Sphinx HTML and 17-page LaTeX PDF for the audit-ready pack

source/ is the Sphinx tree. Companion PDF hrefs are relative, not Markdown.

source/architecture.rst

@@ -0,0 +1,43 @@
+Architecture (audit interview)
+==============================
+
+::
+
+   Endpoint (keys stay here / HSM)
+       │  HPKE content (NPE suite)
+       │  routing: dest + subject in the clear
+       ▼
+   Untrusted NATS (cannot read bodies)
+       │
+       ▼
+   Verae DataCube chain (append-only hashes)
+       │  written through Peergos client
+       ▼
+   Peergos cryptree (encrypted names, sizes, graph)
+       │  chunks → CID / hash
+       ▼
+   IPFS  (distributed, hash-verified ciphertext)
+
+* **At rest:** Peergos cryptree + IPFS. Hosts with disk/backup see
+  **opaque hashed ciphertext**, not PHI, if they lack keys.
+* **In transit (NATS):** HPKE-Base to directory public keys. Broker is
+  honest-but-curious: destinations yes, bodies no.
+* **Integrity:** cube JSONL chain + dual hash + IPFS CID check on
+  restore (re-fetch blocks, re-verify hashes — not a plaintext tape).
+
+NATS remains an untrusted router. Production E2E is NPE/HPKE.
+Passthrough means destination in the clear; the body is ciphertext.
+
+.. only:: html
+
+   Live: https://pfc.georgelambert.org/v1/npe/keys (public keys only).
+   Controls: https://docs.pfc.georgelambert.org/controls.html
+
+.. only:: latex
+
+   See companion ``peergos-for-compliance.pdf`` (same folder) for
+   controls, custody, and variables chapters.
+
+   .. raw:: latex
+
+      \href{peergos-for-compliance.pdf}{peergos-for-compliance.pdf}