Add Sinople full integration: real vulnerability found

Fifth integration report - Sinople complete integration SUCCESS:

CRITICAL FINDING: addslashes() was used for Turtle escaping
- addslashes() is SQL escaping, NOT Turtle escaping
- Real RDF injection vulnerability existed
- Fixed with TurtleEscaper::literal() and TurtleEscaper::iri()

Security fixes applied:
- CRITICAL: Turtle escaping (2 issues)
- HIGH: URL validation, Micropub sanitization
- MEDIUM: Security headers (CSP, HSTS), rate limiting
- LOW: strict_types on all files

New upstream issues identified:
- php-aegis: WordPress validators, TurtleEscaper lang tags, Headers WP integration
- sanctify-php: Hook detection, Turtle context, REST API patterns

This proves: When focused on unique value (Turtle escaping),
php-aegis finds and fixes REAL vulnerabilities WordPress cannot address.

Author: claude

docs/IMPLEMENTATION-TRACKER.md

@@ -27,6 +27,7 @@
 | wp-sinople-theme | ⚠️ With difficulty | ⚠️ Limited | Needed Haskell setup |
 | Zotpress | ❌ **NO** | ❌ None | GHC not available |
 | sinople-theme | ✅ **CI Integration** | ✅ **Turtle!** | Success with unique value focus |
+| Sinople (full) | ✅ **Real vuln found** | ✅ **Critical fix** | TurtleEscaper fixed RDF injection |
 
 > **Zotpress integration failed completely** — sanctify-php could not be executed.
 > Manual analysis was performed instead using documented patterns.

docs/INTEGRATION-SUMMARY.md

@@ -12,6 +12,7 @@ Consolidated findings from four real-world integration attempts.
 | 2 | Zotpress | Mature WP plugin | ❌ **Could not run** | ❌ No value added |
 | 3 | (Metrics capture) | - | Improvements measured | Issues documented |
 | 4 | sinople-theme | Semantic WP theme | ✅ **CI integration** | ✅ **Unique value (Turtle!)** |
+| 5 | Sinople (full) | Semantic WP theme | ✅ **Real vuln found** | ✅ **TurtleEscaper fix** |
 
 ### Success Story: sinople-theme
 
@@ -35,6 +36,37 @@ The sinople-theme integration demonstrates the **correct approach**:
 
 **Key success factor**: Focus on **unique value** (Turtle escaping) not WordPress duplicates.
 
+### Major Win: Sinople Full Integration (Real Vulnerability Found)
+
+The complete Sinople integration found a **real security vulnerability**:
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  CRITICAL: addslashes() used for Turtle escaping            │
+│                                                             │
+│  Original code: addslashes($value) for RDF Turtle output    │
+│  Problem: addslashes() is SQL escaping, NOT Turtle escaping │
+│  Risk: RDF injection attacks possible                       │
+│                                                             │
+│  Fix: TurtleEscaper::literal() + TurtleEscaper::iri()       │
+│  Result: W3C-compliant Turtle escaping                      │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Security Fixes Applied**:
+
+| Severity | Issue | Fix |
+|----------|-------|-----|
+| CRITICAL | addslashes() for Turtle | TurtleEscaper::literal() |
+| CRITICAL | IRI without validation | Validator::url() + error handling |
+| HIGH | URL validation via strpos() | parse_url() host comparison |
+| HIGH | Unsanitized Micropub input | sanitize_text_field() + wp_kses_post() |
+| MEDIUM | No security headers | CSP, HSTS, X-Frame-Options |
+| MEDIUM | No rate limiting | 1-min rate limit for Webmentions |
+| LOW | Missing strict_types | Added to all PHP files |
+
+**This proves**: When focused on unique value (Turtle escaping), php-aegis finds and fixes real vulnerabilities that WordPress cannot address.
+
 ---
 
 ## Critical Findings

docs/UPSTREAM-ISSUES.md

@@ -229,6 +229,86 @@ The `sanctify export --guix` command is documented but the output format and usa
 
 ---
 
+## Issues from Sinople Full Integration
+
+### php-aegis Issues (from Sinople)
+
+#### Issue 5: WordPress-Specific Validators Needed
+
+**Severity**: Medium
+**Found in**: Sinople full integration
+
+**Description**:
+WordPress has security patterns (nonces, capabilities) that php-aegis doesn't address.
+
+**Needed validators**:
+```php
+Aegis\WordPress\Nonce::verify($action, $nonce);
+Aegis\WordPress\Capability::check($cap, $user_id);
+```
+
+---
+
+#### Issue 6: TurtleEscaper Language Tag Case Sensitivity
+
+**Severity**: Low
+**Found in**: Sinople full integration
+
+**Description**:
+Language tags in Turtle should be case-insensitive per BCP 47, but TurtleEscaper may not handle this correctly.
+
+---
+
+#### Issue 7: Headers Class WordPress Integration
+
+**Severity**: Low
+**Found in**: Sinople full integration
+
+**Description**:
+`Headers::secure()` doesn't integrate with WordPress's `send_headers` action.
+
+**Recommended**:
+```php
+add_action('send_headers', [Headers::class, 'secure']);
+```
+
+---
+
+### sanctify-php Issues (from Sinople)
+
+#### Issue 5: WordPress Hook Detection
+
+**Severity**: Medium
+**Found in**: Sinople full integration
+
+**Description**:
+sanctify-php should detect WordPress hooks (`add_action`, `add_filter`) and reduce false positives when code is wrapped in hook callbacks.
+
+---
+
+#### Issue 6: RDF Turtle as Distinct Output Context
+
+**Severity**: High
+**Found in**: Sinople full integration
+
+**Description**:
+Turtle output is a distinct context from HTML. sanctify-php should:
+- Detect `Content-Type: text/turtle`
+- Warn when `esc_html()` is used in Turtle context
+- Suggest `TurtleEscaper` instead
+
+---
+
+#### Issue 7: WordPress REST API Pattern Recognition
+
+**Severity**: Medium
+**Found in**: Sinople full integration
+
+**Description**:
+WordPress REST API endpoints have specific sanitization patterns that sanctify-php should recognize.
+
+---
+
 ## Tracking
 
 | Issue | Repository | Reported | Status |
@@ -237,10 +317,16 @@ The `sanctify export --guix` command is documented but the output format and usa
 | Not on Packagist | php-aegis | 🔲 Pending | - |
 | mu-plugin not implemented | php-aegis | 🔲 Pending | - |
 | Missing Permissions-Policy | php-aegis | 🔲 Pending | - |
+| WordPress validators needed | php-aegis | 🔲 Pending | - |
+| TurtleEscaper lang tag case | php-aegis | 🔲 Pending | - |
+| Headers WP integration | php-aegis | 🔲 Pending | - |
 | UnsafeRedirect false positive | sanctify-php | 🔲 Pending | - |
 | MissingTextDomain false positive | sanctify-php | 🔲 Pending | - |
 | PHP 8.1+ syntax verification | sanctify-php | 🔲 Pending | - |
 | Guix export docs incomplete | sanctify-php | 🔲 Pending | - |
+| WordPress hook detection | sanctify-php | 🔲 Pending | - |
+| Turtle as output context | sanctify-php | 🔲 Pending | - |
+| REST API pattern recognition | sanctify-php | 🔲 Pending | - |
 
 ---