refactor: migrate Markdown to AsciiDoc

ARCHITECTURE.adoc

@@ -0,0 +1,48 @@
+== Architecture
+
+=== Overview
+
+This repository follows a modular, maintainable architecture designed
+for clarity, scalability, and long-term sustainability.
+
+=== Directory Structure
+
+....
+.
+├── src/           # Source code
+├── tests/        # Test suites
+├── docs/         # Documentation
+├── scripts/      # Utility scripts
+├── config/       # Configuration files
+├── LICENSE       # License file
+├── LICENSES/     # Full license texts
+└── README.adoc   # Project documentation
+....
+
+=== Design Principles
+
+* *Separation of Concerns*: Each module has a single responsibility
+* *Testability*: Code is written to be easily testable
+* *Documentation*: All public APIs are documented
+* *Configuration*: Environment-specific settings are externalized
+
+=== Dependencies
+
+* External dependencies are minimized and clearly declared
+* Version pinning is used for reproducibility
+
+=== Security Considerations
+
+* Sensitive data is never committed to the repository
+* Secrets are managed through environment variables or secure vaults
+* Regular dependency audits are performed
+
+=== Maintainability
+
+* Code follows consistent style guidelines
+* Pull requests require review and CI checks
+* Issues and discussions are tracked transparently
+
+'''''
+
+_Last updated: 2026-07-18_

CHANGELOG.adoc

@@ -1,102 +1,69 @@
-// SPDX-License-Identifier: CC-BY-SA-4.0
-= Changelog
-
-All notable changes to Project Wharf will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-== [Unreleased]
-
-=== Added
-- Initial project structure
-- Rust workspace with wharf-core, wharf-cli, and yacht-agent crates
-- DNS zone templates (simple, shared, standard, maximalist)
-- Nickel configuration schemas for security policies
-- Database policy engine with AST-based SQL filtering (sqlparser 0.39)
-- CMS adapters for WordPress, Drupal, Joomla, Moodle
-- Shell scripts for zone rendering, auditing, and deployment
-- Comprehensive Justfile with 50+ recipes
-- RSR (Rhodium Standard Repository) compliance documentation
-
-=== Local Deployment Proof (2026-02-14)
-- *Local compose stack*: `deploy/compose.yaml` with 3-service podman compose (MariaDB, yacht-agent proxy, OpenLiteSpeed+WordPress). Full end-to-end proof.
-- *Containerfile bug fixes*: `Containerfile.agent` fixed Wolfi package names (musl→glibc), main `Containerfile` fixed yacht-agent runtime stage (static→wolfi-base to avoid glibc segfault)
-- *WordPress adapter fix*: `wharf-adapter.php` now fetches both `/stats` and `/status` endpoints, mapping nested JSON to flat format the widget expects
-- *OLS container*: `deploy/Containerfile.ols-local` wrapping litespeedtech/openlitespeed:1.8.5-lsphp83 with WordPress-required PHP extensions
-- *Automated setup*: `deploy/local-test.sh` downloads WordPress, fetches real salt keys, generates wp-config.php with `DB_HOST=agent:3306`, copies adapter plugin, builds and starts stack
-- *SQL injection verification*: `deploy/verify-sqli.sh` proves 6/6 attacks blocked (SELECT passes, INSERT wp_users/DROP/ALTER/TRUNCATE/UNION all blocked), with live agent stats
-
-=== V1.0 Shipping Preparation (2026-02-14)
-- *Signature scheme feature flag*: Ed448 now opt-in via `SignatureScheme::Hybrid`; default is `MlDsa87Only` (FIPS 204 peer-reviewed). Configurable via `--signature-scheme` CLI arg and TOML config.
-- *SQL injection smoke tests*: 19 integration tests proving AST-based proxy blocks real WordPress attack patterns (user creation, options manipulation, content defacement, DDL, stacked injection)
-- *Deployment package*: `deploy/setup.sh` first-run script + `deploy/DEPLOY.adoc` step-by-step guide with podman/selur-compose orchestration
-- *Hack-me challenge*: `docs/HACK-ME-CHALLENGE.adoc` with rules of engagement, attack surface table, and technical details for security researchers
-- *WordPress adapter plugin*: `adapters/wordpress-wharf/` — GPL-2.0-or-later PHP plugin providing dashboard widget (query stats, firewall mode, signature scheme) and admin bar indicator
-- *systemd unit*: `infra/systemd/yacht-agent.service` with DynamicUser, ProtectSystem=strict, MemoryDenyWriteExecute, and CAP_BPF
-- *Tooling enrollment*: Bot directives for gitbot-fleet (8 bots), panic-attacker security scan workflow, AI manifest updated
-- *K9 contractiles*: Nickel configuration templates (Kennel/Yard/Hunt levels) for deployment automation
-
-=== Production Hardening (2026-02-14)
-- *Persistent hybrid keypairs*: Wharf CLI (`~/.wharf/keys/wharf.key`) and Yacht Agent (`/etc/wharf/keys/yacht.key`) now persist Ed448 + ML-DSA-87 keypairs across restarts with proper file permissions (0600 private, 0644 public)
-- *Keypair serialization*: Custom binary format with `WHRF` magic, versioning, and optional password encryption via HKDF-SHAKE512 + XChaCha20-Poly1305
-- *eBPF XDP firewall*: Full kernel-level packet filtering with XDP programs and userspace loader (`crates/wharf-ebpf/`)
-- *Certificate management*: Complete Nebula certificate lifecycle — CA creation, cert signing, IP allocation, and revocation (`nebula.rs`)
-- *Prometheus metrics*: Real-time counters for queries (allowed/blocked/audited), mooring sessions, integrity checks, and moored status at `GET /metrics`
-- *Statistics endpoint*: `GET /stats` now returns actual counters instead of placeholder zeros
-- *File integrity verification*: Yacht Agent mooring verify phase now checks BLAKE3 manifests against on-disk files when `site_root` is configured
-- *HTTP client resilience*: Mooring client configured with 30s timeout, 10s connect timeout, and connection pooling (2 idle per host)
-- *Configuration*: Added `key_store_dir` (CLI + agent) and `site_root` (agent) config options
-
-=== Security
-- Implemented AST-based SQL query analysis (not regex)
-- Added HTTP header airlock configuration
-- Defined filesystem immutability policies
-- Configured Nebula mesh network policies
-- Added FIDO2/WebAuthn authentication framework
-
-=== Known Issues
-- `ed448-goldilocks` v0.14.0-pre.10 is unaudited — needs third-party audit before production deployment
-
-== [0.1.0] - 2025-11-26
-
-=== Added
-- Initial release of Project Wharf
-- Core architecture: Wharf (offline controller) + Yacht (runtime enforcer)
-- Database "Virtual Sharding" concept
-- Zero Trust networking via Nebula
-- Support for WordPress, Drupal, Joomla, Moodle
-
-=== Documentation
-- README.adoc with full architecture overview
-- SECURITY.md with vulnerability reporting process
-- CONTRIBUTING.adoc with TPCF contribution framework
-- GOVERNANCE.adoc with decision-making process
-
----
-
-== Version History Summary
-
-| Version | Date | Highlights |
-|---------|------|------------|
-| Unreleased | 2026-02-14 | Local E2E deployment proof, Containerfile fixes, WordPress adapter stats fix, compose stack, SQLi verification |
-| 0.1.0 | 2025-11-26 | Initial release |
-
-== Upgrade Guide
-
-=== Upgrading to 0.1.0
-
-This is the initial release. No upgrade path required.
-
-== Deprecation Notices
-
-*None at this time.*
-
-== Security Advisories
-
-*None at this time.*
-
----
-
-[Unreleased]: https://gitlab.com/hyperpolymath/wharf/-/compare/v0.1.0...HEAD
-[0.1.0]: https://gitlab.com/hyperpolymath/wharf/-/releases/v0.1.0
+== Changelog
+
+All notable changes to `+project-wharf+` will be documented in this
+file.
+
+This file is generated from conventional commits by the
+https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`]
+workflow (`+hyperpolymath/standards#206+`). Adopt the workflow in this
+repo’s CI to keep this file in sync automatically — see
+https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`]
+for the canonical config.
+
+The format follows https://keepachangelog.com/en/1.1.0/[Keep a
+Changelog]; this project aims to follow
+https://semver.org/spec/v2.0.0.html[Semantic Versioning].
+
+=== [Unreleased]
+
+==== Added
+
+* feat(snapshot): implement create_snapshot / restore over StateConfig
+contract
+* feat(core+bin): adopt WP-edition source — mooring client, integrity
+updates, config layer
+* feat(deploy): containerization + WP-specific deploy + config examples
+* feat(adapters): add WordPress integration adapter
+* feat(workspace): add xtask + fuzz + ClusterFuzzLite from WP-edition
+fork
+* feat: Add remote integrity verification and eBPF XDP loader
+* feat: Release v1.0.0 - Production-ready Sovereign Web Hypervisor
+* feat: Implement v1.0 core functionality - sync, integrity, and fleet
+management
+* feat: Add Rust eBPF firewall, Wolfi containers, and expanded CLI
+* feat: Add RSR (Rhodium Standard Repository) compliance
+
+==== Fixed
+
+* fix(licence): #3 Tranche 1 — clear scaffold-placeholder leak
+(project-wharf) (#28)
+* fix(ci): sync hypatia-scan.yml to canonical (#26)
+* fix(ci): rsr-antipattern.yml duplicate heredoc (#25)
+* fix: Restore original README content
+* fix: Make containers buildable and add smoke test
+
+==== Documentation
+
+* docs(flake): annotate KEEP+DEP rationale (standards#102) (#30)
+* docs(readme): add SPDX header and/or standard badges
+* docs: Update roadmap for v1.0+ with detailed version plans
+
+==== CI
+
+* ci(antipattern): fix top-level dir + benchmark/lsp filename matching
+(#20)
+* ci(antipattern): TS check reads .claude/CLAUDE.md exemption table
+(#19)
+* ci(antipattern): broaden TS allowlist (cli, mod.ts, lsp-server,
+_vscode_, deno-*) (#18)
+* ci(antipattern): allowlist legit TS bridge/adapter paths (#17)
+
+=== Pre-history
+
+Prior commits to this file’s introduction are recorded in git history
+but not formally classified into Keep-a-Changelog sections. To backfill,
+run `+git cliff -o CHANGELOG.md+` locally using the canonical
+https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+cliff.toml+`]
+— this is one-shot mechanical work.
+
+'''''