S16-S24: Remaining-Work plan, thesaurus occurrences, deploy docs

VARIABLES.md, MODULE writer, catalog review covers subjects.json,
deploy rsyncs system HTML/PDF and SM docs.

scripts/build_thesaurus.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+"""Rebuild thesaurus.md with file:line occurrences in in-scope repos."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+ROOT = Path("/Users/marchon/research")
+OUT = Path("/Users/marchon/research/system-git-sync/docs/thesaurus.md")
+SCOPE = [
+    "system-git-sync",
+    "nats-service-endpoints",
+    "secure-messaging",
+    "peergos-for-compliance",
+    "peergos-for-compliance-admin",
+    "peergos-for-compliance-ipfs",
+    "peergos-for-compliance-replication",
+    "peergos-compliance-docs",
+    "peergos-compliance-architecture",
+    "peergos-compliance-go",
+    "peergos-compliance-config",
+]
+# Canonical term, banned phrase, grep needle for "use this"
+TERMS = [
+    ("Untrusted broker", "NATS", "secure bus", "untrusted"),
+    ("Production E2E", "NPE / HPKE", "TLS to NATS", "NPE"),
+    ("Lab envelope", "pfc-lab-xor", "xor cipher", "lab-xor"),
+    ("Dest in clear", "passthrough", "plaintext message", "passthrough"),
+    ("Sender handle", "lookup_id", "from username on wire", "lookup_id"),
+    ("Config file", "signed wrapper", "raw JSON config", "signed wrapper"),
+    ("Admin audit", "DataCube admin-history", "SQL log", "admin-history"),
+    ("Failure to sender", "ct_sender", "email bounce plaintext", "ct_sender"),
+    ("Ops bounce", "ct_system / Network Error Bundle", "log the ciphertext body", "ct_system"),
+    ("Inspect officers", "share names", "Google accounts", "k-of-n"),
+    ("Console SSO", "PFC TOTP/Google", "Peergos Drive login", "PFC_REQUIRE_AUTH"),
+    ("NPE sidecar", "npe seal --to", "HPKE in Python", "npe_adapter"),
+    ("Review gate", "cicd/GATE.md", "auto-deploy to ns1", "GATE.md"),
+    ("sm-leaf health", "GET 127.0.0.1:18783/health", "WAN NATS ports", "18783"),
+]
+
+
+def hits(needle: str, limit: int = 8) -> list[str]:
+    cmd = [
+        "rg",
+        "-n",
+        "--glob",
+        "!**/{build,.git,node_modules,__pycache__,bin}/**",
+        "-g",
+        "!*.pyc",
+        needle,
+    ]
+    paths = [str(ROOT / s) for s in SCOPE]
+    p = subprocess.run(cmd + paths, capture_output=True, text=True)
+    lines = [ln for ln in (p.stdout or "").splitlines() if ln.strip()]
+    out = []
+    for ln in lines[:limit]:
+        if ":" in ln:
+            out.append(ln.replace(str(ROOT) + "/", "")[:160])
+    return out
+
+
+def main() -> None:
+    rows = [
+        "# Thesaurus",
+        "",
+        "Canonical term → where it lives. Occurrences are grepped from in-scope",
+        "repos (docs **and** code). Banned phrases must not be used as the name",
+        "of the thing.",
+        "",
+        "This is **not** a HIPAA/SOC 2/ISO certificate.",
+        "",
+        "| Term | Use this | Not this | Occurrences |",
+        "|---|---|---|---|",
+    ]
+    for term, use, banned, needle in TERMS:
+        occ = hits(needle)
+        cell = "<br>".join(f"`{x}`" for x in occ) if occ else "_(none)_"
+        rows.append(f"| {term} | {use} | {banned} | {cell} |")
+    rows += [
+        "",
+        "## Certification",
+        "",
+        "In-scope documentation uses the **Use this** column. `passthrough`",
+        "means destination in the clear, not a plaintext message body.",
+        "NATS is the untrusted broker. Production E2E is NPE/HPKE.",
+        "",
+    ]
+    OUT.write_text("\n".join(rows) + "\n")
+    print("wrote", OUT)
+
+
+if __name__ == "__main__":
+    main()