S17/S18: send success and failure routes; Sphinx HTML/PDF

Python router + Go sm-leaf reject missing to, empty ct, plaintext body.
Summary logs never include ciphertext. MODULE.md.

go/internal/leaf/leaf.go

@@ -64,8 +64,7 @@ func (n *Node) subscribe() error {
 		}
 	}
 	if _, err := n.nc.Subscribe("verae.sm.send", func(msg *nats.Msg) {
-		// Passthrough: do not log ciphertext.
-		ack(msg, []byte(`{"accepted":true}`))
+		n.handleSend(msg)
 	}); err != nil {
 		return err
 	}
@@ -82,6 +81,12 @@ func (n *Node) subscribe() error {
 	if _, err := n.nc.Subscribe("verae.sm.log.summary", func(msg *nats.Msg) {
 		var hdr map[string]any
 		_ = json.Unmarshal(msg.Data, &hdr)
+		// Summary only: never log ciphertext or recipient payload.
+		if _, ok := hdr["ct"]; ok {
+			log.Printf("sm-summary rejected body-like field")
+			ack(msg, []byte(`{"logged":false,"error":"body-like fields present"}`))
+			return
+		}
 		log.Printf("sm-summary code=%v lookup=%v class=%v", hdr["error_code"], hdr["lookup_id"], hdr["dest_class"])
 		ack(msg, []byte(`{"logged":true}`))
 	}); err != nil {
@@ -90,6 +95,57 @@ func (n *Node) subscribe() error {
 	return nil
 }
 
+func (n *Node) handleSend(msg *nats.Msg) {
+	var env map[string]any
+	if err := json.Unmarshal(msg.Data, &env); err != nil {
+		n.fail(msg, "SM-BAD-JSON", "parse", "")
+		return
+	}
+	to, _ := env["to"].(string)
+	alg, _ := env["alg"].(string)
+	ct, _ := env["ct"].(string)
+	lid, _ := env["from_lookup_id"].(string)
+	if _, hasBody := env["body"]; hasBody {
+		n.fail(msg, "SM-PLAINTEXT-BODY", "mailbox", lid)
+		return
+	}
+	if to == "" {
+		n.fail(msg, "SM-MISSING-TO", "mailbox", lid)
+		return
+	}
+	if alg != "" && alg != "npe" && alg != "lab-xor" && alg != "plain-lab" {
+		n.fail(msg, "SM-BAD-ALG", "mailbox", lid)
+		return
+	}
+	if alg != "plain-lab" && ct == "" {
+		n.fail(msg, "SM-EMPTY-CT", "mailbox", lid)
+		return
+	}
+	ack, _ := json.Marshal(map[string]any{"accepted": true, "lookup_id": lid})
+	if msg.Reply != "" {
+		_ = n.nc.Publish(msg.Reply, ack)
+	}
+}
+
+func (n *Node) fail(msg *nats.Msg, code, destClass, lid string) {
+	summary, _ := json.Marshal(map[string]any{
+		"error_code": code,
+		"lookup_id":  lid,
+		"dest_class": destClass,
+	})
+	_ = n.nc.Publish("verae.sm.log.summary", summary)
+	_ = n.nc.Publish("verae.sm.error", summary)
+	_ = n.nc.Publish("verae.sm.dead", summary)
+	ack, _ := json.Marshal(map[string]any{
+		"accepted":   false,
+		"error_code": code,
+		"lookup_id":  lid,
+	})
+	if msg.Reply != "" {
+		_ = n.nc.Publish(msg.Reply, ack)
+	}
+}
+
 // HealthHandler is the loopback JSON health mux (does not expose NATS).
 func HealthHandler() http.Handler {
 	mux := http.NewServeMux()

go/internal/leaf/leaf_test.go

@@ -56,19 +56,78 @@ func TestSMSubjectsAck(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer n.Shutdown()
-	cases := map[string]string{
-		"verae.sm.send":        `{"accepted":true}`,
+	good := []byte(`{"to":"npe.inbox.x","alg":"lab-xor","ct":"abcd","from_lookup_id":"lid-good"}`)
+	msg, err := n.nc.Request("verae.sm.send", good, time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ack map[string]any
+	if err := json.Unmarshal(msg.Data, &ack); err != nil {
+		t.Fatal(err)
+	}
+	if ack["accepted"] != true || ack["lookup_id"] != "lid-good" {
+		t.Fatalf("good send %s", msg.Data)
+	}
+	for subj, want := range map[string]string{
 		"verae.sm.dead":        `{"queued":true}`,
 		"verae.sm.error":       `{"emitted":true}`,
 		"verae.sm.log.summary": `{"logged":true}`,
-	}
-	for subj, want := range cases {
-		msg, err := n.nc.Request(subj, []byte(`{"lookup_id":"t"}`), time.Second)
+	} {
+		got, err := n.nc.Request(subj, []byte(`{"lookup_id":"t","error_code":"x","dest_class":"mailbox"}`), time.Second)
 		if err != nil {
 			t.Fatalf("%s: %v", subj, err)
 		}
-		if string(msg.Data) != want {
-			t.Fatalf("%s got %s want %s", subj, msg.Data, want)
+		if string(got.Data) != want {
+			t.Fatalf("%s got %s want %s", subj, got.Data, want)
 		}
 	}
 }
+
+func TestSMSendRejectsMissingTo(t *testing.T) {
+	n, err := Start("")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer n.Shutdown()
+	msg, err := n.nc.Request("verae.sm.send", []byte(`{"alg":"lab-xor","ct":"ab"}`), time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ack map[string]any
+	_ = json.Unmarshal(msg.Data, &ack)
+	if ack["accepted"] != false || ack["error_code"] != "SM-MISSING-TO" {
+		t.Fatalf("missing to %s", msg.Data)
+	}
+}
+
+func TestSMSendRejectsEmptyCiphertext(t *testing.T) {
+	n, err := Start("")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer n.Shutdown()
+	msg, err := n.nc.Request("verae.sm.send", []byte(`{"to":"npe.inbox.x","alg":"lab-xor","ct":""}`), time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ack map[string]any
+	_ = json.Unmarshal(msg.Data, &ack)
+	if ack["accepted"] != false || ack["error_code"] != "SM-EMPTY-CT" {
+		t.Fatalf("empty ct %s", msg.Data)
+	}
+}
+
+func TestSMSummaryRejectsCiphertextField(t *testing.T) {
+	n, err := Start("")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer n.Shutdown()
+	msg, err := n.nc.Request("verae.sm.log.summary", []byte(`{"error_code":"x","ct":"secret"}`), time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(msg.Data) == `{"logged":true}` {
+		t.Fatal("must not log body-like fields")
+	}
+}