docs: update STATE.scm, README for Lago Grey integration

Updated project state tracking and documentation to reflect completed
Lago Grey image designer integration:

SCM Updates:
- STATE.scm: Completion 25% → 35%, added m2.5 milestone for Lago Grey
- Added lago-grey-integration component (60% complete)
- Updated frontend-ui completion (30% → 45%)
- Updated working-features with LagoGrey components
- Updated critical-next-actions with import/export priorities
- Synced to .machines_readable/6scm/STATE.scm for AI agents

Documentation Updates:
- README.adoc: Added "Lago Grey Designer" as Page 4
- Updated "Three Visual Views" → "Four Visual Views"
- Added Phase 2 progress indicators (30% → 45%)
- Detailed Lago Grey features (ice formations, sizing, crypto)

Next Steps:
- Wire View.res and CiscoView.res to App.res
- Implement critical import/export functionality
- Build pipeline integration with podman

Related work:
- LagoGreyImageDesigner.res already committed (e51d101)
- Oblibeny wiki integration docs created

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.machines_readable/6scm/STATE.scm

@@ -1,64 +1,218 @@
-;; SPDX-License-Identifier: AGPL-3.0-or-later
-;; STATE.scm - Project state tracking for rsr-template-repo
-;; Media-Type: application/vnd.state+scm
+;; SPDX-License-Identifier: PMPL-1.0-or-later
+;; STATE.scm - Current project state
 
-(define-state rsr-template-repo
-  (metadata
-    (version "0.1.0")
-    (schema-version "1.0.0")
-    (created "2026-01-30")
-    (updated "2026-01-30")
-    (project "rsr-template-repo")
-    (repo "hyperpolymath/rsr-template-repo"))
+(define state
+  '((metadata
+     (version "0.1.0")
+     (schema-version "1.0")
+     (created "2026-02-05")
+     (updated "2026-02-05")
+     (project "stapeln")
+     (repo "hyperpolymath/stapeln"))
 
-  (project-context
-    (name "rsr-template-repo")
-    (tagline "Hyperpolymath ecosystem project")
-    (tech-stack ()))
+    (project-context
+     (name "stapeln")
+     (tagline "Visual drag-and-drop container stack designer for verified containers")
+     (tech-stack
+      ((frontend . "ReScript-TEA + cadre-tea-router + Deno")
+       (backend . "Elixir (Phoenix) + Ephapax + AffineScript")
+       (validation . "Idris2 proofs for stack correctness")
+       (codegen . "Rust for compose.toml generation")
+       (runtime-support . "Podman + Docker + nerdctl"))))
 
-  (current-position
-    (phase "initialization")
-    (overall-completion 5)
-    (components ())
-    (working-features ()))
+    (current-position
+     (phase "Phase 2: Frontend Implementation In Progress")
+     (overall-completion 35)
+     (components
+      ((frontend-ui . 45)         ; Model, View, Update, CiscoView, Settings, LagoGreyImageDesigner complete
+       (lago-grey-integration . 60) ; Visual designer integrated, import/export pending
+       (drag-drop-canvas . 20)     ; Architecture defined, not implemented
+       (component-library . 15)    ; Types defined in Model.res
+       (backend-api . 10)          ; GraphQL schema designed
+       (stack-validator . 0)       ; Pending miniKanren implementation
+       (security-analysis . 40)    ; Full spec + OWASP rules defined
+       (firewall-config . 30)      ; Full spec + ephemeral pinholes designed
+       (database-integration . 35) ; VeriSimDB + A2ML + K9 specs complete
+       (codegen-engine . 0)
+       (runtime-adapters . 0)
+       (documentation . 95)))      ; Comprehensive docs + roadmap created
+     (working-features
+      ("Repository initialized from rsr-template-repo"
+       "STATE.scm, ECOSYSTEM.scm, META.scm created"
+       "Full ReScript-TEA architecture (Model, Msg, Update, View)"
+       "Four-page UI design (Paragon, Cisco, Lago Grey, Settings)"
+       "LagoGreyImageDesigner integrated as Page 4"
+       "Interactive ice formation designer (Floes, Icebergs, Glaciers)"
+       "Real-time size calculation and competitive comparison"
+       "Dark theme UI with Lago Grey branding"
+       "LagoGrey component type added to Model.res"
+       "WCAG 2.3 AAA accessibility implementation"
+       "GraphQL schema with a11y metadata"
+       "Database integration spec (VeriSimDB, A2ML, K9-SVC)"
+       "Security stack audit (47% compliance, identified gaps)"
+       "Firewall config with OWASP ModSecurity + ephemeral pinholes"
+       "miniKanren security reasoning engine design"
+       "Game-like UI mockups for attack surface analyzer"
+       "UX Manifesto and Container-Hater Test documents"
+       "Deno-only setup (no npm/node) via SETUP.md"
+       "Comprehensive ROADMAP.md for v1.0 path")))
 
-  (route-to-mvp
-    (milestones
-      ((name "Initial Setup")
-       (status "in-progress")
-       (completion 50)
-       (items
-         ("Initialize repository structure" . done)
-         ("Add standard workflows" . done)
-         ("Define project scope" . todo)
-         ("Set up development environment" . todo)))))
+    (route-to-mvp
+     (milestones
+      ((m1 "Design & Specifications"
+           ((status . "complete")
+            (completion . 100)
+            (items
+             ("✅ ReScript-TEA architecture (Model, Msg, Update, View)"
+              "✅ Three-page UI design (Paragon, Cisco, Settings)"
+              "✅ WCAG 2.3 AAA accessibility specs"
+              "✅ GraphQL schema with a11y metadata"
+              "✅ Deno-only setup documentation"
+              "✅ Database integration spec (VeriSimDB, A2ML, K9)"
+              "✅ Security reasoning engine design (miniKanren)"
+              "✅ Firewall config with ephemeral pinholes"
+              "✅ UX Manifesto and Container-Hater Test"
+              "✅ Game-like UI mockups"))))
+       (m2 "Frontend Implementation"
+           ((status . "in-progress")
+            (completion . 45)
+            (items
+             ("✅ Model.res - Type definitions and state"
+              "✅ Msg.res - Message types for TEA"
+              "✅ Update.res - State transition logic"
+              "✅ View.res - Paragon-style vertical stack view"
+              "✅ CiscoView.res - Network topology view"
+              "✅ Settings.res - Preferences and defaults"
+              "✅ LagoGreyImageDesigner.res - Base image designer component"
+              "✅ LagoGreyImageDesigner.css - Dark theme styling"
+              "✅ App.res - Four-page navigation with LagoGrey integration"
+              "⚠️ Wire View.res and CiscoView.res to App.res (pending)"
+              "⚠️ Fix componentTypeToString for LagoGrey (pending)"
+              "⚠️ Router.res - cadre-tea-router integration (pending)"
+              "⚠️ PortConfigPanel.res - Port configuration UI (pending)"
+              "⚠️ SecurityInspector.res - Attack surface display (pending)"
+              "⚠️ GapAnalysis.res - Sidebar warnings panel (pending)"
+              "⚠️ SimulationMode.res - Packet animation (pending)"
+              "⚠️ Auth.res - User authentication flow (pending)"))))
+       (m2.5 "Lago Grey Integration"
+           ((status . "in-progress")
+            (completion . 60)
+            (items
+             ("✅ LagoGreyImageDesigner component created (921 lines)"
+              "✅ Interactive ice formation catalog (Floes, Icebergs, Glaciers)"
+              "✅ Component selection with real-time size tracking"
+              "✅ Base image selector (Distroless, Alpine, Scratch)"
+              "✅ Visual layer stacking on canvas"
+              "✅ Competitive comparison (vs Alpine, target 17.5MB)"
+              "✅ Security status indicators (PQ crypto, classical crypto)"
+              "✅ Dark theme with Lago Grey branding"
+              "✅ LagoGrey componentType added to Model.res"
+              "✅ ECOSYSTEM.scm integration documented"
+              "⚠️ Import/export for designs (critical, pending)"
+              "⚠️ Image export (.tar.gz with manifest, pending)"
+              "⚠️ Build pipeline (podman build integration, pending)"
+              "⚠️ Triple crypto signing (Dilithium5 + Ed448 + SPHINCS+, pending)"
+              "⚠️ Dockerfile generation from selections (pending)"))))
+       (m3 "Security Reasoning Engine"
+           ((status . "not-started")
+            (completion . 0)
+            (items
+             ("miniKanren + Guile Scheme setup"
+              "Core security relations (componento, exposed-porto, etc.)"
+              "Security rules (SSH exposure, root user, unencrypted traffic)"
+              "CVE feed sync script"
+              "OWASP Top 10 rule generator"
+              "CIS Benchmark rules"
+              "Elixir backend integration (S-expression parser)"
+              "Provenance chain generation"))))
+       (m4 "Backend API (Elixir + Phoenix)"
+           ((status . "not-started")
+            (completion . 0)
+            (items
+             ("Phoenix server with GraphQL (Absinthe)"
+              "EphemeralPinhole GenServer for firewall pinholes"
+              "SecurityReasoner module (miniKanren interface)"
+              "VeriSimDB integration"
+              "A2ML parser for attested documentation"
+              "K9-SVC validator for component configs"
+              "PAM authentication for user-only access"
+              "Audit log to VeriSimDB temporal modality"
+              "WebSocket for real-time updates"))))
+       (m5 "Firewall & Security"
+           ((status . "not-started")
+            (completion . 0)
+            (items
+             ("ModSecurity + OWASP CRS in Svalinn gateway"
+              "firewalld default-deny rules"
+              "Ephemeral pinhole implementation"
+              "Port conflict detection"
+              "Component security scanning (Grype CVE scanner)"
+              "Attack surface analyzer"
+              "Gap analysis engine"))))
+       (m6 "Code Generation & Deployment"
+           ((status . "not-started")
+            (completion . 0)
+            (items
+             ("compose.toml generator (Rust)"
+              "docker-compose.yml generator"
+              "podman-compose.yml generator"
+              "Validation against verified-container-spec"
+              "Podman API client"
+              "Docker API client"
+              "Live deployment testing"
+              "Simulation mode (pre-deployment dry-run)"
+              "Rollback support")))))))
 
-  (blockers-and-issues
-    (critical ())
-    (high ())
-    (medium ())
-    (low ()))
+    (blockers-and-issues
+     (critical
+      ("None currently - design phase complete"))
+     (high
+      ("cadre-tea-router availability (check JSR/npm or vendor)"
+       "Guile Scheme + miniKanren installation/setup"
+       "Elixir backend needs PAM library for system user auth"
+       "VeriSimDB federated mode configuration"))
+     (medium
+      ("SVG vs Canvas rendering decision for Cisco view"
+       "Component connection routing algorithm (orthogonal recommended)"
+       "WebGL for large stacks (100+ containers) - future optimization"
+       "Simulation mode packet animation performance"))
+     (low
+      ("Dark mode theme refinement"
+       "Keyboard shortcuts for power users"
+       "Braille display testing (WCAG AAA requirement)")))
 
-  (critical-next-actions
-    (immediate
-      "Define project scope and objectives"
-      "Update README.adoc with project description")
-    (this-week
-      "Set up development environment"
-      "Create initial architecture design")
-    (this-month
-      "Implement core functionality"
-      "Add comprehensive tests"))
-
-  (session-history ()))
-
-;; Helper functions
-(define (get-completion-percentage state)
-  (current-position 'overall-completion state))
-
-(define (get-blockers state severity)
-  (blockers-and-issues severity state))
-
-(define (get-milestone state name)
-  (find (lambda (m) (equal? (car m) name))
-        (route-to-mvp 'milestones state)))
+    (critical-next-actions
+     (immediate
+      ("Fix App.res to wire up View.res and CiscoView.res (Phase 1)"
+       "Add LagoGrey case to componentTypeToString function"
+       "Test navigation between all four pages"
+       "Implement design import/export (JSON schema, critical)"
+       "Implement Lago Grey image export (.tar.gz with manifest)"
+       "Build pipeline: Dockerfile generation from selections"
+       "Integrate podman build with progress UI"))
+     (this-week
+      ("Complete import/export functionality (Phase 2, critical)"
+       "Implement triple crypto signing (Dilithium5 + Ed448 + SPHINCS+)"
+       "Create LagoGreyExport.res and LagoGreyImport.res modules"
+       "Build accountability trace generation (.zpkg)"
+       "Update SCM files (.machines_readable/6scm/)"
+       "Update README.adoc with Lago Grey integration"
+       "Test image build → export → import round-trip"))
+     (this-month
+      ("Implement PortConfigPanel.res with ephemeral toggle"
+       "Add SecurityInspector.res component"
+       "Build real-time security scoring display"
+       "Create miniKanren proof-of-concept with 5 basic security rules"
+       "Implement simulation mode (packet animation)"
+       "Set up Phoenix backend with GraphQL"
+       "User testing with container-hater (cyberwar officer!)"))
+     (before-release
+      ("Complete security reasoning engine (miniKanren)"
+       "Implement ModSecurity + OWASP CRS in Svalinn"
+       "Post-quantum crypto upgrades (full Dilithium5, Kyber-1024)"
+       "HTTP/3 + QUIC migration"
+       "Comprehensive security audit"
+       "Performance optimization (handle 100+ container stacks)"
+       "WCAG 2.3 AAA compliance verification"
+       "Documentation for end users"
+       "Deployment guide")))))

ECOSYSTEM.scm

@@ -19,6 +19,9 @@
   ((name . "cerro-torre")
    (relationship . "sibling-standard")
    (description . "stapeln includes Cerro Torre as a draggable component for .ctp bundle creation"))
+  ((name . "lago-grey")
+   (relationship . "sibling-standard")
+   (description . "stapeln includes Lago Grey as base image designer - Alpine/Chainguard alternative for minimal, secure base images"))
   ((name . "svalinn")
    (relationship . "sibling-standard")
    (description . "stapeln models Svalinn as an edge gateway component in the stack"))
@@ -31,6 +34,15 @@
   ((name . "verified-container-spec")
    (relationship . "protocol-specification")
    (description . "stapeln validates generated stacks against verified-container-spec schemas"))
+  ((name . "verisimdb")
+   (relationship . "sibling-standard")
+   (description . "stapeln uses VeriSimDB for stack metadata storage (6 modalities: graph, vector, tensor, semantic, document, temporal)"))
+  ((name . "a2ml")
+   (relationship . "sibling-standard")
+   (description . "stapeln uses A2ML for attested component documentation with progressive strictness"))
+  ((name . "k9-svc")
+   (relationship . "sibling-standard")
+   (description . "stapeln uses K9-SVC for self-validating component configurations"))
   ((name . "rescript-tea")
    (relationship . "inspiration")
    (description . "TEA architecture for predictable UI state management"))
@@ -42,22 +54,46 @@
    (description . "Backend uses Ephapax linear types for stack validation"))
   ((name . "affinescript")
    (relationship . "potential-consumer")
-   (description . "Backend uses AffineScript for resource constraints")))
+   (description . "Backend uses AffineScript for resource constraints"))
+  ((name . "minikanren")
+   (relationship . "external-dependency")
+   (description . "stapeln uses miniKanren for deterministic security rule reasoning and attack surface analysis"))
+  ((name . "owasp-modsecurity")
+   (relationship . "external-integration")
+   (description . "stapeln integrates OWASP ModSecurity Core Rule Set for firewall protection"))
+  ((name . "rekor")
+   (relationship . "external-integration")
+   (description . "stapeln verifies container signatures via Rekor transparency log")))
 
  (provides
   (capability "visual-stack-design")
   (capability "drag-and-drop-ui")
   (capability "compose-file-generation")
   (capability "formal-stack-validation")
-  (interface "web-ui-http-api"))
+  (capability "attack-surface-analysis")
+  (capability "security-gap-detection")
+  (capability "ephemeral-firewall-pinholes")
+  (capability "real-time-security-scoring")
+  (capability "simulation-mode")
+  (capability "wcag-2.3-aaa-accessibility")
+  (interface "web-ui-http-api")
+  (interface "graphql-api"))
 
  (consumes
   (dependency "rescript-tea")
   (dependency "cadre-tea-router")
   (dependency "deno-runtime")
   (dependency "phoenix-framework")
   (dependency "ephapax-linear")
-  (dependency "idris2-proofs"))
+  (dependency "idris2-proofs")
+  (dependency "verisimdb")
+  (dependency "a2ml")
+  (dependency "k9-svc")
+  (dependency "minikanren")
+  (dependency "guile-scheme")
+  (dependency "owasp-modsecurity-crs")
+  (dependency "firewalld")
+  (dependency "pam-authentication"))
 
  (integration-points
   ((component . "selur-compose")
@@ -66,6 +102,30 @@
   ((component . "cerro-torre")
    (method . "ct-cli-integration")
    (description . "stapeln can invoke ct commands for bundle creation"))
+  ((component . "lago-grey")
+   (method . "base-image-designer")
+   (description . "stapeln integrates lago-grey for designing minimal, secure base images (Alpine/Chainguard alternative)"))
+  ((component . "verisimdb")
+   (method . "graphql-api")
+   (description . "stapeln stores stack metadata in VeriSimDB using 6 modalities"))
+  ((component . "a2ml")
+   (method . "parser-integration")
+   (description . "stapeln renders A2ML attested documentation for components"))
+  ((component . "k9-svc")
+   (method . "validator-integration")
+   (description . "stapeln validates component configs using K9-SVC Nickel contracts"))
+  ((component . "minikanren")
+   (method . "scheme-ipc")
+   (description . "stapeln queries miniKanren for security rule violations"))
+  ((component . "modsecurity")
+   (method . "svalinn-integration")
+   (description . "stapeln configures OWASP ModSecurity CRS rules in Svalinn gateway"))
+  ((component . "firewalld")
+   (method . "cli-integration")
+   (description . "stapeln manages firewall rules and ephemeral pinholes"))
+  ((component . "rekor")
+   (method . "api-client")
+   (description . "stapeln verifies container signatures via Rekor transparency log"))
   ((component . "podman")
    (method . "api-client")
    (description . "stapeln can deploy directly to Podman via HTTP API"))
@@ -77,7 +137,7 @@
    (description . "stapeln can deploy via nerdctl CLI")))
 
  (what-this-is
-  "A visual drag-and-drop web application for designing container stacks using the verified-container-spec ecosystem. Users drag components (Cerro Torre, Svalinn, selur, Vörðr, Podman/Docker/nerdctl) onto a canvas, connect them, configure them, and stapeln generates compose.toml files for deployment. The backend uses Elixir/Phoenix for API, Ephapax for linear type validation, AffineScript for resource constraints, Idris2 for formal proofs, and Rust for code generation. The frontend is pure ReScript-TEA running on Deno. Named 'stapeln' (Icelandic for 'stack' with designer suffix) to match the Nordic naming theme.")
+  "A visual drag-and-drop web application for designing container stacks with built-in attack surface analysis and security reasoning. Users experience a game-like interface (think spaceship customizer) where they drag components onto a canvas, see real-time security scoring, get automatic vulnerability detection, and receive actionable fix suggestions. Features three views: Paragon (vertical stack), Cisco (network topology), and Settings. Includes miniKanren-based security reasoning engine that queries OWASP/CVE rules for deterministic vulnerability detection. Implements WCAG 2.3 AAA accessibility (full ARIA, Braille, semantic XML). Uses VeriSimDB for multi-modal storage, A2ML for attested documentation, K9-SVC for self-validating configs. Backend is Elixir/Phoenix with GraphQL API, ephemeral firewall pinholes, and OWASP ModSecurity integration. Frontend is pure ReScript-TEA on Deno. Named 'stapeln' (Swedish for 'the stack') matching Nordic naming theme. Designed to convert container-haters: 'If you have to read the manual, we failed.'")
 
  (what-this-is-not
-  "Not a container runtime (use Podman/Docker/nerdctl). Not a CLI tool (use selur-compose for CLI). Not a replacement for compose files (generates them). Not a general-purpose diagram tool (specific to verified containers). Not a monitoring dashboard (focused on design/configuration). Not a CI/CD system (generates configs for deployment)."))
+  "Not a container runtime (use Podman/Docker/nerdctl). Not a CLI tool (use selur-compose for CLI). Not a replacement for compose files (generates them). Not a general-purpose diagram tool (specific to verified containers). Not a monitoring dashboard (focused on design/configuration). Not a CI/CD system (generates configs for deployment). Not using an SLM for security (uses deterministic miniKanren instead). Not a penetration testing tool (does static analysis only). Not a vulnerability scanner replacement (integrates Grype for CVEs)."))