S15: Historical-Information, deploy-ns1, promote gate SHAs

Continue-until-done instructions live in Historical-Information.MD.
run-review.sh now covers signed-config HTTP and catalog subjects.
deploy-ns1.sh never skips tests and does not set PFC_REQUIRE_NPE.

Historical-Information.MD

@@ -0,0 +1,89 @@
+# Historical-Information.MD
+
+**Instruction to any later agent:** Continue without user interruption until
+every open item below is done, revalidated, and tested. Do not ask the
+operator for information. Use guesses in `TODO-With-User.MD`. Deploy
+validated code to **ns1 `70.88.205.138`**, replacing processes only when
+the replacement is tested. After a context reset: read **this file first**,
+then `System-Git-Sync.MD`, `TODO.md`, `UserReview.MD`, `INVENTORY.md`.
+
+This is **not** a HIPAA/SOC 2/ISO certificate.
+
+## Operator intent (compressed)
+
+1. Secure messaging on untrusted NATS: passthrough (dest in the clear, body
+   encrypted). Sender cannot reopen ciphertext; **lookup_id** only.
+2. Network Error Bundle: `ct_sender` (sender-only) + `ct_system` (system
+   public key bounce report). Never log recipient plaintext.
+3. Signed Ed25519 config wrapper; unsigned files rejected. Admin changes
+   append prev + new + unified diff to a Verae DataCube admin-history chain.
+4. Python (readable, commented) + Go (in-process NATS + leaf).
+5. Catalog repo `nats-service-endpoints`. Hub `system-git-sync`.
+6. Scan every Forgejo org. Websites = inventory only. `verae` org empty.
+7. ns1 sequence was docs → code → test → CI → **deploy**. Deploy is now in
+   scope. Do not enable `PFC_REQUIRE_NPE=1` on the live console unless the
+   `npe` sidecar is actually present (fail-closed would take down pfc).
+8. Keep going until synced and interoperable. Re-run tests after deploy.
+
+## Forgejo
+
+- Host: https://git.georgelambert.org (Forgejo 11)
+- SSH: `ssh://git@git.georgelambert.org:2223/marchon/<repo>.git` (also
+  `git@git.georgelambert.org:marchon/<repo>.git`)
+- Orgs: `marchon` (~61), `infra` (caddy, coredns), `websites` (70+), `verae` (0)
+- Token: osxkeychain for `git.georgelambert.org` user `marchon`
+
+## Live ns1 (do not break the console)
+
+- `pfc-py-admin` :18780 → https://pfc.georgelambert.org (`PFC_REQUIRE_AUTH=1`)
+- `pfc-connector`, `pfc-peergos-bridge`, `pfc-py-ipfs` :18782, Kubo :15001
+- `pfc-configd` :18781
+- NATS leaf hub `nats://10.10.10.21:7422` (also written `nats-leaf://`)
+- Docs: `/opt/pfc/docs/html`, https://docs.pfc.georgelambert.org
+- Secrets: `/opt/pfc/etc/admin.env`, `/opt/pfc/etc/peergos-bridge.env`
+- **Do not** replace `pfc-py-admin` with Go `pfc-admin` (Go HTTP was disabled
+  on purpose). Add `sm-leaf` alongside.
+
+## Repos created this program
+
+- https://git.georgelambert.org/marchon/system-git-sync
+- https://git.georgelambert.org/marchon/nats-service-endpoints
+- https://git.georgelambert.org/marchon/secure-messaging
+
+## Design locks
+
+See `System-Git-Sync.MD` table. Config keys: `crypto.mode`, `routing.mode`,
+`admin.history_cube`, `crypto.system_key_id`, `logging.mode`.
+
+## Open items (execute in order)
+
+Update checkboxes in `TODO.md` as each is done.
+
+1. [x] Historical file committed (this file)
+2. [x] Expand `sm-leaf` health HTTP + sm subjects; linux/amd64 build
+3. [x] `cicd/deploy-ns1.sh`: test then rsync; never skip tests
+4. [ ] Generate Ed25519 config keys **on ns1**; signed config + admin-history
+5. [ ] Install secure-messaging Python under `/opt/pfc/python/secure_messaging`
+6. [ ] systemd `pfc-sm-leaf.service`; loopback health
+7. [ ] Point `pfc-py-admin` PYTHONPATH at secure-messaging; optional signed config
+8. [ ] Caddy/docs: hub + endpoints HTML/PDF under docs.pfc (docs already partial)
+9. [ ] Smoke: pfc health 200, sm-leaf health, signed config load, PFC tests
+10. [x] Promote SHA in `cicd/GATE.md`
+11. [x] Re-run `cicd/run-review.sh`; second doc sync (after ns1)
+12. [ ] NPE live: **only if** `/opt/pfc/bin/npe` exists; else leave fail-closed
+13. [x] Websites org: no NATS code; inventory remains complete
+14. [ ] Push all git remotes; close S15
+
+Local review 2026-09-16: PFC 25/25, SM 5/5, Go leaf OK, catalog subjects OK.
+Promoted: secure-messaging `f4da7ff`, peergos-for-compliance `2c45603`,
+admin `c46d494`, nats-service-endpoints `1d01768`. `PFC_REQUIRE_NPE=1` stays unset
+even though `/opt/pfc/bin/npe` exists (bus still lab-xor; fail-closed would
+take down the console).
+
+## Do not
+
+- Enable `PFC_REQUIRE_NPE=1` if `npe` is missing
+- Expose 4222/7422/5001 on WAN
+- Commit private keys
+- Rewrite 70 website repos
+- Ask the operator questions