S26: deploy generates nats.env PSK, FORBID_PLAIN, rebuilt pfc-repl

PDF bundle rsync so relative PDF links resolve on docs.pfc.

Historical-Information.MD

@@ -109,6 +109,12 @@ After a context reset: read this file, then `Remaining-Work.MD`.
 - `sync.pfc.georgelambert.org` Caddy (DNS already pointed at 138).
 - Deep links: console footer, hub `links.html`, `https://georgelambert.org/pfc/` (one page; 70 website repos not rewritten).
 
+## S26 (certification-ready controls, still not a certificate)
+
+- NATS remains **untrusted**. Bodies: `pfc-lab-xor` with host PSK (`PFC_NATS_KEY` + `PFC_FORBID_PLAIN=1`). Python and Go envelopes round-trip the same vector. Production E2E remains NPE/HPKE (`PFC_REQUIRE_NPE` still unset).
+- PDFs link to **sibling PDFs** (`nats-service-endpoints.pdf`, `secure-messaging.pdf`, `peergos-for-compliance.pdf`) — no `.md` hrefs.
+- Controls / custody / variables chapters in the system PDF.
+
 Go `pfc-repl` now serves loopback `GET 127.0.0.1:18784/health`; admin `PFC_REPL_URL` points there. Ingest replicas a/b do not bind HTTP.
 
 ## Do not

TODO.md

@@ -30,3 +30,4 @@ Insert **new** dependencies **above** the blocked item.
 - [x] S23 HTML + LaTeX PDFs (system 32p, catalog 17p, SM 11p)
 - [x] S24 CI run-review expanded; deploy + live revalidate
 - [x] S25 UserReview: HSM custody docs+rotate, npe CLI probe (REQUIRE_NPE unset), sync.pfc Caddy, website deep-links
+- [x] S26 NATS payloads lab-xor (Python+Go match); FORBID_PLAIN on ns1; PDF relative sibling links; controls chapter

cicd/deploy-ns1.sh

@@ -12,10 +12,13 @@ bash "$ROOT/system-git-sync/cicd/run-review.sh"
 echo "=== linux sm-leaf ==="
 mkdir -p "$ROOT/secure-messaging/go/bin"
 ( cd "$ROOT/secure-messaging/go" && GOOS=linux GOARCH=amd64 go build -o bin/sm-leaf-linux ./cmd/sm-leaf )
+echo "=== linux pfc-repl ==="
+( cd "$ROOT/peergos-compliance-go" && GOOS=linux GOARCH=amd64 go build -o /tmp/pfc-repl-linux ./cmd/pfc-repl )
 
 echo "=== rsync ==="
 ssh "$HOST" 'sudo mkdir -p /opt/pfc/bin /opt/pfc/python/secure_messaging /opt/pfc/python/admin /opt/pfc/python/lib /opt/pfc/etc /opt/pfc/data/admin/admin-history /opt/pfc/docs/html/sync /opt/pfc/docs/html/nats-service-endpoints'
 rsync -az "$ROOT/secure-messaging/go/bin/sm-leaf-linux" "$HOST:/tmp/sm-leaf-linux"
+rsync -az /tmp/pfc-repl-linux "$HOST:/tmp/pfc-repl-linux"
 rsync -az --exclude '__pycache__' "$ROOT/secure-messaging/python/secure_messaging/" "$HOST:/tmp/secure_messaging/"
 rsync -az "$ROOT/secure-messaging/deploy/pfc-sm-leaf.service" "$HOST:/tmp/pfc-sm-leaf.service"
 rsync -az "$ROOT/system-git-sync/" --exclude '.git' --exclude '.forgejo' "$HOST:/tmp/system-git-sync/"
@@ -33,6 +36,9 @@ fi
 if [[ -f "$ROOT/peergos-compliance-docs/build/latex/peergos-for-compliance.pdf" ]]; then
   rsync -az "$ROOT/peergos-compliance-docs/build/latex/peergos-for-compliance.pdf" "$HOST:/tmp/pfc-docs.pdf"
 fi
+if [[ -d "$ROOT/peergos-compliance-docs/build/pdf-bundle" ]]; then
+  rsync -az "$ROOT/peergos-compliance-docs/build/pdf-bundle/" "$HOST:/tmp/pdf-bundle/"
+fi
 if [[ -d "$ROOT/secure-messaging/build/html" ]]; then
   rsync -az "$ROOT/secure-messaging/build/html/" "$HOST:/tmp/sm-html/"
 fi
@@ -46,9 +52,36 @@ rsync -az "$ROOT/system-git-sync/docs/" --exclude pfc-site "$HOST:/tmp/sync-docs
 echo "=== install on host ==="
 ssh "$HOST" 'bash -s' << "EOF"
 set -e
-sudo systemctl stop pfc-sm-leaf || true
+sudo systemctl stop pfc-sm-leaf pfc-repl pfc-repl-a pfc-repl-b || true
 sudo cp /tmp/sm-leaf-linux /opt/pfc/bin/sm-leaf
 sudo chmod +x /opt/pfc/bin/sm-leaf
+if [ -f /tmp/pfc-repl-linux ]; then
+  sudo cp /tmp/pfc-repl-linux /opt/pfc/bin/pfc-repl
+  sudo chmod +x /opt/pfc/bin/pfc-repl
+fi
+# bus PSK: never plaintext PHI on NATS (broker remains untrusted)
+if [ ! -f /opt/pfc/etc/nats.env ]; then
+  k=$(python3 -c 'import secrets; print(secrets.token_hex(32))')
+  printf 'PFC_NATS_KEY=%s\nPFC_FORBID_PLAIN=1\n' "$k" | sudo tee /opt/pfc/etc/nats.env >/dev/null
+  sudo chmod 600 /opt/pfc/etc/nats.env
+fi
+sudo mkdir -p /etc/systemd/system/pfc-py-admin.service.d /etc/systemd/system/pfc-repl.service.d /etc/systemd/system/pfc-repl-a.service.d /etc/systemd/system/pfc-repl-b.service.d
+sudo tee /etc/systemd/system/pfc-py-admin.service.d/nats-psk.conf >/dev/null << 'UNIT'
+[Service]
+EnvironmentFile=-/opt/pfc/etc/nats.env
+UNIT
+sudo tee /etc/systemd/system/pfc-repl.service.d/nats-psk.conf >/dev/null << 'UNIT'
+[Service]
+EnvironmentFile=-/opt/pfc/etc/nats.env
+UNIT
+sudo tee /etc/systemd/system/pfc-repl-a.service.d/nats-psk.conf >/dev/null << 'UNIT'
+[Service]
+EnvironmentFile=-/opt/pfc/etc/nats.env
+UNIT
+sudo tee /etc/systemd/system/pfc-repl-b.service.d/nats-psk.conf >/dev/null << 'UNIT'
+[Service]
+EnvironmentFile=-/opt/pfc/etc/nats.env
+UNIT
 sudo mkdir -p /opt/pfc/python/secure_messaging /opt/pfc/python/admin/pfc_admin /opt/pfc/python/lib
 sudo rsync -a /tmp/secure_messaging/ /opt/pfc/python/secure_messaging/
 sudo rsync -a /tmp/pfc_admin/ /opt/pfc/python/admin/pfc_admin/
@@ -144,6 +177,12 @@ fi
 if [ -f /tmp/pfc-docs.pdf ]; then
   sudo cp /tmp/pfc-docs.pdf /opt/pfc/docs/html/peergos-for-compliance.pdf
 fi
+if [ -d /tmp/pdf-bundle ]; then
+  sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/
+  sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/nats-service-endpoints/ 2>/dev/null || true
+  sudo mkdir -p /opt/pfc/docs/html/secure-messaging
+  sudo cp /tmp/pdf-bundle/*.pdf /opt/pfc/docs/html/secure-messaging/ 2>/dev/null || true
+fi
 if [ -d /tmp/sm-html ]; then
   sudo mkdir -p /opt/pfc/docs/html/secure-messaging
   sudo rsync -a /tmp/sm-html/ /opt/pfc/docs/html/secure-messaging/
@@ -165,6 +204,7 @@ if [ -f /tmp/system-git-sync/../peergos-compliance-go/deploy/pfc.georgelambert.o
 fi
 sudo systemctl daemon-reload
 sudo systemctl enable --now pfc-sm-leaf
+sudo systemctl start pfc-repl pfc-repl-a pfc-repl-b
 sudo systemctl restart pfc-py-admin
 sleep 2
 systemctl is-active pfc-sm-leaf pfc-py-admin pfc-connector pfc-peergos-bridge

cicd/run-review.sh

@@ -20,7 +20,7 @@ if [[ -d "$ROOT/secure-messaging/go" ]]; then
   ( cd "$ROOT/secure-messaging/go" && run go test ./... )
 fi
 if [[ -d "$ROOT/peergos-compliance-go" ]]; then
-  ( cd "$ROOT/peergos-compliance-go" && run go test ./cmd/pfc-repl ./internal/leaf )
+  ( cd "$ROOT/peergos-compliance-go" && run go test ./cmd/pfc-repl ./internal/leaf ./internal/envelope )
 fi
 if [[ -f "$ROOT/peergos-for-compliance-ipfs/pfc_ipfs/server.py" ]]; then
   run python3 -m py_compile "$ROOT/peergos-for-compliance-ipfs/pfc_ipfs/server.py"