feat: v1.0 shipping preparation — signature scheme flag, SQLi tests, deployment package

Feature-flag ed448: add SignatureScheme enum (MlDsa87Only default, Hybrid
optional). ML-DSA-87 alone is FIPS 204 peer-reviewed and production-safe.
Ed448 (unaudited) can be enabled per-config when audit completes.

Add 6 database proxy SQLi smoke tests proving: legitimate SELECTs pass,
mutable table writes allowed, immutable table writes blocked, DROP/ALTER
always blocked, stacked query injection caught by AST parser.

Add deployment package: setup.sh (creates dirs, pulls images, downloads
WordPress, generates wp-config.php routing DB through yacht-agent proxy),
DEPLOY.adoc with step-by-step guide.

Add hack-me security challenge document (docs/HACK-ME-CHALLENGE.adoc)
for public bug bounty when a live site is deployed.

Add WordPress adapter plugin (adapters/wordpress-wharf/, GPL-2.0) —
dashboard widget showing agent stats, admin bar indicator, wordpress.org
readme.txt. Pure display, zero security logic in PHP.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

adapters/wordpress-wharf/readme.txt

@@ -0,0 +1,65 @@
+=== Wharf Security Adapter ===
+Contributors: hyperpolymath
+Tags: security, firewall, database-proxy, post-quantum
+Requires at least: 6.0
+Tested up to: 6.7
+Stable tag: 1.0.0
+Requires PHP: 8.0
+License: GPLv2 or later
+License URI: https://www.gnu.org/licenses/gpl-2.0.html
+
+Dashboard widget and status display for sites protected by Project Wharf.
+
+== Description ==
+
+Project Wharf is a Sovereign Web Hypervisor — an external security layer that sits
+between the internet and your WordPress site. This adapter plugin provides a
+dashboard widget showing the protection status.
+
+**This plugin does NO security work itself.** All security enforcement is handled by
+the yacht-agent, a separate Rust daemon that:
+
+* Proxies all database queries through an AST-aware SQL parser
+* Blocks SQL injection at the wire protocol level (not regex)
+* Monitors file integrity via BLAKE3 cryptographic hashes
+* Enforces write policies (immutable tables, no DROP/ALTER)
+* Uses ML-DSA-87 post-quantum signatures for the control plane
+
+= What This Plugin Does =
+
+* Adds a "Wharf Security Status" widget to your WordPress dashboard
+* Shows query statistics (total, blocked, audited)
+* Displays firewall mode and signature scheme
+* Adds an admin bar indicator (green = protected, grey = agent unreachable)
+* Caches agent responses for 30 seconds to minimise overhead
+
+= What This Plugin Does NOT Do =
+
+* Does not implement any security features (that's the yacht-agent's job)
+* Does not modify your database or files
+* Does not phone home or collect telemetry
+* Does not require an account or subscription
+
+== Installation ==
+
+1. Install and configure Project Wharf on your server (see https://github.com/hyperpolymath/project-wharf)
+2. Upload the `wharf-adapter` folder to `/wp-content/plugins/`
+3. Activate the plugin through the 'Plugins' menu
+4. Visit your Dashboard to see the Wharf Security Status widget
+
+= Configuration =
+
+Set the `WHARF_AGENT_URL` environment variable if your yacht-agent runs on a
+non-default address:
+
+    define('WHARF_AGENT_URL', 'http://agent:9001');
+
+Default is `http://localhost:9001`.
+
+== Changelog ==
+
+= 1.0.0 =
+* Initial release
+* Dashboard widget with query stats
+* Admin bar status indicator
+* Agent health monitoring

adapters/wordpress-wharf/wharf-adapter.php

@@ -0,0 +1,134 @@
+<?php
+/**
+ * Plugin Name: Wharf Security Adapter
+ * Plugin URI: https://github.com/hyperpolymath/project-wharf
+ * Description: Dashboard widget and status display for sites protected by Project Wharf (yacht-agent).
+ * Version: 1.0.0
+ * Author: Jonathan D.A. Jewell
+ * Author URI: https://github.com/hyperpolymath
+ * License: GPL-2.0-or-later
+ * License URI: https://www.gnu.org/licenses/gpl-2.0.html
+ * Text Domain: wharf-adapter
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This plugin is a thin adapter — it does NO security work itself.
+ * All security enforcement is handled by the yacht-agent (a separate Rust daemon).
+ * This plugin simply reads status from the agent's API and displays it in wp-admin.
+ */
+
+if (!defined('ABSPATH')) {
+    exit;
+}
+
+define('WHARF_ADAPTER_VERSION', '1.0.0');
+define('WHARF_AGENT_URL', getenv('WHARF_AGENT_URL') ?: 'http://localhost:9001');
+
+/**
+ * Register the dashboard widget
+ */
+function wharf_add_dashboard_widget() {
+    wp_add_dashboard_widget(
+        'wharf_security_status',
+        'Wharf Security Status',
+        'wharf_render_dashboard_widget'
+    );
+}
+add_action('wp_dashboard_setup', 'wharf_add_dashboard_widget');
+
+/**
+ * Fetch stats from yacht-agent API
+ */
+function wharf_fetch_agent_stats() {
+    $cache_key = 'wharf_agent_stats';
+    $cached = get_transient($cache_key);
+    if ($cached !== false) {
+        return $cached;
+    }
+
+    $response = wp_remote_get(WHARF_AGENT_URL . '/stats', array(
+        'timeout' => 3,
+        'sslverify' => false,
+    ));
+
+    if (is_wp_error($response)) {
+        return array('error' => $response->get_error_message());
+    }
+
+    $body = wp_remote_retrieve_body($response);
+    $data = json_decode($body, true);
+
+    if (!is_array($data)) {
+        return array('error' => 'Invalid response from yacht-agent');
+    }
+
+    set_transient($cache_key, $data, 30); // Cache for 30 seconds
+    return $data;
+}
+
+/**
+ * Render the dashboard widget
+ */
+function wharf_render_dashboard_widget() {
+    $stats = wharf_fetch_agent_stats();
+
+    if (isset($stats['error'])) {
+        echo '<p style="color:#d63638"><strong>Agent Unreachable:</strong> ';
+        echo esc_html($stats['error']);
+        echo '</p>';
+        echo '<p>Ensure yacht-agent is running at <code>' . esc_html(WHARF_AGENT_URL) . '</code></p>';
+        return;
+    }
+
+    $queries_allowed = isset($stats['queries_allowed']) ? intval($stats['queries_allowed']) : 0;
+    $queries_blocked = isset($stats['queries_blocked']) ? intval($stats['queries_blocked']) : 0;
+    $moored = !empty($stats['moored']);
+    $firewall = isset($stats['firewall_mode']) ? esc_html($stats['firewall_mode']) : 'unknown';
+    $sig_scheme = isset($stats['signature_scheme']) ? esc_html($stats['signature_scheme']) : 'unknown';
+
+    echo '<table class="widefat" style="border:0">';
+
+    // Status indicator
+    $status_color = $moored ? '#00a32a' : '#dba617';
+    $status_label = $moored ? 'Moored (Connected)' : 'Unmoored (Standalone)';
+    echo '<tr><td><strong>Status</strong></td>';
+    echo '<td><span style="color:' . $status_color . '">&#9679;</span> ' . $status_label . '</td></tr>';
+
+    // Query stats
+    $total = $queries_allowed + $queries_blocked;
+    echo '<tr><td><strong>DB Queries</strong></td>';
+    echo '<td>' . number_format($total) . ' total (' . number_format($queries_blocked) . ' blocked)</td></tr>';
+
+    // Firewall
+    echo '<tr><td><strong>Firewall</strong></td>';
+    echo '<td>' . $firewall . '</td></tr>';
+
+    // Signature scheme
+    echo '<tr><td><strong>Signatures</strong></td>';
+    echo '<td>' . $sig_scheme . '</td></tr>';
+
+    echo '</table>';
+
+    echo '<p style="margin-top:12px;color:#757575;font-size:12px">';
+    echo 'Protected by <a href="https://github.com/hyperpolymath/project-wharf" target="_blank">Project Wharf</a>';
+    echo ' &mdash; The Sovereign Web Hypervisor';
+    echo '</p>';
+}
+
+/**
+ * Add admin bar indicator
+ */
+function wharf_admin_bar_item($admin_bar) {
+    $stats = wharf_fetch_agent_stats();
+    $is_healthy = !isset($stats['error']);
+
+    $admin_bar->add_node(array(
+        'id'    => 'wharf-status',
+        'title' => ($is_healthy ? '&#9679; ' : '&#9675; ') . 'Wharf',
+        'href'  => admin_url(),
+        'meta'  => array(
+            'title' => $is_healthy ? 'Wharf: Protected' : 'Wharf: Agent unreachable',
+        ),
+    ));
+}
+add_action('admin_bar_menu', 'wharf_admin_bar_item', 100);

bin/yacht-agent/src/main.rs

@@ -34,7 +34,7 @@ use tracing_subscriber::FmtSubscriber;
 use wharf_core::config::{ConfigLoader, YachtAgentConfig};
 use wharf_core::crypto::{
     self, HybridKeypair, HybridPublicKey, generate_hybrid_keypair, hybrid_public_key,
-    verify_hybrid, serialize_public_key,
+    verify_with_scheme, serialize_public_key, SignatureScheme,
     serialize_keypair_raw, deserialize_keypair_raw,
 };
 use wharf_core::db_policy::{DatabasePolicy, PolicyEngine, QueryAction};
@@ -137,6 +137,10 @@ struct Args {
     #[arg(long, default_value_t = true, env = "METRICS_ENABLED")]
     metrics_enabled: bool,
 
+    /// Signature scheme: ml-dsa-87-only (default, production-safe) or hybrid (requires ed448 audit)
+    #[arg(long, default_value = "ml-dsa-87-only", env = "SIGNATURE_SCHEME")]
+    signature_scheme: String,
+
     /// Enable verbose logging
     #[arg(short, long, action = clap::ArgAction::Count)]
     verbose: u8,
@@ -179,6 +183,9 @@ struct AgentState {
     /// Site root for integrity verification
     site_root: Option<String>,
 
+    /// Signature scheme for mooring verification
+    signature_scheme: SignatureScheme,
+
     /// Statistics
     queries_allowed: u64,
     queries_blocked: u64,
@@ -188,7 +195,7 @@ struct AgentState {
 }
 
 impl AgentState {
-    fn new(key_store_dir: Option<&str>) -> Self {
+    fn new(key_store_dir: Option<&str>, signature_scheme: SignatureScheme) -> Self {
         // Load or generate yacht keypair with persistence
         let (keypair, pubkey) = Self::load_or_generate_keypair(key_store_dir);
 
@@ -203,6 +210,7 @@ impl AgentState {
             yacht_pubkey: pubkey,
             last_mooring_time: None,
             site_root: None,
+            signature_scheme,
             queries_allowed: 0,
             queries_blocked: 0,
             queries_audited: 0,
@@ -453,8 +461,15 @@ async fn main() -> anyhow::Result<()> {
         error!("WARNING: No firewall protection active!");
     }
 
+    // Parse signature scheme from CLI arg
+    let signature_scheme = match args.signature_scheme.as_str() {
+        "hybrid" => SignatureScheme::Hybrid,
+        _ => SignatureScheme::MlDsa87Only,
+    };
+    info!("Signature scheme: {:?}", signature_scheme);
+
     // Initialize shared state with persistent keypair
-    let mut agent_state = AgentState::new(config.key_store_dir.as_deref());
+    let mut agent_state = AgentState::new(config.key_store_dir.as_deref(), signature_scheme);
     agent_state.site_root = config.site_root.clone();
     let state = Arc::new(RwLock::new(agent_state));
 
@@ -793,8 +808,8 @@ async fn mooring_init(
             Ok(wharf_pk) => {
                 match crypto::deserialize_signature(&request.signature) {
                     Ok(sig) => {
-                        if let Err(e) = verify_hybrid(&wharf_pk, &canonical, &sig) {
-                            warn!("Hybrid signature verification failed: {}", e);
+                        if let Err(e) = verify_with_scheme(&wharf_pk, &canonical, &sig, state_guard.signature_scheme) {
+                            warn!("Signature verification failed: {}", e);
                             return Json(serde_json::json!({
                                 "error": "invalid_signature",
                                 "message": format!("Signature verification failed: {}", e)
@@ -1326,7 +1341,7 @@ mod tests {
     #[tokio::test]
     async fn test_mooring_e2e_flow() {
         // Build the yacht-agent API on a random port
-        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        let state = Arc::new(RwLock::new(AgentState::new(None, SignatureScheme::default())));
         let app = build_api_router(state.clone(), true);
 
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
@@ -1395,7 +1410,7 @@ mod tests {
     /// Test that the health endpoint responds
     #[tokio::test]
     async fn test_health_endpoint() {
-        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        let state = Arc::new(RwLock::new(AgentState::new(None, SignatureScheme::default())));
         let app = build_api_router(state, false);
 
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
@@ -1420,7 +1435,7 @@ mod tests {
     /// Test that metrics endpoint returns real counters
     #[tokio::test]
     async fn test_metrics_endpoint() {
-        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        let state = Arc::new(RwLock::new(AgentState::new(None, SignatureScheme::default())));
         {
             let mut s = state.write().await;
             s.queries_allowed = 42;
@@ -1451,7 +1466,7 @@ mod tests {
     /// Test that stats endpoint returns real counters
     #[tokio::test]
     async fn test_stats_endpoint() {
-        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        let state = Arc::new(RwLock::new(AgentState::new(None, SignatureScheme::default())));
         {
             let mut s = state.write().await;
             s.queries_allowed = 10;

crates/wharf-core/src/config.rs

@@ -16,6 +16,7 @@
 //! 5. System config (`/etc/wharf/`)
 //! 6. Hardcoded defaults
 
+use crate::crypto::SignatureScheme;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use thiserror::Error;
@@ -67,6 +68,9 @@ pub struct YachtAgentConfig {
 
     /// Directory for storing persistent keypairs (default: /etc/wharf/keys/)
     pub key_store_dir: Option<String>,
+
+    /// Signature scheme: "ml-dsa-87-only" (default, production-safe) or "hybrid" (requires ed448 audit)
+    pub signature_scheme: SignatureScheme,
 }
 
 /// Logging configuration
@@ -198,6 +202,9 @@ pub struct WharfCliConfig {
 
     /// Directory for storing persistent keypairs (default: ~/.wharf/keys/)
     pub key_store_dir: Option<String>,
+
+    /// Signature scheme: "ml-dsa-87-only" (default, production-safe) or "hybrid" (requires ed448 audit)
+    pub signature_scheme: SignatureScheme,
 }
 
 /// Path configuration