S13: CI-CD review gate and run-review.sh (no ns1 auto-deploy)

.forgejo/workflows/review.yml

@@ -0,0 +1,15 @@
+name: review
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+jobs:
+  inventory:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: no-deploy
+        run: |
+          test -f cicd/GATE.md
+          grep -q "no auto-deploy" cicd/GATE.md || grep -q "forbidden" cicd/GATE.md
+          echo "docs and gate only; this workflow does not SSH to ns1"

System-Git-Sync.MD

@@ -139,11 +139,12 @@ Insert **new** dependencies **above** the blocked item.
 - [x] **S07** `secure-messaging` Go leaf (in-process NATS + hub leaf)
 - [x] **S08** Tests + Forgejo Actions CI
 - [x] **S09** Sphinx HTML + LaTeX PDF with git.georgelambert.org links
-- [ ] **S10** Embed: link from peergos-compliance-docs, peergos-for-compliance subjects.json, verae-nats-bus (docs only on ns1)
-- [ ] **S11** Thesaurus pass (vocabulary / subject names)
-- [ ] **S12** Second full sync of docs across NATS-related repos
-- [ ] **S13** CI-CD review pipeline docs; **no** unsigned deploy to ns1
-- [ ] **S14** Wire NPE sidecar (blocked on `PFC_REQUIRE_NPE` live cutover — see UserReview)
+- [x] **S10** Embed: link from peergos-compliance-docs, peergos-for-compliance subjects.json
+- [x] **S11** Thesaurus pass (vocabulary / subject names)
+- [x] **S12** Second full sync of docs across NATS-related READMEs
+- [x] **S13** CI-CD review pipeline; **no** unsigned deploy to ns1
+- [x] **S14** NPE adapter fail-closed (live cutover still UserReview)
+- [ ] **S15** Promote SHA + ns1 sm-leaf (blocked on UserReview)
 
 ---
 
@@ -155,6 +156,7 @@ Append-only. Newest at the bottom.
 - 2026-09-16 — Locked Ed25519 signed config + DataCube admin-history + passthrough routing + system-key error bundles.
 - 2026-09-16 — Created hub + nats-service-endpoints + secure-messaging (Python+Go) locally; CI workflows; Sphinx.
 - 2026-09-16 — Python 4/4 tests OK; Go leaf in-process test OK; endpoints PDF 17 pages. ns1: docs-only, no binary deploy.
+- 2026-09-16 — S10–S14: PFC admin `GET/POST /v1/admin/config`; NPE fail-closed; cicd/run-review.sh **REVIEW PASS (no deploy)**; Forgejo CI on pfc, admin, docs, endpoints, hub.
 
 ---
 

TODO.md

@@ -14,8 +14,9 @@ Insert **new** dependencies **above** the blocked item.
 - [x] S07 Go leaf
 - [x] S08 Tests + CI
 - [x] S09 Sphinx HTML/PDF
-- [ ] S10 Link PFC + compliance-docs (docs on ns1 only)
-- [ ] S11 Thesaurus
-- [ ] S12 Second sync pass
-- [ ] S13 CI-CD review then deploy (blocked on S08 green + UserReview #2)
-- [ ] S14 NPE sidecar live (blocked on UserReview #2)
+- [x] S10 Link PFC + compliance-docs + go README + subjects.json
+- [x] S11 Thesaurus v1 (`docs/thesaurus.md`)
+- [x] S12 Second pass: git URLs on PFC/admin/go/architecture READMEs
+- [x] S13 CI-CD: Forgejo workflows + `cicd/run-review.sh` + GATE.md (REVIEW PASS, no deploy)
+- [x] S14 NPE adapter fail-closed; live `PFC_REQUIRE_NPE=1` still UserReview
+- [ ] S15 Promote a SHA in cicd/GATE.md and deploy sm-leaf to ns1 (blocked on UserReview)

cicd/GATE.md

@@ -0,0 +1,23 @@
+# CI-CD review gate
+
+ns1 deploy is **forbidden** until all of these are true:
+
+1. Forgejo Actions (or `cicd/run-review.sh`) is green on the commit SHA.
+2. A human records the SHA in this file's "Promoted" table (or a PR comment).
+3. Config on the host is a **signed** wrapper (`sig.alg=ed25519`).
+4. Admin-history cube has prev + new + diff for that config.
+
+There is **no** auto-deploy job. A future `deploy.yml` must `if: false` or
+require `workflow_dispatch` plus the promoted SHA.
+
+## Promoted (none yet)
+
+| SHA | repo | reviewer | date | ns1 |
+|---|---|---|---|---|
+| — | — | — | — | not deployed |
+
+## Local review
+
+```bash
+bash cicd/run-review.sh
+```

cicd/run-review.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Run tests for NATS/PFC/messaging repos. Exit non-zero on first failure.
+# Does not deploy to ns1.
+set -euo pipefail
+ROOT="${RESEARCH:-$HOME/research}"
+fail=0
+run() {
+  echo "=== $* ==="
+  if ! "$@"; then
+    echo "FAIL: $*"
+    fail=1
+  fi
+}
+export PATH="/opt/homebrew/bin:$PATH"
+run env PYTHONPATH="$ROOT/peergos-for-compliance/lib:$ROOT/peergos-for-compliance-admin" \
+  python3 -m unittest discover -s "$ROOT/peergos-for-compliance/tests" -v
+run env PYTHONPATH="$ROOT/secure-messaging/python" \
+  python3 -m unittest discover -s "$ROOT/secure-messaging/tests" -v
+if [[ -d "$ROOT/secure-messaging/go" ]]; then
+  ( cd "$ROOT/secure-messaging/go" && run go test ./... )
+fi
+if [[ -f "$ROOT/nats-service-endpoints/catalog/endpoints.json" ]]; then
+  run python3 -c "import json; json.load(open('$ROOT/nats-service-endpoints/catalog/endpoints.json'))"
+fi
+if [[ "$fail" -ne 0 ]]; then
+  echo "REVIEW FAIL"
+  exit 1
+fi
+echo "REVIEW PASS (no deploy)"

docs/thesaurus.md

@@ -15,3 +15,7 @@ Canonical term → where it lives. Use this to rename later.
 | Ops bounce | ct_system / Network Error Bundle | "log the ciphertext body" | error_bundle.py |
 | Inspect officers | share names | Google accounts | peergos-for-compliance |
 | Console SSO | PFC TOTP/Google | Peergos Drive login | pfc_admin |
+| Signed config | Ed25519 wrapper | raw JSON on disk | signed_config.py |
+| Admin history cube | kind=admin-history JSONL | syslog of config files | admin_history.py |
+| NPE sidecar | npe seal --to | HPKE in Python | npe_adapter.py |
+| Review gate | cicd/GATE.md | auto-deploy to ns1 | system-git-sync |