Snapshot local work before sync

Author: hyperpolymath

.github/workflows/casket-pages.yml

@@ -0,0 +1,116 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: GitHub Pages
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+
+      - name: Checkout casket-ssg
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        with:
+          repository: hyperpolymath/casket-ssg
+          path: .casket-ssg
+
+      - name: Setup GHCup
+        uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2
+        with:
+          ghc-version: '9.8.2'
+          cabal-version: '3.10'
+
+      - name: Cache Cabal
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: |
+            ~/.cabal/packages
+            ~/.cabal/store
+            .casket-ssg/dist-newstyle
+          key: ${{ runner.os }}-casket-${{ hashFiles('.casket-ssg/casket-ssg.cabal') }}
+
+      - name: Build casket-ssg
+        working-directory: .casket-ssg
+        run: cabal build
+
+      - name: Prepare site source
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf .site-src _site
+
+          if [ -d site ]; then
+            cp -R site .site-src
+          else
+            mkdir -p .site-src
+            TODAY="$(date +%Y-%m-%d)"
+            REPO_NAME="${{ github.event.repository.name }}"
+            REPO_URL="https://github.com/${{ github.repository }}"
+            README_URL=""
+
+            if [ -f README.md ]; then
+              README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.md"
+            elif [ -f README.adoc ]; then
+              README_URL="${REPO_URL}/blob/${{ github.ref_name }}/README.adoc"
+            fi
+
+            {
+              echo "---"
+              echo "title: ${REPO_NAME}"
+              echo "date: ${TODAY}"
+              echo "---"
+              echo
+              echo "# ${REPO_NAME}"
+              echo
+              echo "Static documentation site for ${REPO_NAME}."
+              echo
+              echo "- Source repository: [${{ github.repository }}](${REPO_URL})"
+              if [ -n "${README_URL}" ]; then
+                echo "- README: [project README](${README_URL})"
+              fi
+              if [ -d docs ]; then
+                echo "- Docs directory: [docs/](${REPO_URL}/tree/${{ github.ref_name }}/docs)"
+              fi
+              echo
+              echo "Project-specific site content can be added later under site/."
+            } > .site-src/index.md
+          fi
+
+      - name: Build site
+        run: |
+          mkdir -p _site
+          cd .casket-ssg && cabal run casket-ssg -- build ../.site-src ../_site
+          touch ../_site/.nojekyll
+
+      - name: Setup Pages
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        with:
+          path: '_site'
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

ROADMAP.adoc

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+= Project Wharf Roadmap
+
+== Current Status
+
+Project Wharf is the strongest architectural core in this portfolio, but it should be judged by trusted-core rigor rather than by broad completion percentages.
+
+* The offline-controller / online-runtime split is coherent and strategically strong.
+* The database policy engine, integrity path, and mooring model are the highest-value differentiators.
+* The release story still depends on deeper fail-closed verification and clearer crypto-release posture.
+
+== P0 Release Blockers
+
+* [ ] Prove and test fail-closed handling for unrecognized or administrative SQL statements across the DB policy path.
+* [ ] Expand database-policy tests beyond smoke coverage so the trusted core is exercised more realistically.
+* [ ] Resolve the Ed448 audit dependency or standardize deployment guidance around the audited ML-DSA-only path.
+* [ ] Reconcile the 95%-complete style language with the thin current test surface.
+
+== P1 Hardening Work
+
+* [ ] Add load, fault-injection, and concurrency testing for mooring, integrity verification, and DB proxying.
+* [ ] Add explicit release criteria for the trusted core.
+* [ ] Publish a tighter operator guide for what is supported, experimental, or crypto-audit dependent.
+
+== P2 Productization
+
+* [ ] Treat Wharf as the backbone of the live stack once the trusted core is proven.
+* [ ] Use WordPress deployments as real operational validation instead of broad architectural percentages.
+* [ ] Keep the scope centered on runtime hardening rather than accumulating adjacent infrastructure features too early.

TOPOLOGY.md

@@ -1,6 +1,8 @@
 <!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
 # TOPOLOGY.md - Project Wharf
 
+> NOTE (2026-03-30): Read this dashboard as an architectural tracking view, not as a release gate by itself. For current blockers and deployment posture, use `ROADMAP.adoc` as the authoritative readiness document.
+
 ## System Architecture
 
 ```

crates/wharf-core/src/db_policy.rs

@@ -14,10 +14,10 @@
 //! - **Immutable (Red)**: Read-only, writes blocked unless from Wharf (e.g., wp_users, wp_options)
 //! - **Hybrid (Grey)**: Conditional based on specific columns/values (e.g., transient caches in wp_options)
 
+use serde::{Deserialize, Serialize};
 use sqlparser::ast::{Statement, TableFactor};
 use sqlparser::dialect::MySqlDialect;
 use sqlparser::parser::Parser;
-use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
 #[derive(Error, Debug)]
@@ -110,6 +110,9 @@ impl PolicyEngine {
 
         for statement in ast {
             match &statement {
+                Statement::Query(_) => {
+                    continue;
+                }
                 Statement::Insert { table_name, .. } => {
                     let table = table_name.to_string();
                     return self.check_write_permission(&table);
@@ -132,8 +135,14 @@ impl PolicyEngine {
                     // ALTER is always blocked from the yacht
                     return Ok(QueryAction::Block);
                 }
-                // SELECT and other read operations are always allowed
-                _ => {}
+                _ => {
+                    if self.is_safe_session_or_read_query(sql) {
+                        continue;
+                    }
+
+                    // Fail closed for anything we do not explicitly understand.
+                    return Ok(QueryAction::Block);
+                }
             }
         }
 
@@ -145,12 +154,22 @@ impl PolicyEngine {
         let normalized = table.trim_matches('`').to_lowercase();
 
         // Check if explicitly allowed (exact match, not substring)
-        if self.policy.allow_write.iter().any(|t| normalized == t.to_lowercase()) {
+        if self
+            .policy
+            .allow_write
+            .iter()
+            .any(|t| normalized == t.to_lowercase())
+        {
             return Ok(QueryAction::Allow);
         }
 
         // Check if explicitly locked (exact match, not substring)
-        if self.policy.lock_down.iter().any(|t| normalized == t.to_lowercase()) {
+        if self
+            .policy
+            .lock_down
+            .iter()
+            .any(|t| normalized == t.to_lowercase())
+        {
             return Err(PolicyError::ImmutableTableViolation { table: normalized });
         }
 
@@ -180,10 +199,10 @@ impl PolicyEngine {
     fn extract_all_tables_from_factor(&self, factor: &TableFactor) -> Vec<String> {
         match factor {
             TableFactor::Table { name, .. } => vec![name.to_string()],
-            TableFactor::Derived { subquery, .. } => {
-                self.extract_tables_from_query(subquery)
-            }
-            TableFactor::NestedJoin { table_with_joins, .. } => {
+            TableFactor::Derived { subquery, .. } => self.extract_tables_from_query(subquery),
+            TableFactor::NestedJoin {
+                table_with_joins, ..
+            } => {
                 let mut tables = self.extract_all_tables_from_factor(&table_with_joins.relation);
                 for join in &table_with_joins.joins {
                     tables.extend(self.extract_all_tables_from_factor(&join.relation));
@@ -207,6 +226,29 @@ impl PolicyEngine {
         }
         tables
     }
+
+    fn is_safe_session_or_read_query(&self, sql: &str) -> bool {
+        let normalized = sql.trim_start().to_uppercase();
+        let safe_prefixes = [
+            "SELECT ",
+            "WITH ",
+            "SHOW ",
+            "DESCRIBE ",
+            "DESC ",
+            "EXPLAIN ",
+            "SET NAMES ",
+            "SET CHARACTER SET ",
+            "SET SESSION ",
+            "START TRANSACTION",
+            "BEGIN",
+            "COMMIT",
+            "ROLLBACK",
+        ];
+
+        safe_prefixes
+            .iter()
+            .any(|prefix| normalized.starts_with(prefix))
+    }
 }
 
 #[cfg(test)]
@@ -223,7 +265,9 @@ mod tests {
     #[test]
     fn test_insert_to_comments_allowed() {
         let engine = PolicyEngine::new(DatabasePolicy::default());
-        let result = engine.analyze("INSERT INTO wp_comments (comment_content) VALUES ('test')").unwrap();
+        let result = engine
+            .analyze("INSERT INTO wp_comments (comment_content) VALUES ('test')")
+            .unwrap();
         assert_eq!(result, QueryAction::Allow);
     }
 
@@ -237,7 +281,9 @@ mod tests {
     #[test]
     fn test_unknown_table_blocked_fail_closed() {
         let engine = PolicyEngine::new(DatabasePolicy::default());
-        let result = engine.analyze("INSERT INTO wp_custom_table (col) VALUES ('test')").unwrap();
+        let result = engine
+            .analyze("INSERT INTO wp_custom_table (col) VALUES ('test')")
+            .unwrap();
         assert_eq!(result, QueryAction::Block);
     }
 
@@ -251,29 +297,51 @@ mod tests {
     #[test]
     fn test_alter_always_blocked() {
         let engine = PolicyEngine::new(DatabasePolicy::default());
-        let result = engine.analyze("ALTER TABLE wp_comments ADD COLUMN backdoor TEXT").unwrap();
+        let result = engine
+            .analyze("ALTER TABLE wp_comments ADD COLUMN backdoor TEXT")
+            .unwrap();
         assert_eq!(result, QueryAction::Block);
     }
 
+    #[test]
+    fn test_truncate_blocked_fail_closed() {
+        let engine = PolicyEngine::new(DatabasePolicy::default());
+        let result = engine.analyze("TRUNCATE TABLE wp_posts").unwrap();
+        assert_eq!(result, QueryAction::Block);
+    }
+
+    #[test]
+    fn test_session_queries_allowed() {
+        let engine = PolicyEngine::new(DatabasePolicy::default());
+        let result = engine.analyze("SET NAMES utf8mb4").unwrap();
+        assert_eq!(result, QueryAction::Allow);
+    }
+
     #[test]
     fn test_exact_table_match_no_substring() {
         // wp_comments_backdoor should NOT match wp_comments (exact match only)
         let engine = PolicyEngine::new(DatabasePolicy::default());
-        let result = engine.analyze("INSERT INTO wp_comments_backdoor (col) VALUES ('test')").unwrap();
+        let result = engine
+            .analyze("INSERT INTO wp_comments_backdoor (col) VALUES ('test')")
+            .unwrap();
         assert_eq!(result, QueryAction::Block);
     }
 
     #[test]
     fn test_delete_from_comments_allowed() {
         let engine = PolicyEngine::new(DatabasePolicy::default());
-        let result = engine.analyze("DELETE FROM wp_comments WHERE comment_id = 1").unwrap();
+        let result = engine
+            .analyze("DELETE FROM wp_comments WHERE comment_id = 1")
+            .unwrap();
         assert_eq!(result, QueryAction::Allow);
     }
 
     #[test]
     fn test_update_comments_allowed() {
         let engine = PolicyEngine::new(DatabasePolicy::default());
-        let result = engine.analyze("UPDATE wp_comments SET comment_content = 'edited' WHERE comment_id = 1").unwrap();
+        let result = engine
+            .analyze("UPDATE wp_comments SET comment_content = 'edited' WHERE comment_id = 1")
+            .unwrap();
         assert_eq!(result, QueryAction::Allow);
     }