Remaining items (review)

Completed in software

  • Profile fail-closed genesis, append-only chain, Shamir wrap, log-before-reveal.

  • Python lab services + stdlib NATS client + lab envelope.

  • Go leaf services (admin, pin, repl, configd) compiled linux/amd64.

  • Caddy hostnames for pfc / config / docs on ns1.

  • Config TUI (curses/dialog) + browser wizard.

  • Forgejo remotes under marchon/*.

Still organizational / ops

  • Merge verae.inspect.* / verae.pfc.* into verae-nats-bus JWT ACLs.

  • NPE Go sidecar instead of pfc-lab-xor in production.

  • DNS A records for pfc.georgelambert.org (and config/docs) → 70.88.205.138.

  • Let’s Encrypt once DNS exists (Caddy site may use existing wildcard later).

  • BAAs, pentest, SOC 2 Type I/II, ISO ISMS.

  • Docker image build when daemon is available.

Do not expose NATS 4222 or Kubo 5001 on WAN.