Remaining items (review)
========================

Completed in software
---------------------

* Profile fail-closed genesis, append-only chain, Shamir wrap, log-before-reveal.
* Python lab services + stdlib NATS client + lab envelope.
* Go leaf services (admin, pin, repl, configd) compiled linux/amd64.
* Caddy hostnames for pfc / config / docs on ns1.
* Config TUI (curses/dialog) + browser wizard.
* Forgejo remotes under ``marchon/*``.

Still organizational / ops
--------------------------

* Merge ``verae.inspect.*`` / ``verae.pfc.*`` into **verae-nats-bus JWT ACLs**.
* NPE Go sidecar instead of ``pfc-lab-xor`` in production.
* DNS A records for ``pfc.georgelambert.org`` (and config/docs) → ``70.88.205.138``.
* Let's Encrypt once DNS exists (Caddy site may use existing wildcard later).
* BAAs, pentest, SOC 2 Type I/II, ISO ISMS.
* Docker image build when daemon is available.

Do not expose NATS ``4222`` or Kubo ``5001`` on WAN.