S16-S24: Remaining-Work plan, thesaurus occurrences, deploy docs

VARIABLES.md, MODULE writer, catalog review covers subjects.json,
deploy rsyncs system HTML/PDF and SM docs.

docs/modules/nats-service-endpoints.md

@@ -0,0 +1,40 @@
+# MODULE — nats-service-endpoints
+
+Git: https://git.georgelambert.org/marchon/nats-service-endpoints
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Every service that publishes `verae.*`.
+
+**Callers:** secure-messaging, pfc-py-admin, pfc-repl, pfc-ipfs, sm-leaf.
+
+## Messages — from / to
+
+- **From:** `catalog/endpoints.json` (SM core) + `catalog/pfc-derived.json` (all subjects.json names).
+- **To:** Sphinx HTML/PDF on docs.pfc `/nats-service-endpoints/`.
+
+## Filters / security
+
+`reject[]` + `filter` + `timeout_sec`. Forbidden `verae.llm.turn.>`.
+
+## Errors and timeouts
+
+- **Errors:** Unknown subject / missing fields → dead letter for SM; others `dead=none`.
+- **Timeouts:** See each row `timeout_sec` (5s request-reply, 4s queue, 30s pin).
+
+## Where data is stored and how others use it
+
+JSON catalog in git.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-compliance-architecture.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-compliance-architecture
+
+Git: https://git.georgelambert.org/marchon/peergos-compliance-architecture
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Design readers. No runtime.
+
+**Callers:** Docs and plan repos.
+
+## Messages — from / to
+
+- **From:** Architecture notes for DataCube + Peergos + NATS.
+- **To:** Links to runtime repos.
+
+## Filters / security
+
+Inventory; do not contradict signed-config design locks.
+
+## Errors and timeouts
+
+- **Errors:** n/a
+- **Timeouts:** n/a
+
+## Where data is stored and how others use it
+
+Markdown in git.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-compliance-config.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-compliance-config
+
+Git: https://git.georgelambert.org/marchon/peergos-compliance-config
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Operator building `pfc.json` before signing.
+
+**Callers:** Browser SPA `config.pfc.georgelambert.org`, bash/curses TUI, pfc-configd.
+
+## Messages — from / to
+
+- **From:** Host, leaf hub, NATS URL, lab PSK, profile, min_ok.
+- **To:** Download JSON; **must be signed** (`signed_config.sign`) before load.
+
+## Filters / security
+
+Unsigned files rejected at load. Live changes append admin-history.
+
+## Errors and timeouts
+
+- **Errors:** Invalid schema / missing crypto.mode.
+- **Timeouts:** n/a
+
+## Where data is stored and how others use it
+
+`~/pfc.json` or host signed path.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-compliance-docs.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-compliance-docs
+
+Git: https://git.georgelambert.org/marchon/peergos-compliance-docs
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Operators and auditors reading docs.pfc.
+
+**Callers:** Sphinx build; Caddy `docs.pfc.georgelambert.org`.
+
+## Messages — from / to
+
+- **From:** RST sources + screenshots in `_static/screens/`.
+- **To:** HTML + LaTeX PDF under `/opt/pfc/docs/html`.
+
+## Filters / security
+
+No PHI examples; not a certificate.
+
+## Errors and timeouts
+
+- **Errors:** latexmk optional; xelatex/pdflatex fallback.
+- **Timeouts:** n/a
+
+## Where data is stored and how others use it
+
+git + ns1 docs tree.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-compliance-go.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-compliance-go
+
+Git: https://git.georgelambert.org/marchon/peergos-compliance-go
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+ns1 leaf processes: pfc-repl, pfc-repl-a/b, pfc-configd, (inactive pfc-admin HTTP).
+
+**Callers:** systemd. pfc-py-admin health-probes pfc-repl `:18784`.
+
+## Messages — from / to
+
+- **From:** NATS `verae.storage.replicate`, replica ingest, `verae.pfc.health`.
+- **To:** Local data dir + replica subjects; config UI static files.
+
+## Filters / security
+
+Coordinator only binds HTTP; ingest replicas NATS-only.
+
+## Errors and timeouts
+
+- **Errors:** min_ok failure in replicate JSON; leaf hub parse `nats-leaf://` → `nats://`.
+- **Timeouts:** 4s replica Request.
+
+## Where data is stored and how others use it
+
+`/opt/pfc/data/repl`.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-for-compliance-admin.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-for-compliance-admin
+
+Git: https://git.georgelambert.org/marchon/peergos-for-compliance-admin
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Operators in the browser SPA.
+
+**Callers:** https://pfc.georgelambert.org (Caddy → 127.0.0.1:18780).
+
+## Messages — from / to
+
+- **From:** Login/TOTP, cube/catalog/inspect/audit HTTP; NATS when bus configured.
+- **To:** CubeStore, UserStore, signed config, sm-leaf, pin, repl.
+
+## Filters / security
+
+`PFC_REQUIRE_AUTH=1`; TOTP for hipaa; k-of-n inspect; unsigned config rejected.
+
+## Errors and timeouts
+
+- **Errors:** 401 auth, 403 totp/admin, 400 profile, 501 missing signing key.
+- **Timeouts:** HTTP 8s in tests; NATS 5s.
+
+## Where data is stored and how others use it
+
+`PFC_DATA` users + cubes; host PEM for Ed25519.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-for-compliance-ipfs.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-for-compliance-ipfs
+
+Git: https://git.georgelambert.org/marchon/peergos-for-compliance-ipfs
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Admin object put (pin) and hydrate.
+
+**Callers:** pfc-py-admin `verae.storage.pin` / HTTP `/v1/pin`.
+
+## Messages — from / to
+
+- **From:** `sha256`, `bytes_hex`, `cube_id`, `tier`.
+- **To:** Kubo API localhost:15001 (never WAN 5001).
+
+## Filters / security
+
+Localhost Kubo only; hash must match bytes.
+
+## Errors and timeouts
+
+- **Errors:** Kubo down → health 503 for ipfs backend; pin error JSON.
+- **Timeouts:** Kubo 30s.
+
+## Where data is stored and how others use it
+
+Kubo blocks; optional stash dir.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-for-compliance-replication.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-for-compliance-replication
+
+Git: https://git.georgelambert.org/marchon/peergos-for-compliance-replication
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Lab HTTP coordinator. **Live ns1 uses Go pfc-repl** instead.
+
+**Callers:** Admin when `NATS_URL` unset (`PFC_REPL_URL`).
+
+## Messages — from / to
+
+- **From:** POST `/v1/replicate` `{bytes_hex, sha256, cube_id}`.
+- **To:** Replica ingest URLs / `verae.pfc.replica.{a,b}.ingest`.
+
+## Filters / security
+
+`min_ok` acks including local.
+
+## Errors and timeouts
+
+- **Errors:** 503 when min_ok not met.
+- **Timeouts:** 4s per replica request.
+
+## Where data is stored and how others use it
+
+`PFC_REPL_DATA` files named by sha256.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/peergos-for-compliance.md

@@ -0,0 +1,40 @@
+# MODULE — peergos-for-compliance
+
+Git: https://git.georgelambert.org/marchon/peergos-for-compliance
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Shared Python lib (`pfc.*`) used by admin, ipfs, repl, connector.
+
+**Callers:** pfc-py-admin, tests, Pattern A inspect app outbox.
+
+## Messages — from / to
+
+- **From:** HTTP browsers/CLI; NATS `verae.*` when `NATS_URL` set.
+- **To:** CubeStore `/PFC_DATA`, stamp leaf `verae.ts.batch`, pin, replicate.
+
+## Filters / security
+
+Profile validate (k>=2, author not officer); HIPAA bytes need inspect session.
+
+## Errors and timeouts
+
+- **Errors:** AccessDenied, ProfileError, NatsError, hash mismatch.
+- **Timeouts:** NATS 5s; stamp sync 15s.
+
+## Where data is stored and how others use it
+
+`cubes/<id>/` chain, catalog card, hash registry.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/secure-messaging.md

@@ -0,0 +1,40 @@
+# MODULE — secure-messaging
+
+Git: https://git.georgelambert.org/marchon/secure-messaging
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+sm-leaf (Go) and pfc-py-admin (Python sign/history).
+
+**Callers:** Console send, tests, systemd `pfc-sm-leaf`.
+
+## Messages — from / to
+
+- **From:** `verae.sm.send` envelopes (`to`, `from_lookup_id`, `alg`, `ct`).
+- **To:** Mailbox dest (clear); ack `lookup_id`. Failures → `verae.sm.error`, `verae.sm.dead`, `verae.sm.log.summary`.
+
+## Filters / security
+
+Missing `to`, empty `ct` (unless plain-lab), plaintext `body`, bad alg, summary `ct` field.
+
+## Errors and timeouts
+
+- **Errors:** Network Error Bundle: `ct_sender` (sender only) + `ct_system` (ops). Never log mail body.
+- **Timeouts:** NATS 5s; NPE seal 15s.
+
+## Where data is stored and how others use it
+
+Signed wrapper path; admin-history JSONL cube.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).

docs/modules/system-git-sync.md

@@ -0,0 +1,40 @@
+# MODULE — system-git-sync
+
+Git: https://git.georgelambert.org/marchon/system-git-sync
+
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+Vocabulary: see `https://git.georgelambert.org/marchon/system-git-sync` `docs/thesaurus.md`.
+Catalog: `https://git.georgelambert.org/marchon/nats-service-endpoints`.
+
+
+## What this module is
+
+Runtime or documentation unit in the Peergos-for-compliance / secure-messaging
+set. See this repo `README.md` for the short intro.
+
+## Who calls this module and why
+
+Operators and later agents. Nothing publishes NATS from this repo.
+
+**Callers:** Humans / CI (`cicd/run-review.sh`, `cicd/deploy-ns1.sh`).
+
+## Messages — from / to
+
+- **From:** Promoted SHAs, inventory, remaining-work.
+- **To:** Forgejo remotes and ns1 rsync after tests.
+
+## Filters / security
+
+No auto-deploy. Unsigned config never copied. Websites org inventory-only.
+
+## Errors and timeouts
+
+- **Errors:** Review fail aborts deploy. Binary-busy: stop unit then copy.
+- **Timeouts:** SSH/rsync operator-bound.
+
+## Where data is stored and how others use it
+
+Git only. Live signed files are on the host.
+
+Walkthroughs and screenshots: `https://git.georgelambert.org/marchon/peergos-compliance-docs` (`source/walkthrough.rst`).