# TODO (dependency order)

Status: `[ ]` pending · `[x]` done (committed).

Insert **new** dependencies **above** the blocked item.

- [x] S00 Scan orgs
- [x] S01 Save prompts
- [x] S02 Inventory
- [x] S03 Lock signed-config + datacube-history + passthrough + error-bundle
- [x] S04 Hub repo
- [x] S05 NATS-Service-Endpoints catalog
- [x] S06 Python spec implementation
- [x] S07 Go leaf
- [x] S08 Tests + CI
- [x] S09 Sphinx HTML/PDF
- [x] S10 Link PFC + compliance-docs + go README + subjects.json
- [x] S11 Thesaurus v1 (`docs/thesaurus.md`)
- [x] S12 Second pass: git URLs on PFC/admin/go/architecture READMEs
- [x] S13 CI-CD: Forgejo workflows + `cicd/run-review.sh` + GATE.md (REVIEW PASS, no deploy)
- [x] S14 NPE adapter fail-closed; live `PFC_REQUIRE_NPE=1` still UserReview
- [x] S15 Promote SHAs in cicd/GATE.md; deploy sm-leaf + signed config to ns1 (NPE live cutover remains UserReview)
- [x] S16 Remaining-Work plan documented
- [x] S17 Python router success/failure/logging tests
- [x] S18 Go sm-leaf accept/reject policy + tests
- [x] S19 Catalog covers all subjects.json (44) with timeout_sec + filter
- [x] S20 MODULE.md on every in-scope repo
- [x] S21 Thesaurus with file:line occurrences
- [x] S22 UI screenshots + walkthrough RST
- [x] S23 HTML + LaTeX PDFs (system 32p, catalog 17p, SM 11p)
- [x] S24 CI run-review expanded; deploy + live revalidate
- [x] S25 UserReview: HSM custody docs+rotate, npe CLI probe (REQUIRE_NPE unset), sync.pfc Caddy, website deep-links
- [x] S26 NATS payloads lab-xor (Python+Go match); FORBID_PLAIN on ns1; PDF relative sibling links; controls chapter