docs: update metadata to 95% completion, add v1.0 shipping entries

STATE.scm bumped to 95%, production-hardening marked complete,
v1.0-shipping milestone added. ECOSYSTEM.scm gains verisimdb-data
and wordpress adapter. TOPOLOGY.md adds signature scheme rows and
wordpress-adapter/deployment components. README adds signature scheme
config, WordPress dashboard adapter, deployment guide, and hack-me
challenge sections. CHANGELOG adds v1.0 shipping preparation block.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.machine_readable/ECOSYSTEM.scm

@@ -14,4 +14,6 @@
     (project "panic-attacker" (relationship quality-tool) (description "Security scanning for weak points"))
     (project "echidna" (relationship quality-tool) (description "Formal proofing and fuzzing"))
     (project "hypatia" (relationship ci-cd-tool) (description "Neurosymbolic CI/CD security intelligence"))
-    (project "gitbot-fleet" (relationship automation) (description "Bot orchestration: rhodibot, echidnabot, sustainabot, glambot, seambot, finishbot"))))
+    (project "gitbot-fleet" (relationship automation) (description "Bot orchestration: rhodibot, echidnabot, sustainabot, glambot, seambot, finishbot"))
+    (project "verisimdb-data" (relationship quality-data) (description "Security scan data ingestion for weak point tracking"))
+    (project "wordpress" (relationship adapter-target) (description "Primary CMS adapter — GPL-2.0 dashboard plugin in adapters/wordpress-wharf/"))))

.machine_readable/STATE.scm

@@ -3,14 +3,14 @@
   (project-context
     (name "project-wharf")
     (purpose "Sovereign Web Hypervisor — immutable CMS infrastructure with offline admin (Wharf) and online runtime (Yacht)")
-    (completion-percentage 90))
+    (completion-percentage 95))
   (route-to-mvp
     (milestone "crypto-overhaul" (status complete) (description "Ed448 + ML-DSA-87 hybrid signatures, SHAKE3-512, XChaCha20-Poly1305, HKDF, Argon2id"))
     (milestone "http-mooring-client" (status complete) (description "MooringClient HTTP API: init → verify → rsync → commit"))
     (milestone "identity-file" (status complete) (description "SSH identity resolution: yacht → fleet → ~/.ssh/id_ed448 → agent"))
     (milestone "container-compliance" (status complete) (description "Chainguard bases, Containerfile naming, selur-compose orchestration"))
     (milestone "demo-script" (status complete) (description "End-to-end mooring + SQL injection blocking + file tampering detection"))
-    (milestone "production-hardening" (status in-progress) (description "Production hardening milestone")
+    (milestone "production-hardening" (status complete) (description "Production hardening milestone")
       (sub-milestone "keypair-persistence" (status complete) (description "Persistent hybrid keypairs for CLI and yacht-agent with file permissions"))
       (sub-milestone "ebpf-loader" (status complete) (description "Full XDP kernel program + userspace loader in crates/wharf-ebpf/"))
       (sub-milestone "database-proxy" (status complete) (description "Full AST parser via sqlparser 0.39 in db_policy.rs"))
@@ -19,6 +19,14 @@
       (sub-milestone "http-resilience" (status complete) (description "Timeouts, connection pooling on mooring HTTP client"))
       (sub-milestone "integrity-verification" (status complete) (description "Yacht agent mooring verify wired to BLAKE3 manifest verification"))
       (sub-milestone "ed448-audit" (status pending) (description "ed448-goldilocks v0.14.0-pre.10 needs third-party audit before production"))))
+    (milestone "v1.0-shipping" (status complete) (description "V1.0 shipping preparation")
+      (sub-milestone "signature-scheme-flag" (status complete) (description "Feature-flag ed448: MlDsa87Only default, Hybrid opt-in"))
+      (sub-milestone "sqli-smoke-tests" (status complete) (description "19 integration tests proving AST proxy blocks WordPress attack patterns"))
+      (sub-milestone "deployment-package" (status complete) (description "setup.sh, DEPLOY.adoc, selur-compose orchestration"))
+      (sub-milestone "hack-me-challenge" (status complete) (description "HACK-ME-CHALLENGE.adoc with rules of engagement and technical details"))
+      (sub-milestone "wordpress-adapter" (status complete) (description "GPL-2.0 PHP plugin for wp-admin dashboard widget + admin bar indicator"))
+      (sub-milestone "systemd-packaging" (status complete) (description "yacht-agent.service with full systemd hardening"))
+      (sub-milestone "tooling-enrollment" (status complete) (description "Bot directives, panic-attacker workflow, AI manifest updated"))))
   (components
     (component "wharf-core" (path "crates/wharf-core") (role "shared library: crypto, fleet, integrity, mooring, sync"))
     (component "wharf-cli" (path "bin/wharf-cli") (role "offline admin CLI: moor, integrity, fleet management"))

CHANGELOG.adoc

@@ -19,6 +19,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Comprehensive Justfile with 50+ recipes
 - RSR (Rhodium Standard Repository) compliance documentation
 
+=== V1.0 Shipping Preparation (2026-02-14)
+- *Signature scheme feature flag*: Ed448 now opt-in via `SignatureScheme::Hybrid`; default is `MlDsa87Only` (FIPS 204 peer-reviewed). Configurable via `--signature-scheme` CLI arg and TOML config.
+- *SQL injection smoke tests*: 19 integration tests proving AST-based proxy blocks real WordPress attack patterns (user creation, options manipulation, content defacement, DDL, stacked injection)
+- *Deployment package*: `deploy/setup.sh` first-run script + `deploy/DEPLOY.adoc` step-by-step guide with podman/selur-compose orchestration
+- *Hack-me challenge*: `docs/HACK-ME-CHALLENGE.adoc` with rules of engagement, attack surface table, and technical details for security researchers
+- *WordPress adapter plugin*: `adapters/wordpress-wharf/` — GPL-2.0-or-later PHP plugin providing dashboard widget (query stats, firewall mode, signature scheme) and admin bar indicator
+- *systemd unit*: `infra/systemd/yacht-agent.service` with DynamicUser, ProtectSystem=strict, MemoryDenyWriteExecute, and CAP_BPF
+- *Tooling enrollment*: Bot directives for gitbot-fleet (8 bots), panic-attacker security scan workflow, AI manifest updated
+- *K9 contractiles*: Nickel configuration templates (Kennel/Yard/Hunt levels) for deployment automation
+
 === Production Hardening (2026-02-14)
 - *Persistent hybrid keypairs*: Wharf CLI (`~/.wharf/keys/wharf.key`) and Yacht Agent (`/etc/wharf/keys/yacht.key`) now persist Ed448 + ML-DSA-87 keypairs across restarts with proper file permissions (0600 private, 0644 public)
 - *Keypair serialization*: Custom binary format with `WHRF` magic, versioning, and optional password encryption via HKDF-SHAKE512 + XChaCha20-Poly1305
@@ -61,7 +71,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 | Version | Date | Highlights |
 |---------|------|------------|
-| Unreleased | 2026-02-14 | Production hardening: persistent keypairs, eBPF, metrics, integrity verification |
+| Unreleased | 2026-02-14 | V1.0 shipping: signature scheme flag, SQLi tests, deployment package, WordPress adapter, hack-me challenge |
 | 0.1.0 | 2025-11-26 | Initial release |
 
 == Upgrade Guide

README.adoc

@@ -228,6 +228,30 @@ cp adapters/wordpress/db.php /var/www/html/wp-content/db.php
 echo "include_once '/opt/wharf/adapters/drupal/settings.php';" >> sites/default/settings.php
 ----
 
+=== WordPress Dashboard Adapter
+
+A thin GPL-2.0 plugin that displays Wharf protection status in wp-admin:
+
+[source,bash]
+----
+# Copy the adapter plugin into your WordPress plugins directory
+cp -r adapters/wordpress-wharf /var/www/html/wp-content/plugins/wharf-adapter
+----
+
+Features:
+
+* Dashboard widget showing query stats (allowed/blocked), firewall mode, signature scheme
+* Admin bar indicator (green = protected, grey = agent unreachable)
+* 30-second response caching via WordPress transients
+* Zero security logic — all enforcement handled by yacht-agent
+
+Configure the agent URL in `wp-config.php` if non-default:
+
+[source,php]
+----
+define('WHARF_AGENT_URL', 'http://agent:9001');
+----
+
 === Others
 
 * Joomla (adapter included)
@@ -236,6 +260,26 @@ echo "include_once '/opt/wharf/adapters/drupal/settings.php';" >> sites/default/
 
 == Security Model
 
+=== Signature Scheme Configuration
+
+Wharf supports two signature modes, selectable at startup:
+
+|===
+| Scheme | Flag | Description
+
+| *ML-DSA-87 Only* (default) | `--signature-scheme ml-dsa-87-only` | FIPS 204 post-quantum only. Production-safe, peer-reviewed.
+| *Hybrid* | `--signature-scheme hybrid` | Ed448 + ML-DSA-87 dual signatures. Requires ed448-goldilocks audit.
+|===
+
+Set in TOML config (`yacht-agent.toml` or `wharf-cli.toml`):
+
+[source,toml]
+----
+signature_scheme = "ml-dsa-87-only"  # or "hybrid"
+----
+
+The default (`ml-dsa-87-only`) is recommended for production until the ed448-goldilocks library completes its third-party audit.
+
 === Cryptographic Primitives
 
 Wharf uses a *post-quantum hybrid* signature scheme and modern cryptographic primitives:
@@ -353,6 +397,21 @@ just gen-email-records # Generate SPF/DKIM/DMARC
 just deploy-yacht      # Deploy agent to server
 ----
 
+== Deployment
+
+See link:deploy/DEPLOY.adoc[Deployment Guide] for a 5-minute quick start with Podman.
+
+[source,bash]
+----
+cd deploy && sudo ./setup.sh --domain example.com
+sudo podman compose -f ../infra/selur-compose.yaml up -d
+curl http://localhost:9001/health
+----
+
+== Security Challenge
+
+**Think you can break it?** See link:docs/HACK-ME-CHALLENGE.adoc[Hack This WordPress Site] — a fully documented challenge for security researchers to test the Wharf architecture.
+
 == Contributing
 
 Contributions are welcome! Please ensure:

TOPOLOGY.md

@@ -64,20 +64,24 @@
 | - mooring protocol     | `[██████████]` 100%         | Init/verify/commit/abort, canonical signing |
 | - mooring_client       | `[██████████]` 100%         | HTTP client with timeouts + pooling |
 | - fleet/sync/config    | `[██████████]` 100%         | Fleet TOML, rsync, config hierarchy |
-| **wharf-cli**          | `[█████████░]` 90%           | Near-complete |
+| **wharf-cli**          | `[█████████░]` 95%           | Near-complete |
 | - moor operations      | `[██████████]` 100%         | Full mooring flow, persistent keypairs |
 | - fleet management     | `[██████████]` 100%         | Add/remove/list yachts |
 | - integrity audit      | `[████████░░]` 80%          | Local + remote SSH, API mode pending |
-| **yacht-agent**        | `[█████████░]` 90%           | Near-complete |
+| - signature scheme     | `[██████████]` 100%         | MlDsa87Only (default) / Hybrid (opt-in) |
+| **yacht-agent**        | `[█████████░]` 95%           | Near-complete |
 | - DB proxy             | `[██████████]` 100%         | MySQL + PostgreSQL wire protocol |
 | - mooring API          | `[██████████]` 100%         | Init/verify/commit with sig verification |
 | - integrity verify     | `[██████████]` 100%         | BLAKE3 manifest verification wired |
 | - firewall (nftables)  | `[██████████]` 100%         | Rule generation, validation, runtime updates |
 | - metrics/stats        | `[██████████]` 100%         | Prometheus + JSON with real counters |
 | - keypair persistence  | `[██████████]` 100%         | /etc/wharf/keys/yacht.key |
+| - signature scheme     | `[██████████]` 100%         | CLI flag --signature-scheme, config support |
 | **wharf-ebpf**         | `[████████░░]` 80%           | XDP program + loader, needs production testing |
 | **nebula.rs**          | `[██████████]` 100%          | CA, cert signing, IP allocation, revocation |
-| **Overall**            | `[█████████░]` 90%           | ed448 audit pending |
+| **wordpress-adapter**  | `[██████████]` 100%          | GPL-2.0 dashboard widget + admin bar indicator |
+| **deployment**         | `[██████████]` 100%          | setup.sh, DEPLOY.adoc, systemd unit, selur-compose |
+| **Overall**            | `[█████████░]` 95%           | ed448 audit pending, otherwise shipping |
 
 ## Key Dependencies