S27: deploy creates npe-dir endpoint keys and systemd KEYDIR

Historical-Information.MD

@@ -115,6 +115,15 @@ After a context reset: read this file, then `Remaining-Work.MD`.
 - PDFs link to **sibling PDFs** (`nats-service-endpoints.pdf`, `secure-messaging.pdf`, `peergos-for-compliance.pdf`) — no `.md` hrefs.
 - Controls / custody / variables chapters in the system PDF.
 
+## S27 NPE/HPKE content + public-key directory
+
+- Content: HPKE-Base only. sm-leaf rejects ``lab-xor`` / ``plain-lab``.
+- Directory: ``/opt/pfc/etc/npe-dir`` public JSON + private 0600.
+  ``GET /v1/npe/keys`` lists public keys for every E2E service.
+- Clear on NATS: routing + error codes only. Content never in JSON.
+- WAN NATS 4222 remains token-gated public-edge (not open). PFC uses
+  internal ``10.10.10.21:4222``.
+
 Go `pfc-repl` now serves loopback `GET 127.0.0.1:18784/health`; admin `PFC_REPL_URL` points there. Ingest replicas a/b do not bind HTTP.
 
 ## Do not

cicd/deploy-ns1.sh

@@ -82,6 +82,42 @@ sudo tee /etc/systemd/system/pfc-repl-b.service.d/nats-psk.conf >/dev/null << 'U
 [Service]
 EnvironmentFile=-/opt/pfc/etc/nats.env
 UNIT
+# Public-key directory + per-endpoint HPKE keys (private 0600, public listed)
+sudo python3 - << 'PY'
+import sys
+sys.path.insert(0, "/opt/pfc/python")
+from pathlib import Path
+from secure_messaging.pubkey_dir import PubKeyDir
+d = PubKeyDir(Path("/opt/pfc/etc/npe-dir"))
+for h in ("pfc-admin", "pfc-repl", "pfc-repl-a", "pfc-repl-b", "pfc-ipfs", "sm-leaf"):
+    if d.get(h) is None:
+        d.create_endpoint(h)
+        print("created", h)
+    else:
+        print("exists", h)
+print("handles", d.available()["handles"])
+PY
+sudo chmod 700 /opt/pfc/etc/npe-dir/private
+sudo tee /etc/systemd/system/pfc-py-admin.service.d/npe-dir.conf >/dev/null << 'UNIT'
+[Service]
+Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
+Environment=PFC_NPE_HANDLE=pfc-admin
+UNIT
+sudo tee /etc/systemd/system/pfc-repl.service.d/npe-dir.conf >/dev/null << 'UNIT'
+[Service]
+Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
+Environment=PFC_NPE_HANDLE=pfc-repl
+UNIT
+sudo tee /etc/systemd/system/pfc-repl-a.service.d/npe-dir.conf >/dev/null << 'UNIT'
+[Service]
+Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
+Environment=PFC_NPE_HANDLE=pfc-repl-a
+UNIT
+sudo tee /etc/systemd/system/pfc-repl-b.service.d/npe-dir.conf >/dev/null << 'UNIT'
+[Service]
+Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
+Environment=PFC_NPE_HANDLE=pfc-repl-b
+UNIT
 sudo mkdir -p /opt/pfc/python/secure_messaging /opt/pfc/python/admin/pfc_admin /opt/pfc/python/lib
 sudo rsync -a /tmp/secure_messaging/ /opt/pfc/python/secure_messaging/
 sudo rsync -a /tmp/pfc_admin/ /opt/pfc/python/admin/pfc_admin/

cicd/run-review.sh

@@ -20,7 +20,7 @@ if [[ -d "$ROOT/secure-messaging/go" ]]; then
   ( cd "$ROOT/secure-messaging/go" && run go test ./... )
 fi
 if [[ -d "$ROOT/peergos-compliance-go" ]]; then
-  ( cd "$ROOT/peergos-compliance-go" && run go test ./cmd/pfc-repl ./internal/leaf ./internal/envelope )
+  ( cd "$ROOT/peergos-compliance-go" && run go test ./cmd/pfc-repl ./internal/leaf ./internal/envelope ./internal/hpke )
 fi
 if [[ -f "$ROOT/peergos-for-compliance-ipfs/pfc_ipfs/server.py" ]]; then
   run python3 -m py_compile "$ROOT/peergos-for-compliance-ipfs/pfc_ipfs/server.py"