Rename Kubernetes manifest to wardnet.yaml after external-secret hardening lands

[seonghobae]

Buyer/operator problem

Wardnet's protected tree still publishes the hardened Kubernetes source asset under the legacy repository filename until the bounded path-migration candidate reaches protected main. The product/deployment rename must not weaken the already-protected external administrator-Secret boundary or silently rename live Kubernetes resource identities.

Protected/default truth is main@5829a0f08d78de464dd24393ce5d0f25fba9d126 through #159. PR #137 remains protected source truth for the administrator credential boundary: the distributable manifest does not ship an administrator Secret or placeholder credential and instead consumes an externally provisioned Secret through a non-optional secretKeyRef.

Current owning candidate — 2026-09-05

PR #144, fix(deploy): rename hardened Kubernetes manifest to wardnet.yaml, is the bounded path-only owner at exact 04692b24c179d1c067113f83c52a4ad1b4af7c5a. The branch was non-force integrated with current protected main; fresh compare recorded behind_by=0 while preserving #159's workflow/AGENTS ownership. Its effective protected-main-relative delta is the repository path migration plus operator/buyer/documentation regressions, not a live-resource rename.

The branch keeps:

• repository source path deploy/kubernetes/wardnet.yaml;
• existing live namespace/resource/PVC/image/probe/port/security-context identities unchanged;
• externally provisioned administrator Secret coordinates and non-optional reference unchanged;
• repository-wide stale operational-path rejection with bounded migration-history/negative-test exceptions;
• deployment-manifest security regression on the new path;
• a bounded docs landing/link contract for the actual published source path.

A prior review false positive that rejected migration-history/negative-fixture references was repaired without weakening operational stale-path detection. A later Clippy-only iterator-closure repair also preserved the path invariant.

Stack / single-writer order

Broader product rename PR #114 overlaps the same Kubernetes source path plus many unrelated runtime/product identities. #144 is the narrower foundation and must reach protected truth first (or be fully superseded by a verified successor carrying every unique path/test/docs delta). #114 then non-force adopts protected #144 rather than competing on the same path.

Current exact-head gate

Exact 04692b24... has newly materialized but non-passing runs recorded on the owning PR:

• Security Scan 33908029943 — queued;
• CodeQL PR 33908029896 — queued;
• SAST Semgrep 33908029998 — queued;
• CI 33908029976 — queued;
• Fuzz 33908029968 — queued.

All predecessor workflow/review conclusions are historical after the ancestry movement. Queue/runner acquisition remains a .github#712 control-plane concern; solo-maintainer live-policy repair remains .github#772 / owner-plane successor #1644. Neither is bypass authority.

Completion gate

Close only after unchanged #144 or a verified successor carrying every unique path/documentation/test delta reaches protected main, the resulting protected path and external-Secret security contract are revalidated, and all then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance gates are terminal-valid. No self/model approval, routine administrator bypass, force push, gate weakening, no-op redispatch, or predecessor-evidence reuse.

[seonghobae]

@devin Implement this now from exact protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 as one bounded Wardnet PR. PR #137 is now protected-main truth, so the prerequisite external-secret hardening has landed.

Use TDD and preserve the manifest contents/security contract byte-for-byte apart from the filesystem path. RED first: add/adjust the repository contract so the candidate requires deploy/kubernetes/wardnet.yaml, rejects the old deploy/kubernetes/waf-ids-ai-soc.yaml path/reference, and still rejects any shipped Secret/placeholder/optional admin secret. GREEN: rename the file only, update every source/docs/test/buyer-evidence/deployment reference, and keep Kubernetes resource names/namespace/image/PVC/env/API identifiers unchanged. Current protected-main references include at least tests/deployment_manifest.rs, crates/waf-ids-core/src/lib.rs, AGENTS.md, CLAUDE.md, README.md, docs/deployment/production.md, docs/commercial/buyer-due-diligence.md, and docs/doctoring/kubernetes-admin-secret-boundary.md; search again before finishing so the old filename has zero repository references.

Update CHANGELOG with the path-only migration/rollback contract. Run formatting, the deployment-manifest tests, full locked workspace tests and strict Clippy locally if available; do not weaken any gate. Open the PR against live main, report the exact head, and leave hosted queued evidence non-passing if the organization runner-acquisition incident persists. Do not rename in-cluster resources in this slice.

[seonghobae]

Fresh exact-state override — 2026-09-03: active implementation PR #144 is now b07e4d21057df4dd4e706b584e5fad00338f20b6 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; GitHub reports it Ready and mechanically mergeable. All currently returned inline review threads are resolved. Exact-head CI 33710607739, Security Scan 33710607747, Scorecard PR 33710607759, Fuzz 33710607794, SAST Semgrep 33710607782, and OSV-Scanner PR 33710608165 remain queued; CodeQL PR 33710608788 terminated startup_failure with no usable GREEN evidence. Therefore predecessor runs do not transfer and #144 is not merge-ready yet. Keep the path-only migration intact and let the central .github#712 / required-workflow owner lanes repair execution; no leaf churn, routine bypass, or gate weakening.