feat: integration tests, tooling enrollment, packaging, k9 contractiles

Add yacht-agent integration tests (4 tests: mooring e2e, health, metrics,
stats). Fix MooringClient null-error handling bug where `error: null` in
JSON responses was incorrectly treated as an error. Extract
build_api_router() for testability.

Add systemd unit file for bare-metal yacht-agent deployment with full
security hardening (DynamicUser, ProtectSystem=strict, etc.).

Enroll in panic-attacker (security-scan.yml workflow), echidna and
gitbot-fleet (8 bot directives with wharf-specific constraints).

Fill k9 contractile templates: Kennel (yacht-config), Yard (deployment
params with validation contracts), Hunt (deploy automation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.bot_directives/echidnabot.scm

@@ -3,5 +3,5 @@
   (bot "echidnabot")
   (scope "formal verification and fuzzing")
   (allow ("analysis" "fuzzing" "proof checks"))
-  (deny ("write to core modules" "write to bindings"))
-  (notes "May open findings; code changes require explicit approval"))
+  (deny ("write to crypto module" "write to mooring protocol"))
+  (notes "May open findings; code changes to crypto.rs or mooring.rs require explicit approval"))

.bot_directives/seambot.scm

@@ -4,4 +4,4 @@
   (scope "integration health")
   (allow ("analysis" "contract checks" "docs updates"))
   (deny ("code changes without approval"))
-  (notes "May add integration test suggestions"))
+  (notes "Verify mooring protocol contracts and inter-crate API consistency"))

.github/workflows/security-scan.yml

@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Panic-Attack Security Scan — Universal stress testing + VeriSimDB ingest
+name: Security Scan
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 0'  # Weekly on Sunday
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  panic-attack:
+    name: Panic-Attack Assail
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: stable
+
+      - name: Cache panic-attacker binary
+        id: cache-pa
+        uses: actions/cache@v4
+        with:
+          path: ~/.cargo/bin/panic-attacker
+          key: panic-attacker-${{ runner.os }}
+
+      - name: Build panic-attacker
+        if: steps.cache-pa.outputs.cache-hit != 'true'
+        run: |
+          git clone https://github.com/hyperpolymath/panic-attacker.git /tmp/panic-attacker
+          cd /tmp/panic-attacker
+          cargo build --release
+          cp target/release/panic-attacker ~/.cargo/bin/
+
+      - name: Run panic-attack assail
+        run: |
+          panic-attacker assail . --output /tmp/scan-results.json
+          echo "## Panic-Attack Scan Results" >> $GITHUB_STEP_SUMMARY
+          WEAK_POINTS=$(jq '.weak_points | length' /tmp/scan-results.json 2>/dev/null || echo 0)
+          echo "- Weak points found: $WEAK_POINTS" >> $GITHUB_STEP_SUMMARY
+
+      - name: Upload scan artifact
+        uses: actions/upload-artifact@65c79d7f54e76e4e3c7a8f34db0f4ac8b515c478 # v4
+        with:
+          name: panic-attack-results
+          path: /tmp/scan-results.json
+          retention-days: 90
+
+      - name: Ingest to VeriSimDB
+        if: always()
+        env:
+          VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}
+        run: |
+          if [ -z "$VERISIMDB_PAT" ]; then
+            echo "VERISIMDB_PAT not set — skipping VeriSimDB ingest"
+            exit 0
+          fi
+
+          curl -X POST \
+            -H "Authorization: token $VERISIMDB_PAT" \
+            -H "Accept: application/vnd.github.v3+json" \
+            https://api.github.com/repos/hyperpolymath/verisimdb-data/dispatches \
+            -d "{\"event_type\":\"ingest-scan\",\"client_payload\":{\"repo\":\"project-wharf\",\"scan_file\":\"panic-attack-results\"}}"
+
+          echo "Dispatched VeriSimDB ingest event"

.gitignore

@@ -49,7 +49,7 @@ __pycache__/
 # Ada/SPARK
 *.ali
 /obj/
-/bin/
+# /bin/ — NOT ignored: contains wharf-cli and yacht-agent source crates
 
 # Haskell
 /.stack-work/
@@ -77,3 +77,8 @@ htmlcov/
 /tmp/
 *.tmp
 *.bak
+
+# AI/Sync artifacts
+ai-cli-crash-capture/
+.directory
+sync_report*.txt

AI.a2ml

@@ -24,6 +24,14 @@
 - AST-aware SQL proxy blocks injection at wire level
 - Fail-closed: if it can't verify, it blocks
 
+## Integration
+
+- **panic-attack**: Weekly security scan via `.github/workflows/security-scan.yml`
+- **hypatia**: Neurosymbolic CI/CD via `.github/workflows/hypatia-scan.yml`
+- **gitbot-fleet**: Bot directives in `.bot_directives/` (8 bots enrolled)
+- **verisimdb-data**: Scan results ingested via repository_dispatch
+- **echidna**: Formal verification via echidnabot directive
+
 ## Delivery Promises
 - Mention in summaries whether STATE, `contractiles/`, or `.bot_directives/` changed.
 - Keep this file in sync with the repository's status; update it if the governance changes.

Cargo.lock

@@ -43,3 +43,6 @@ anyhow = { workspace = true }
 
 # eBPF Userspace Loader (optional - only used in ebpf mode)
 aya = { workspace = true }
+
+[dev-dependencies]
+reqwest = { workspace = true }

bin/yacht-agent/Cargo.toml

@@ -471,24 +471,11 @@ async fn main() -> anyhow::Result<()> {
     });
 
     // Build the API router
-    let api_state = state.clone();
-    let mut app = Router::new()
-        .route("/health", get(health_check))
-        .route("/status", get(status))
-        .route("/stats", get(stats))
-        // Mooring protocol endpoints
-        .route("/mooring/init", post(mooring_init))
-        .route("/mooring/verify", post(mooring_verify))
-        .route("/mooring/commit", post(mooring_commit));
-
-    // Add metrics endpoint if enabled
+    let app = build_api_router(state.clone(), args.metrics_enabled);
     if args.metrics_enabled {
-        app = app.route("/metrics", get(prometheus_metrics));
         info!("Prometheus metrics enabled at /metrics");
     }
 
-    let app = app.with_state(api_state);
-
     // Bind API to localhost only (Nebula mesh provides external access)
     let api_addr = SocketAddr::from(([0, 0, 0, 0], args.api_port));
     info!("API listening on {}", api_addr);
@@ -499,6 +486,29 @@ async fn main() -> anyhow::Result<()> {
     Ok(())
 }
 
+// =============================================================================
+// ROUTER CONSTRUCTION
+// =============================================================================
+
+/// Build the API router for the yacht-agent.
+///
+/// Extracted for testability — the integration tests call this directly.
+fn build_api_router(state: SharedState, metrics_enabled: bool) -> Router {
+    let mut app = Router::new()
+        .route("/health", get(health_check))
+        .route("/status", get(status))
+        .route("/stats", get(stats))
+        .route("/mooring/init", post(mooring_init))
+        .route("/mooring/verify", post(mooring_verify))
+        .route("/mooring/commit", post(mooring_commit));
+
+    if metrics_enabled {
+        app = app.route("/metrics", get(prometheus_metrics));
+    }
+
+    app.with_state(state)
+}
+
 // =============================================================================
 // DATABASE PROXY
 // =============================================================================
@@ -1299,3 +1309,175 @@ async fn setup_nftables_firewall() -> Option<NftablesManager> {
         }
     }
 }
+
+// =============================================================================
+// INTEGRATION TESTS
+// =============================================================================
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+    use wharf_core::mooring::{LayerManifest, MooringLayer};
+    use wharf_core::mooring_client::MooringClient;
+
+    /// End-to-end test of the full mooring protocol flow:
+    /// init → verify → commit over real HTTP.
+    #[tokio::test]
+    async fn test_mooring_e2e_flow() {
+        // Build the yacht-agent API on a random port
+        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        let app = build_api_router(state.clone(), true);
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("Failed to bind test listener");
+        let addr = listener.local_addr().unwrap();
+
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+
+        // Give the server a moment to start
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        // Create a MooringClient with a fresh keypair
+        let keypair = generate_hybrid_keypair().expect("keypair gen");
+        let client = MooringClient::new(&format!("http://{}", addr), keypair);
+
+        // Step 1: Init mooring session
+        let layers = vec![MooringLayer::Config, MooringLayer::Files];
+        let init_resp = client
+            .init_session(layers, false, false)
+            .await
+            .expect("init_session failed");
+
+        assert!(!init_resp.session_id.is_empty(), "session_id should not be empty");
+        assert_eq!(init_resp.accepted_layers.len(), 2);
+        assert!(init_resp.expires_at > 0);
+
+        // Step 2: Verify a layer
+        let manifest = LayerManifest {
+            files: HashMap::from([
+                ("index.html".to_string(), "abc123".to_string()),
+                ("style.css".to_string(), "def456".to_string()),
+            ]),
+            total_size: 2048,
+            file_count: 2,
+            root_hash: "root000".to_string(),
+        };
+
+        let verify_resp = client
+            .verify_layer(&init_resp.session_id, MooringLayer::Config, manifest)
+            .await
+            .expect("verify_layer failed");
+
+        // Without site_root configured, verification passes (dev mode)
+        assert!(verify_resp.verified);
+        assert_eq!(verify_resp.matched_files, 2);
+
+        // Step 3: Commit
+        let commit_resp = client
+            .commit(&init_resp.session_id, init_resp.accepted_layers)
+            .await
+            .expect("commit failed");
+
+        assert!(commit_resp.success);
+        assert!(commit_resp.snapshot_id.is_some());
+
+        // Verify state was updated
+        let s = state.read().await;
+        assert!(s.moored);
+        assert!(s.last_mooring_time.is_some());
+        assert_eq!(s.mooring_session_count, 1);
+    }
+
+    /// Test that the health endpoint responds
+    #[tokio::test]
+    async fn test_health_endpoint() {
+        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        let app = build_api_router(state, false);
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .unwrap();
+        let addr = listener.local_addr().unwrap();
+
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        let resp = reqwest::get(format!("http://{}/health", addr))
+            .await
+            .expect("health request failed");
+
+        assert!(resp.status().is_success());
+        assert_eq!(resp.text().await.unwrap(), "OK");
+    }
+
+    /// Test that metrics endpoint returns real counters
+    #[tokio::test]
+    async fn test_metrics_endpoint() {
+        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        {
+            let mut s = state.write().await;
+            s.queries_allowed = 42;
+            s.queries_blocked = 3;
+        }
+        let app = build_api_router(state, true);
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .unwrap();
+        let addr = listener.local_addr().unwrap();
+
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        let resp = reqwest::get(format!("http://{}/metrics", addr))
+            .await
+            .expect("metrics request failed");
+
+        let body = resp.text().await.unwrap();
+        assert!(body.contains("yacht_queries_total{status=\"allowed\"} 42"));
+        assert!(body.contains("yacht_queries_total{status=\"blocked\"} 3"));
+    }
+
+    /// Test that stats endpoint returns real counters
+    #[tokio::test]
+    async fn test_stats_endpoint() {
+        let state = Arc::new(RwLock::new(AgentState::new(None)));
+        {
+            let mut s = state.write().await;
+            s.queries_allowed = 10;
+            s.queries_blocked = 5;
+            s.queries_audited = 2;
+        }
+        let app = build_api_router(state, false);
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .unwrap();
+        let addr = listener.local_addr().unwrap();
+
+        tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        let resp = reqwest::get(format!("http://{}/stats", addr))
+            .await
+            .expect("stats request failed");
+
+        let body: serde_json::Value = resp.json().await.unwrap();
+        assert_eq!(body["queries"]["allowed"], 10);
+        assert_eq!(body["queries"]["blocked"], 5);
+        assert_eq!(body["queries"]["audited"], 2);
+    }
+}