feat(workspace): add xtask + fuzz + ClusterFuzzLite from WP-edition fork

Brings the WordPress-edition fork's workspace shape into the canonical
repo. The WP-edition was developed in-tree under
repos-monorepo/document-management-toolset/wordpress-tools/project-wharf/
and is now graduating back to the standalone.

- Cargo.toml: add xtask workspace member; exclude fuzz/ from default build
- Cargo.lock: synced (includes new deps for xtask + fuzz dependencies)
- .cargo/config.toml: pinned cargo settings
- xtask/: build-automation crate (`cargo xtask build-ebpf`, etc.)
- fuzz/: cargo fuzz targets (sql_policy, integrity)
- .clusterfuzzlite/: OSS-Fuzz / ClusterFuzzLite CI integration

Per the 2026-04-26 graduation plan (AI-WORK-todo.md item -4).

Author: hyperpolymath

.cargo/config.toml

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+
+# Cargo configuration for Project Wharf
+
+[alias]
+# Run xtask commands (e.g., cargo xtask build-ebpf)
+xtask = "run --package xtask --"
+
+# Build everything including eBPF
+build-all = "xtask build-all"
+
+# eBPF-specific target configuration
+[target.bpfel-unknown-none]
+rustflags = ["-C", "link-arg=--btf"]

.clusterfuzzlite/Containerfile

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite Dockerfile for Rust fuzzing
+
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+
+COPY . $SRC/project-wharf
+WORKDIR $SRC/project-wharf
+
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,21 @@
+#!/bin/bash -eu
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite build script for Rust fuzzing
+
+cd "$SRC"/project-wharf
+
+# Install nightly for fuzzing
+rustup install nightly
+rustup default nightly
+
+# Build fuzz targets
+cargo +nightly fuzz build
+
+# Copy fuzz targets to output
+for target in fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_*; do
+    if [ -f "$target" ] && [ -x "$target" ]; then
+        cp "$target" $OUT/
+    fi
+done

.clusterfuzzlite/project.yaml

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite project configuration
+
+language: rust

Cargo.toml

@@ -3,23 +3,25 @@ members = [
     "crates/wharf-core",
     "bin/wharf-cli",
     "bin/yacht-agent",
+    "xtask",
 ]
 # eBPF crate excluded from default build - requires special toolchain (bpf-linker)
-# Build separately with: cd crates/wharf-ebpf && cargo +nightly build --target bpfel-unknown-none
-exclude = ["crates/wharf-ebpf"]
+# Build with: cargo xtask build-ebpf
+# Or manually: cd crates/wharf-ebpf && cargo +nightly build --target bpfel-unknown-none -Z build-std=core
+exclude = ["crates/wharf-ebpf", "fuzz"]
 resolver = "2"
 
 [workspace.package]
 version = "0.1.0"
 edition = "2021"
-authors = ["Jonathan D. A. Jewell <hyperpolymath>"]
-license = "MIT"
+authors = ["Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>"]
+license = "PMPL-1.0"
 repository = "https://gitlab.com/hyperpolymath/wharf"
 description = "The Sovereign Web Hypervisor - Immutable CMS Infrastructure"
 
 [workspace.dependencies]
 # CLI & Async
-clap = { version = "4.4", features = ["derive"] }
+clap = { version = "4.4", features = ["derive", "env"] }
 tokio = { version = "1", features = ["full"] }
 
 # Configuration
@@ -35,17 +37,43 @@ sqlparser = "0.39"
 webauthn-rs = "0.4"
 
 # Cryptography
-ed25519-dalek = "2.0"
 blake3 = "1.5"
 argon2 = "0.5"
 
+# Post-Quantum Hybrid Signatures (FIPS 204 ML-DSA-87)
+pqcrypto-mldsa = "0.1"
+pqcrypto-traits = "0.3"
+
+# Ed448 Goldilocks Curve (classical component of hybrid)
+ed448-goldilocks = { version = "0.14.0-pre.10", features = ["signing"] }
+
+# SHAKE3/SHA3 (FIPS 202)
+sha3 = "0.10"
+
+# XChaCha20-Poly1305 symmetric encryption
+chacha20poly1305 = "0.10"
+
+# HKDF key derivation
+hkdf = "0.12"
+
+# ChaCha20-based CSPRNG
+rand_chacha = "0.3"
+rand_core = { version = "0.6", features = ["std"] }
+
+# HTTP client
+reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }
+
+# Crypto utilities
+hex = "0.4"
+zeroize = { version = "1.7", features = ["derive"] }
+
 # Networking
 trust-dns-client = "0.23"
 trust-dns-server = "0.23"
 
 # Logging & Error Handling
 tracing = "0.1"
-tracing-subscriber = "0.3"
+tracing-subscriber = { version = "0.3", features = ["json"] }
 anyhow = "1.0"
 thiserror = "1.0"
 

fuzz/Cargo.toml

@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+
+[package]
+name = "project-wharf-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[dependencies.wharf-core]
+path = "../crates/wharf-core"
+
+[[bin]]
+name = "fuzz_sql_policy"
+path = "fuzz_targets/fuzz_sql_policy.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz_integrity"
+path = "fuzz_targets/fuzz_integrity.rs"
+test = false
+doc = false
+bench = false

fuzz/fuzz_targets/fuzz_integrity.rs

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: PMPL-1.0
+// SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+//
+//! Fuzz target for integrity manifest parsing
+//! Tests handling of arbitrary manifest JSON input
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use wharf_core::integrity::Manifest;
+
+fuzz_target!(|data: &[u8]| {
+    // Try to interpret fuzzer input as JSON manifest
+    if let Ok(json_str) = std::str::from_utf8(data) {
+        // Attempt to deserialize - should handle any input gracefully
+        let _: Result<Manifest, _> = serde_json::from_str(json_str);
+    }
+});

fuzz/fuzz_targets/fuzz_sql_policy.rs

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: PMPL-1.0
+// SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+//
+//! Fuzz target for SQL policy engine
+//! Tests the PolicyEngine's ability to handle arbitrary SQL input
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use wharf_core::db_policy::{PolicyConfig, PolicyEngine, TableZone};
+
+fuzz_target!(|data: &[u8]| {
+    // Try to interpret fuzzer input as UTF-8 SQL
+    if let Ok(sql) = std::str::from_utf8(data) {
+        // Create a basic policy config for testing
+        let config = PolicyConfig {
+            mutable_tables: vec!["wp_comments".to_string(), "wp_posts".to_string()],
+            immutable_tables: vec!["wp_users".to_string(), "wp_options".to_string()],
+            hybrid_tables: vec![],
+            default_zone: TableZone::Mutable,
+        };
+
+        let engine = PolicyEngine::new(config);
+
+        // Fuzz the evaluate function - it should handle any input gracefully
+        let _ = engine.evaluate(sql);
+    }
+});

xtask/Cargo.toml

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+
+[package]
+name = "xtask"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+anyhow = "1.0"
+clap = { version = "4", features = ["derive"] }