) |
+| `fieldwitness fieldkit purge --confirm CONFIRM-PURGE` | Activate killswitch |
+| `fieldwitness fieldkit geofence set --lat X --lon Y --radius M` | Set GPS boundary |
+| `fieldwitness fieldkit usb snapshot` | Record USB whitelist baseline |
+| `fieldwitness fieldkit tamper baseline` | Record file integrity baseline |

 ### Chain and Evidence

 | Command | Description |
 |---|---|
-| `soosef chain status` | Show chain head, length, integrity |
-| `soosef chain verify` | Verify full chain (hashes + signatures) |
-| `soosef chain log --count 20` | Show recent chain entries |
-| `soosef chain export -o bundle.zip` | Export attestation bundle |
-| `soosef chain disclose -i 5,12,47 -o disclosure.json` | Selective disclosure |
-| `soosef chain anchor` | Manual anchor (prints hash for external witness) |
-| `soosef chain anchor --tsa https://freetsa.org/tsr` | RFC 3161 automated anchor |
+| `fieldwitness chain status` | Show chain head, length, integrity |
+| `fieldwitness chain verify` | Verify full chain (hashes + signatures) |
+| `fieldwitness chain log --count 20` | Show recent chain entries |
+| `fieldwitness chain export -o bundle.zip` | Export attestation bundle |
+| `fieldwitness chain disclose -i 5,12,47 -o disclosure.json` | Selective disclosure |
+| `fieldwitness chain anchor` | Manual anchor (prints hash for external witness) |
+| `fieldwitness chain anchor --tsa https://freetsa.org/tsr` | RFC 3161 automated anchor |

 ---

@@ -132,7 +132,7 @@ The web UI admin panel at `/admin` provides:
 - Reset passwords (temporary password issued)
 - View active sessions

-User credentials are stored in SQLite at `~/.soosef/auth/soosef.db`.
+User credentials are stored in SQLite at `~/.fwmetadata/auth/fieldwitness.db`.

 ---

@@ -140,9 +140,9 @@ User credentials are stored in SQLite at `~/.soosef/auth/soosef.db`.

 | What | How often | Command |
 |---|---|---|
-| Key bundle | After every rotation, weekly minimum | `soosef keys export -o backup.enc` |
-| Cold archive | Weekly or before travel | `soosef archive export --include-keys -o archive.zip` |
-| Docker volume | Before updates | `docker compose stop server && docker run --rm -v server-data:/data -v /backup:/backup busybox tar czf /backup/soosef-$(date +%Y%m%d).tar.gz -C /data .` |
+| Key bundle | After every rotation, weekly minimum | `fieldwitness keys export -o backup.enc` |
+| Cold archive | Weekly or before travel | `fieldwitness archive export --include-keys -o archive.zip` |
+| Docker volume | Before updates | `docker compose stop server && docker run --rm -v server-data:/data -v /backup:/backup busybox tar czf /backup/fieldwitness-$(date +%Y%m%d).tar.gz -C /data .` |

 Store backups on separate physical media. Keep one copy offsite.

@@ -151,11 +151,11 @@ Store backups on separate physical media. Keep one copy offsite.
 ## Federation Setup

 1. Exchange public keys between organizations (verify fingerprints out-of-band)
-2. Import collaborator keys: `soosef keys trust --import /path/to/pubkey.pem`
+2. Import collaborator keys: `fieldwitness keys trust --import /path/to/pubkey.pem`
 3. Register peers via web UI at `/federation` or via CLI
 4. Gossip starts automatically; monitor at `/federation`

-For airgapped federation: `soosef chain export` to USB, carry to partner, import there.
+For airgapped federation: `fieldwitness chain export` to USB, carry to partner, import there.

 ---

@@ -177,7 +177,7 @@ For airgapped federation: `soosef chain export` to USB, carry to partner, import
 - [ ] Disable unnecessary services (bluetooth, avahi-daemon)
 - [ ] Apply a threat level preset appropriate for the environment
 - [ ] Set `cover_name` in config if operating under cover
- [ ] Set `SOOSEF_DATA_DIR` to an inconspicuous path if needed
+- [ ] Set `FIELDWITNESS_DATA_DIR` to an inconspicuous path if needed
 - [ ] Enable HTTPS (default) or place behind a reverse proxy with TLS
 - [ ] Create systemd service for bare metal (see `docs/deployment.md` Section 7)
 - [ ] Set up regular backups (key bundle + cold archive)
@@ -194,11 +194,11 @@ For airgapped federation: `soosef chain export` to USB, carry to partner, import
 | Web UI unreachable from LAN | `host` must be `0.0.0.0`, not `127.0.0.1`. Check firewall. |
 | Docker container exits | `docker compose logs server` -- check for port conflict or volume permissions |
 | Dead man fires unexpectedly | Service crashed and exceeded interval+grace. Ensure `Restart=on-failure`. |
-| Permission errors on `~/.soosef/` | Run SooSeF as the same user who ran `soosef init` |
+| Permission errors on `~/.fwmetadata/` | Run FieldWitness as the same user who ran `fieldwitness init` |
 | Drop box tokens expire immediately | System clock wrong. Run `date -u` and fix if needed. |
 | Chain anchor TSA fails | Requires network. Use manual anchor on airgapped devices. |
 | Account locked out | Wait for lockout to expire, or restart the server. |
-| SSL cert shows wrong name | Delete `~/.soosef/certs/cert.pem`, set `cover_name`, restart. |
+| SSL cert shows wrong name | Delete `~/.fwmetadata/certs/cert.pem`, set `cover_name`, restart. |

 ---

@@ -215,5 +215,5 @@ $ curl http://localhost:8000/health
 $ curl http://localhost:8001/health

 # Full system status
-$ soosef status --json
+$ fieldwitness status --json
 ```
--- a/docs/training/emergency-card.md
+++ b/docs/training/emergency-card.md
@@ -1,6 +1,6 @@
 # Emergency Reference Card

-**Audience**: All SooSeF users. Print, laminate, and carry in your wallet.
+**Audience**: All FieldWitness users. Print, laminate, and carry in your wallet.

 ---

@@ -17,7 +17,7 @@ In the browser: **Fieldkit** > **Emergency Purge** > type `CONFIRM-PURGE` > clic
 From a terminal:

 ```
-soosef fieldkit purge --confirm CONFIRM-PURGE
+fieldwitness fieldkit purge --confirm CONFIRM-PURGE
 ```

 ### Option 3: Hardware button (Raspberry Pi only)
@@ -51,7 +51,7 @@ If enabled, you must check in before the deadline or all data will be destroyed.

 **Check in**: Browser > **Fieldkit** > **Check In**

-Or: `soosef fieldkit checkin`
+Or: `fieldwitness fieldkit checkin`

 If you cannot check in, contact your editor. They may be able to disarm it remotely.

--- a/docs/training/reporter-field-guide.md
+++ b/docs/training/reporter-field-guide.md
@@ -1,22 +1,22 @@
-# SooSeF Reporter Field Guide
+# FieldWitness Reporter Field Guide

-**Audience**: Reporters, field researchers, and documentarians using SooSeF to protect
+**Audience**: Reporters, field researchers, and documentarians using FieldWitness to protect
 and verify their work. No technical background required.

-**Prerequisites**: A working SooSeF instance (Tier 1 USB or web UI access to a Tier 2
+**Prerequisites**: A working FieldWitness instance (Tier 1 USB or web UI access to a Tier 2
 server). Your IT admin should have set this up for you.

 ---

-## What SooSeF Does For You
+## What FieldWitness Does For You

-SooSeF helps you do three things:
+FieldWitness helps you do three things:

 1. **Prove your photos and files are authentic** -- every photo you attest gets a
   cryptographic signature that proves you took it, when, and that it has not been
   tampered with since.
 2. **Hide messages in images** -- send encrypted messages that look like ordinary photos.
-3. **Destroy everything if compromised** -- if your device is about to be seized, SooSeF
+3. **Destroy everything if compromised** -- if your device is about to be seized, FieldWitness
   can erase all evidence of itself and your data in seconds.

 ---
@@ -37,7 +37,7 @@ permanent, tamper-evident record.
 5. Add a location if relevant (optional)
 6. Click **Attest**

-SooSeF will:
+FieldWitness will:
 - Extract GPS coordinates and timestamp from the photo's EXIF data (for the provenance record)
 - Strip device-identifying information (serial numbers, firmware version) from the stored copy
 - Sign the photo with your Ed25519 identity key
@@ -46,7 +46,7 @@ SooSeF will:
 **Through the CLI (if available):**

 ```bash
-$ soosef attest IMAGE photo.jpg --caption "Market protest, central square"
+$ fieldwitness attest IMAGE photo.jpg --caption "Market protest, central square"
 ```

 > **Warning**: Attest the original, unedited photo. If you crop, filter, or resize
@@ -57,12 +57,12 @@ $ soosef attest IMAGE photo.jpg --caption "Market protest, central square"
 If you have a folder of photos from a field visit:

 ```bash
-$ soosef attest batch ./field-photos/ --caption "Site visit 2026-04-01"
+$ fieldwitness attest batch ./field-photos/ --caption "Site visit 2026-04-01"
 ```

 ### Checking Your Status

-Run `soosef status` or visit the web UI home page to see:
+Run `fieldwitness status` or visit the web UI home page to see:
 - Whether your identity key is set up
 - How many attestations you have
 - Whether your dead man's switch needs a check-in
@@ -92,7 +92,7 @@ message, passphrase, and PIN.
 **CLI:**

 ```bash
-$ soosef stego encode vacation.jpg -r shared_photo.jpg -m "Meeting moved to Thursday"
+$ fieldwitness stego encode vacation.jpg -r shared_photo.jpg -m "Meeting moved to Thursday"
 #   Passphrase: (enter your passphrase, hidden)
 #   PIN: (enter your PIN, hidden)
 ```
@@ -101,22 +101,22 @@ The output is a normal-looking image file that contains your hidden message.

 ### Transport-Aware Encoding

-If you are sending the image through a messaging app, tell SooSeF which platform. The
-app will recompress images, so SooSeF needs to use a survival-resistant encoding:
+If you are sending the image through a messaging app, tell FieldWitness which platform. The
+app will recompress images, so FieldWitness needs to use a survival-resistant encoding:

 ```bash
-$ soosef stego encode photo.jpg -r shared.jpg -m "Safe house confirmed" --transport whatsapp
-$ soosef stego encode photo.jpg -r shared.jpg -m "Safe house confirmed" --transport signal
-$ soosef stego encode photo.jpg -r shared.jpg -m "Safe house confirmed" --transport telegram
+$ fieldwitness stego encode photo.jpg -r shared.jpg -m "Safe house confirmed" --transport whatsapp
+$ fieldwitness stego encode photo.jpg -r shared.jpg -m "Safe house confirmed" --transport signal
+$ fieldwitness stego encode photo.jpg -r shared.jpg -m "Safe house confirmed" --transport telegram
 ```

-> **Warning**: Never reuse the same carrier image twice. SooSeF will warn you if you
+> **Warning**: Never reuse the same carrier image twice. FieldWitness will warn you if you
 > do. Comparing two versions of the same image trivially reveals steganographic changes.

 ### Decoding a Message

 ```bash
-$ soosef stego decode received_image.jpg -r shared_photo.jpg
+$ fieldwitness stego decode received_image.jpg -r shared_photo.jpg
 #   Passphrase: (same passphrase)
 #   PIN: (same PIN)
 ```
@@ -126,7 +126,7 @@ $ soosef stego decode received_image.jpg -r shared_photo.jpg
 ## Check-In (Dead Man's Switch)

 If your admin has enabled the dead man's switch, you must check in regularly. If you miss
-your check-in window, SooSeF assumes something has gone wrong and will eventually destroy
+your check-in window, FieldWitness assumes something has gone wrong and will eventually destroy
 all data to protect you.

 **Check in through the web UI:** Visit the **Fieldkit** page and click **Check In**.
@@ -134,7 +134,7 @@ all data to protect you.
 **Check in through the CLI:**

 ```bash
-$ soosef fieldkit checkin
+$ fieldwitness fieldkit checkin
 ```

 > **Warning**: If you will be unable to check in (traveling without the device, planned
@@ -150,7 +150,7 @@ If your device is about to be seized or compromised:
 **CLI:**

 ```bash
-$ soosef fieldkit purge --confirm CONFIRM-PURGE
+$ fieldwitness fieldkit purge --confirm CONFIRM-PURGE
 ```

 **Web UI:** Visit the **Fieldkit** page and use the emergency purge button.
@@ -169,9 +169,9 @@ access.
 4. All attestation records and chain data
 5. Temporary files and audit logs
 6. Configuration
-7. System log entries mentioning SooSeF
-8. Python bytecache and pip metadata (to hide that SooSeF was installed)
-9. The SooSeF package itself
+7. System log entries mentioning FieldWitness
+8. Python bytecache and pip metadata (to hide that FieldWitness was installed)
+9. The FieldWitness package itself

 > **Warning**: This is irreversible. Make sure you have recent backups stored
 > separately before relying on the killswitch. See "Backups" below.
@@ -180,25 +180,25 @@ access.

 ## Backups

-Back up your keys regularly. SooSeF will remind you if your backup is overdue.
+Back up your keys regularly. FieldWitness will remind you if your backup is overdue.

 ### Creating a Backup

 ```bash
-$ soosef keys export -o /media/usb/soosef-backup.enc
+$ fieldwitness keys export -o /media/usb/fieldwitness-backup.enc
 ```

 You will be prompted for a passphrase. This creates an encrypted bundle containing your
 identity key and channel key. Store the USB drive **in a different physical location**
-from your SooSeF device.
+from your FieldWitness device.

 ### Restoring From Backup

-On a fresh SooSeF instance:
+On a fresh FieldWitness instance:

 ```bash
-$ soosef init
-$ soosef keys import -b /media/usb/soosef-backup.enc
+$ fieldwitness init
+$ fieldwitness keys import -b /media/usb/fieldwitness-backup.enc
 ```

 ---
@@ -206,11 +206,11 @@ $ soosef keys import -b /media/usb/soosef-backup.enc
 ## Evidence Packages

 When you need to hand evidence to a lawyer, a court, or a partner organization that does
-not use SooSeF:
+not use FieldWitness:

 1. Go to the web UI or use the CLI to create an evidence package
 2. Select the photos to include
-3. SooSeF creates a ZIP file containing:
+3. FieldWitness creates a ZIP file containing:
   - Your original photos
   - Attestation records with signatures
   - The chain segment proving order and integrity
@@ -218,7 +218,7 @@ not use SooSeF:
   - A standalone verification script
   - A README with instructions

-The recipient can verify the evidence using only Python -- they do not need SooSeF.
+The recipient can verify the evidence using only Python -- they do not need FieldWitness.

 ---

@@ -238,7 +238,7 @@ encrypted with keys derived from the passphrase, PIN, and reference photo. If yo
 any of the three, the message cannot be recovered.

 **You need to share evidence with a court**: Use selective disclosure
-(`soosef chain disclose`) to produce a proof that includes only the specific records
+(`fieldwitness chain disclose`) to produce a proof that includes only the specific records
 requested. The court can verify these records are part of an authentic, unbroken chain
 without seeing your other work.

@@ -259,5 +259,5 @@ the killswitch fires automatically.
 - **Back up regularly** and store backups in a separate physical location.
 - **Lock the browser** or close it when you walk away. Session timeouts help, but do not
  rely on them.
- **Do not discuss SooSeF by name** in environments where your communications may be
+- **Do not discuss FieldWitness by name** in environments where your communications may be
  monitored. If `cover_name` is configured, the tool presents itself under that name.
--- a/docs/training/reporter-quickstart.md
+++ b/docs/training/reporter-quickstart.md
@@ -1,6 +1,6 @@
 # Reporter Quick-Start Card

-**Audience**: Field reporters using a SooSeF Tier 1 bootable USB device.
+**Audience**: Field reporters using a FieldWitness Tier 1 bootable USB device.
 No technical background assumed.

 **Print this page on a single sheet, laminate it, and keep it with the USB stick.**
@@ -14,7 +14,7 @@ No technical background assumed.
 3. **Enter your passphrase** when the blue screen appears (this unlocks your data)
 4. **Wait for the browser** to open automatically

-You are now running SooSeF. The laptop's own hard drive is never touched.
+You are now running FieldWitness. The laptop's own hard drive is never touched.

 ---

@@ -54,7 +54,7 @@ If your admin has enabled the dead man's switch, you must check in regularly.
 Or from a terminal:

 ```
-soosef fieldkit checkin
+fieldwitness fieldkit checkin
 ```

 If you miss your check-in window, the system will destroy all data after the grace period.
@@ -80,7 +80,7 @@ Everything is gone. Keys, photos, attestations, messages -- all destroyed.
 1. **Close the browser**
 2. **Pull the USB stick**

-The laptop returns to its normal state. No trace of SooSeF remains.
+The laptop returns to its normal state. No trace of FieldWitness remains.

 ---