Skip to content

Commit e36ef8a

Browse files
hyperpolymathhyperpolymath
committed
chore: adopt WP-edition versions of common docs + dedupe formats
Bring in the absorbed-fork's versions of files that existed in both trees, plus a few WP-edition-only metadata files. Per estate convention (.adoc preferred over .md, "LICENSE" over "LICENSE.txt"), dedupe the format overlap. Updated to absorbed-fork content: - .gitignore, .gitattributes, .gitlab-ci.yml, FUNDING.yml - Justfile, SECURITY.md, CONTRIBUTING.adoc, README.adoc Added (WP-edition only): - MAINTAINERS.adoc, TOPOLOGY.md, .nojekyll - CHANGELOG.adoc (replaces CHANGELOG.md per estate convention) Format dedupe: - CHANGELOG.md removed (CHANGELOG.adoc wins) - LICENSE.txt removed (LICENSE wins, no extension per estate convention) - CODE_OF_CONDUCT.adoc kept (already canonical here) Per the 2026-04-26 graduation plan (AI-WORK-todo.md item -4).
1 parent dda8c07 commit e36ef8a

15 files changed

Lines changed: 827 additions & 789 deletions

‎.gitattributes‎

Lines changed: 53 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,54 @@
1-
# SPDX-License-Identifier: MIT
2-
# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
3-
#
4-
# Git Attributes Configuration
5-
# Ensures consistent behavior across platforms
6-
7-
# Auto-detect text files and normalize line endings
8-
* text=auto
9-
10-
# Source code - LF line endings
11-
*.rs text eol=lf
12-
*.toml text eol=lf
13-
*.ncl text eol=lf
14-
*.nix text eol=lf
15-
*.sh text eol=lf
16-
*.php text eol=lf
17-
*.py text eol=lf
18-
19-
# Documentation - LF line endings
20-
*.md text eol=lf
21-
*.adoc text eol=lf
22-
*.txt text eol=lf
23-
*.yml text eol=lf
24-
*.yaml text eol=lf
25-
*.json text eol=lf
26-
27-
# Configuration
28-
*.conf text eol=lf
29-
*.ini text eol=lf
30-
*.cfg text eol=lf
31-
.gitignore text eol=lf
1+
# SPDX-License-Identifier: PMPL-1.0
2+
# RSR-compliant .gitattributes
3+
4+
* text=auto eol=lf
5+
6+
# Source
7+
*.rs text eol=lf diff=rust
8+
*.ex text eol=lf diff=elixir
9+
*.exs text eol=lf diff=elixir
10+
*.jl text eol=lf
11+
*.res text eol=lf
12+
*.resi text eol=lf
13+
*.ada text eol=lf diff=ada
14+
*.adb text eol=lf diff=ada
15+
*.ads text eol=lf diff=ada
16+
*.hs text eol=lf
17+
*.chpl text eol=lf
18+
*.scm text eol=lf
19+
*.ncl text eol=lf
20+
*.nix text eol=lf
21+
22+
# Docs
23+
*.md text eol=lf diff=markdown
24+
*.adoc text eol=lf
25+
*.txt text eol=lf
26+
27+
# Data
28+
*.json text eol=lf
29+
*.yaml text eol=lf
30+
*.yml text eol=lf
31+
*.toml text eol=lf
32+
33+
# Config
34+
.gitignore text eol=lf
3235
.gitattributes text eol=lf
33-
Justfile text eol=lf
34-
Containerfile text eol=lf
35-
Dockerfile text eol=lf
36-
37-
# Templates (DNS zone files)
38-
*.tpl text eol=lf
39-
*.db text eol=lf
40-
*.zone text eol=lf
41-
42-
# Binary files - no conversion
43-
*.png binary
44-
*.jpg binary
45-
*.jpeg binary
46-
*.gif binary
47-
*.ico binary
48-
*.pdf binary
49-
*.wasm binary
50-
51-
# Archives - no conversion
52-
*.tar binary
53-
*.tar.gz binary
54-
*.zip binary
55-
56-
# Diff configuration
57-
*.rs diff=rust
58-
*.md diff=markdown
59-
*.adoc diff=asciidoc
60-
61-
# Merge strategies
62-
Cargo.lock merge=binary
63-
flake.lock merge=binary
64-
65-
# Export ignore (not included in archives)
66-
.git* export-ignore
67-
.gitlab-ci.yml export-ignore
68-
.pre-commit-config.yaml export-ignore
69-
tests/ export-ignore
36+
justfile text eol=lf
37+
Makefile text eol=lf
38+
Containerfile text eol=lf
39+
40+
# Scripts
41+
*.sh text eol=lf
42+
43+
# Binary
44+
*.png binary
45+
*.jpg binary
46+
*.gif binary
47+
*.pdf binary
48+
*.woff2 binary
49+
*.zip binary
50+
*.gz binary
51+
52+
# Lock files
53+
Cargo.lock text eol=lf -diff
54+
flake.lock text eol=lf -diff

‎.gitignore‎

Lines changed: 75 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,95 @@
1-
# Rust build artifacts
2-
/target/
3-
**/*.rs.bk
4-
Cargo.lock
1+
# SPDX-License-Identifier: PMPL-1.0
2+
# RSR-compliant .gitignore
3+
4+
# OS & Editor
5+
.DS_Store
6+
Thumbs.db
7+
*.swp
8+
*.swo
9+
*~
10+
.idea/
11+
.vscode/
512

6-
# Distribution/build outputs
13+
# Build
14+
/target/
15+
/_build/
16+
/build/
717
/dist/
18+
/out/
819

9-
# Secrets and keys (NEVER commit these!)
10-
*.key
11-
*.pem
12-
infra/nebula/*.key
13-
infra/nebula/*.crt
14-
!infra/nebula/.gitkeep
20+
# Dependencies
21+
/node_modules/
22+
/vendor/
23+
/deps/
24+
/.elixir_ls/
1525

16-
# Environment files
17-
.env
18-
.env.*
19-
!.env.example
26+
# Rust
27+
# Cargo.lock # Keep for binaries
2028

21-
# Editor/IDE
22-
.vscode/
23-
.idea/
24-
*.swp
25-
*.swo
26-
*~
29+
# Elixir
30+
/cover/
31+
/doc/
32+
*.ez
33+
erl_crash.dump
2734

28-
# OS files
29-
.DS_Store
30-
Thumbs.db
35+
# Julia
36+
*.jl.cov
37+
*.jl.mem
38+
/Manifest.toml
39+
40+
# ReScript
41+
/lib/bs/
42+
/.bsb.lock
3143

32-
# Variable files with secrets
33-
vars/*.json
34-
!vars/example.json
44+
# Python (SaltStack only)
45+
__pycache__/
46+
*.py[cod]
47+
.venv/
48+
49+
# Ada/SPARK
50+
*.ali
51+
/obj/
52+
# /bin/ — NOT ignored: contains wharf-cli and yacht-agent source crates
53+
54+
# Haskell
55+
/.stack-work/
56+
/dist-newstyle/
57+
58+
# Chapel
59+
*.chpl.tmp.*
60+
61+
# Secrets
62+
.env
63+
.env.*
64+
*.pem
65+
*.key
66+
secrets/
67+
68+
# Test/Coverage
69+
/coverage/
70+
htmlcov/
3571

3672
# Logs
3773
*.log
38-
logs/
74+
/logs/
3975

40-
# Temporary files
76+
# Temp
77+
/tmp/
4178
*.tmp
42-
*.temp
43-
.cache/
79+
*.bak
4480

45-
# Coverage reports
46-
tarpaulin-report.html
47-
coverage/
81+
# Local deployment runtime data
82+
deploy/wharf-local/
83+
84+
# AI/Sync artifacts
85+
ai-cli-crash-capture/
86+
.directory
87+
sync_report*.txt
4888
target/
4989
node_modules/
5090
_build/
5191
deps/
5292
.elixir_ls/
93+
.cache/
5394
build/
5495
dist/

‎.gitlab-ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: MIT
1+
# SPDX-License-Identifier: PMPL-1.0-or-later
22
# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
33
#
44
# GitLab CI/CD Configuration for Project Wharf

‎.nojekyll‎

Whitespace-only changes.

‎CHANGELOG.adoc‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
// SPDX-License-Identifier: PMPL-1.0-or-later
2+
= Changelog
3+
4+
All notable changes to Project Wharf will be documented in this file.
5+
6+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
7+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
8+
9+
== [Unreleased]
10+
11+
=== Added
12+
- Initial project structure
13+
- Rust workspace with wharf-core, wharf-cli, and yacht-agent crates
14+
- DNS zone templates (simple, shared, standard, maximalist)
15+
- Nickel configuration schemas for security policies
16+
- Database policy engine with AST-based SQL filtering (sqlparser 0.39)
17+
- CMS adapters for WordPress, Drupal, Joomla, Moodle
18+
- Shell scripts for zone rendering, auditing, and deployment
19+
- Comprehensive Justfile with 50+ recipes
20+
- RSR (Rhodium Standard Repository) compliance documentation
21+
22+
=== Local Deployment Proof (2026-02-14)
23+
- *Local compose stack*: `deploy/compose.yaml` with 3-service podman compose (MariaDB, yacht-agent proxy, OpenLiteSpeed+WordPress). Full end-to-end proof.
24+
- *Containerfile bug fixes*: `Containerfile.agent` fixed Wolfi package names (musl→glibc), main `Containerfile` fixed yacht-agent runtime stage (static→wolfi-base to avoid glibc segfault)
25+
- *WordPress adapter fix*: `wharf-adapter.php` now fetches both `/stats` and `/status` endpoints, mapping nested JSON to flat format the widget expects
26+
- *OLS container*: `deploy/Containerfile.ols-local` wrapping litespeedtech/openlitespeed:1.8.5-lsphp83 with WordPress-required PHP extensions
27+
- *Automated setup*: `deploy/local-test.sh` downloads WordPress, fetches real salt keys, generates wp-config.php with `DB_HOST=agent:3306`, copies adapter plugin, builds and starts stack
28+
- *SQL injection verification*: `deploy/verify-sqli.sh` proves 6/6 attacks blocked (SELECT passes, INSERT wp_users/DROP/ALTER/TRUNCATE/UNION all blocked), with live agent stats
29+
30+
=== V1.0 Shipping Preparation (2026-02-14)
31+
- *Signature scheme feature flag*: Ed448 now opt-in via `SignatureScheme::Hybrid`; default is `MlDsa87Only` (FIPS 204 peer-reviewed). Configurable via `--signature-scheme` CLI arg and TOML config.
32+
- *SQL injection smoke tests*: 19 integration tests proving AST-based proxy blocks real WordPress attack patterns (user creation, options manipulation, content defacement, DDL, stacked injection)
33+
- *Deployment package*: `deploy/setup.sh` first-run script + `deploy/DEPLOY.adoc` step-by-step guide with podman/selur-compose orchestration
34+
- *Hack-me challenge*: `docs/HACK-ME-CHALLENGE.adoc` with rules of engagement, attack surface table, and technical details for security researchers
35+
- *WordPress adapter plugin*: `adapters/wordpress-wharf/` — GPL-2.0-or-later PHP plugin providing dashboard widget (query stats, firewall mode, signature scheme) and admin bar indicator
36+
- *systemd unit*: `infra/systemd/yacht-agent.service` with DynamicUser, ProtectSystem=strict, MemoryDenyWriteExecute, and CAP_BPF
37+
- *Tooling enrollment*: Bot directives for gitbot-fleet (8 bots), panic-attacker security scan workflow, AI manifest updated
38+
- *K9 contractiles*: Nickel configuration templates (Kennel/Yard/Hunt levels) for deployment automation
39+
40+
=== Production Hardening (2026-02-14)
41+
- *Persistent hybrid keypairs*: Wharf CLI (`~/.wharf/keys/wharf.key`) and Yacht Agent (`/etc/wharf/keys/yacht.key`) now persist Ed448 + ML-DSA-87 keypairs across restarts with proper file permissions (0600 private, 0644 public)
42+
- *Keypair serialization*: Custom binary format with `WHRF` magic, versioning, and optional password encryption via HKDF-SHAKE512 + XChaCha20-Poly1305
43+
- *eBPF XDP firewall*: Full kernel-level packet filtering with XDP programs and userspace loader (`crates/wharf-ebpf/`)
44+
- *Certificate management*: Complete Nebula certificate lifecycle — CA creation, cert signing, IP allocation, and revocation (`nebula.rs`)
45+
- *Prometheus metrics*: Real-time counters for queries (allowed/blocked/audited), mooring sessions, integrity checks, and moored status at `GET /metrics`
46+
- *Statistics endpoint*: `GET /stats` now returns actual counters instead of placeholder zeros
47+
- *File integrity verification*: Yacht Agent mooring verify phase now checks BLAKE3 manifests against on-disk files when `site_root` is configured
48+
- *HTTP client resilience*: Mooring client configured with 30s timeout, 10s connect timeout, and connection pooling (2 idle per host)
49+
- *Configuration*: Added `key_store_dir` (CLI + agent) and `site_root` (agent) config options
50+
51+
=== Security
52+
- Implemented AST-based SQL query analysis (not regex)
53+
- Added HTTP header airlock configuration
54+
- Defined filesystem immutability policies
55+
- Configured Nebula mesh network policies
56+
- Added FIDO2/WebAuthn authentication framework
57+
58+
=== Known Issues
59+
- `ed448-goldilocks` v0.14.0-pre.10 is unaudited — needs third-party audit before production deployment
60+
61+
== [0.1.0] - 2025-11-26
62+
63+
=== Added
64+
- Initial release of Project Wharf
65+
- Core architecture: Wharf (offline controller) + Yacht (runtime enforcer)
66+
- Database "Virtual Sharding" concept
67+
- Zero Trust networking via Nebula
68+
- Support for WordPress, Drupal, Joomla, Moodle
69+
70+
=== Documentation
71+
- README.adoc with full architecture overview
72+
- SECURITY.md with vulnerability reporting process
73+
- CONTRIBUTING.adoc with TPCF contribution framework
74+
- GOVERNANCE.adoc with decision-making process
75+
76+
---
77+
78+
== Version History Summary
79+
80+
| Version | Date | Highlights |
81+
|---------|------|------------|
82+
| Unreleased | 2026-02-14 | Local E2E deployment proof, Containerfile fixes, WordPress adapter stats fix, compose stack, SQLi verification |
83+
| 0.1.0 | 2025-11-26 | Initial release |
84+
85+
== Upgrade Guide
86+
87+
=== Upgrading to 0.1.0
88+
89+
This is the initial release. No upgrade path required.
90+
91+
== Deprecation Notices
92+
93+
*None at this time.*
94+
95+
== Security Advisories
96+
97+
*None at this time.*
98+
99+
---
100+
101+
[Unreleased]: https://gitlab.com/hyperpolymath/wharf/-/compare/v0.1.0...HEAD
102+
[0.1.0]: https://gitlab.com/hyperpolymath/wharf/-/releases/v0.1.0

0 commit comments

Comments
 (0)