fix(deploy): rename hardened Kubernetes manifest to wardnet.yaml

[seonghobae]

Fixes #75 only after this exact bounded slice reaches protected main.

Buyer / operator outcome

This branch is the foundation-first repository-path migration for the hardened Kubernetes asset plus its public/operator documentation landing:

• move the hardened source asset to deploy/kubernetes/wardnet.yaml without renaming live Kubernetes resource identities;
• make README/operator/buyer/security references use the canonical repository path;
• retain a strict stale-path regression with only bounded migration/rollback-history exceptions;
• add a bounded docs/index.md landing and repository-link validation;
• preserve the externally provisioned administrator-Secret boundary and current non-production/release truth.

The latest pre-restack source repair, 8d656d313c18c2b304d3e1a563317a967c23e250, is valid intervening delta rather than a race: it only rewrites one iterator closure in tests/kubernetes_manifest_path.rs to satisfy the Rust 1.98 Clippy contract without changing the asserted path semantics.

Fresh protected-main integration — 2026-09-05 KST

Protected/default main is exact 5829a0f08d78de464dd24393ce5d0f25fba9d126 after #159. The previous candidate was 19 protected commits behind. Fresh compare showed the protected-only delta was the six-file workflow-control foundation from #159; AGENTS.md was the only semantic overlap.

The non-force three-way repair keeps #159's canonical Actions ownership/concurrency/explicit-runner guidance and applies only this lane's Kubernetes source-path substitution inside that file. Protected CI/Fuzz/Scorecard and workflow queue/runner contract files were adopted exactly from protected main. Merge commit 04692b24c179d1c067113f83c52a4ad1b4af7c5a preserves exact 8d656d3... and exact protected main as parents; no force push or destructive rebase was used.

Fresh compare now reports behind_by=0. The protected-main-relative effective delta is 13 paths: AGENTS/CHANGELOG/CLAUDE/README, one core documentation string, the manifest rename, buyer/deployment/doctoring docs, docs/index.md, and three path/deployment/documentation regressions.

Stack / single-writer decision

This narrower path-only migration is the prerequisite for broad rename PR #114. #114 also renames the same Kubernetes asset and many surrounding product/runtime identities, so it must remain Draft and later non-force adopt the protected result of this PR rather than racing two overlapping rename authorities. If this slice is replaced, the successor must prove complete transfer of every unique path/documentation/test delta before #144 can be retired.

Exact-head gate

Exact current head is 04692b24c179d1c067113f83c52a4ad1b4af7c5a. Fresh runs are non-passing/queued: Security Scan 33908029943, CodeQL PR 33908029896, SAST Semgrep 33908029998, CI 33908029976, Fuzz 33908029968. All predecessor workflow conclusions are historical after ancestry movement.

Keep Draft until this unchanged head has terminal repository/security/coverage/package/SBOM/provenance/central-review/thread/governance evidence. No self/model approval, routine administrator bypass, force push, gate weakening, no-op redispatch commit, or predecessor-evidence reuse.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 75030a2e-29f3-4ab3-ba1e-6792591fc4fc

📥 Commits

Reviewing files that changed from the base of the PR and between 9616b94 and b07e4d2.

📒 Files selected for processing (1)

• tests/kubernetes_manifest_path.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Kubernetes 매니페스트를 deploy/kubernetes/wardnet.yaml로 추가하고 저장소의 경로 참조를 갱신했습니다. 기존 Kubernetes 리소스와 외부 관리자 시크릿 참조는 유지합니다. 경로 회귀 검사는 이전 파일과 허용되지 않은 레거시 참조를 차단합니다.

Changes

Kubernetes 매니페스트 경로 마이그레이션

Layer / File(s)	Summary
새 Kubernetes 매니페스트 deploy/kubernetes/wardnet.yaml	네임스페이스, 2Gi PVC, gateway Deployment, 비선택적 ADMIN_TOKEN Secret 참조, 헬스 프로브, 보안 컨텍스트 및 HTTP Service를 정의합니다.
운영 참조 및 문서 갱신 AGENTS.md, CLAUDE.md, README.md, CHANGELOG.md, crates/waf-ids-core/src/lib.rs, docs/commercial/..., docs/deployment/..., docs/doctoring/..., docs/index.md	매니페스트 경로를 deploy/kubernetes/wardnet.yaml로 변경합니다. README와 문서 랜딩 페이지에 Wardnet의 제품 범위, 운영 정보 및 증거 경계를 반영합니다.
경로 회귀 검증 tests/deployment_manifest.rs, tests/kubernetes_manifest_path.rs, tests/documentation_landing.rs	새 매니페스트를 검사 대상으로 등록합니다. 이전 파일의 부재와 문서 링크의 실제 경로를 검증합니다. 명시적 마이그레이션·롤백 문맥만 레거시 경로를 허용합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b07e4

This change completes the Wardnet manifest-path migration while retaining controlled migration and rollback references. No concrete current-head merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	변경 사항은 이슈 [#75]의 주요 요구사항과 일치합니다. 새 경로를 추가하고 기존 Secret 경계, 리소스 식별자, 프로브, 포트 및 보안 컨텍스트를 유지했습니다. 운영 문서, 구매자 검토 문서, 배포 자산 참조, 회귀 테스트 및 경로 검증을 갱신했습니다. 마이그레이션과 롤백 시 파일 경로와 클러스터 리소스 식별자가 다르다는 점도 문서화했습니다.
Out of Scope Changes check	✅ Passed	README 전면 개편, docs/index.md 추가 및 문서 링크 검증은 PR 목표와 이슈 [#75]에 명시된 제품 문서화 및 탐색성 개선 범위에 포함됩니다. 제공된 변경 요약에는 관련 없는 런타임 리소스, API, 패키지 또는 제품 기능 변경이 없습니다.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 강화된 Kubernetes 매니페스트를 wardnet.yaml로 변경하는 PR의 핵심 내용을 정확하고 간결하게 설명합니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kubernetes-manifest-path-20260901

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[cwl-noema-review]

Noema LLM review

The PR correctly renames the hardened Kubernetes manifest from deploy/kubernetes/waf-ids-ai-soc.yaml to deploy/kubernetes/wardnet.yaml and updates all corresponding references in documentation, agent guides, and source code. Crucially, it introduces a structural regression contract in tests/kubernetes_manifest_path.rs to prevent the accidental reintroduction of the legacy path in operational contexts, while allowing it for explicit migration history. It also adds tests/documentation_landing.rs to ensure GitHub Pages links resolve correctly, addressing a previously identified 404 risk.

Reviewed changed lines

• AGENTS.md:20 (RIGHT): Correctly updates the remediation path for k8s/IaC misconfigs to the new filename.
• tests/deployment_manifest.rs:651 (RIGHT): Adds a concrete test to ensure the legacy manifest file is physically absent from the distributable tree.
• tests/kubernetes_manifest_path.rs:78 (RIGHT): Implements a granular allowlist for legacy paths, distinguishing between dangerous operational references (e.g., kubectl apply) and safe historical documentation.
• tests/documentation_landing.rs:63 (RIGHT): Implements a repository-wide link validator for the landing page to prevent broken links to the main branch.

Adversarial validation

• tests/kubernetes_manifest_path.rs:145 (RIGHT) falsified: The stale-reference scanner can be bypassed by placing the legacy path in a non-text file. — The scanner explicitly iterates over TEXT_EXTENSIONS; however, the legacy path is a source-tree reference typically found in docs/scripts, which are covered.
• tests/kubernetes_manifest_path.rs:102 (RIGHT) falsified: The scanner fails if the test file itself contains the legacy path literal as a negative test case. — The test uses runtime fragment concatenation (lines 138-140) to avoid literal matches, ensuring the test file remains subject to the scan without triggering it.
• Residual risk: low

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 9616b94ac1ecf70038071a8c9395348694e6312c
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[devin-ai-integration]

Devin Review found 0 new potential issues.