fix(deploy): rename hardened Kubernetes manifest to wardnet.yaml

AGENTS.md

@@ -17,7 +17,7 @@ Cross-agent conventions for any agent (Claude, Codex, Cursor, opencode, …) wor
 - A failing **`trivy-fs` is a REAL finding, not a flake.** Read the job log — it prints each finding's rule id / severity / file — or the run's SARIF results, then **remediate**:
   - Rust dependency CVE → bump the crate (`cargo update -p <crate>`, adjust `Cargo.toml`) and commit the updated `Cargo.lock`.
   - Container/OS finding → fix the base image or package in the `Dockerfile`.
-  - k8s/IaC misconfig → fix `deploy/kubernetes/waf-ids-ai-soc.yaml` or `deploy/docker-compose.yml`.
+  - k8s/IaC misconfig → fix `deploy/kubernetes/wardnet.yaml` or `deploy/docker-compose.yml`.
   - Genuine false positive only → add a narrow, commented entry to `.trivyignore` (see the existing `AVD-KSV-0125` note for the expected style). Never broaden it to silence a real vuln.
 - Do **not** weaken or disable the gate. A local scan with a stale DB misses findings: run `trivy --download-db-only` first, then scan the **merge ref**, not just the PR head (e.g. `trivy fs --scanners vuln,misconfig --severity CRITICAL,HIGH --ignore-unfixed .`).
 - Gating is by the Security Scan **job result**, not the `code_scanning` rule. That org ruleset is intentionally **CodeQL-only** (multiple code-scanning tools can't converge on one PR ref) — do **not** add tools to it.
@@ -56,4 +56,4 @@ As of 2026-08-04, code-owner review requirements (`require_code_owner_reviews` i
 protection, `require_code_owner_review` in rulesets) are disabled across the ContextualWisdomLab
 org: there is a single maintainer (solo developer), so a code-owner approval gate can never be
 satisfied. This is ON HOLD until the org has multiple maintainers — do NOT re-enable these
-settings or add CODEOWNERS-based merge gates before then.
+settings or add CODEOWNERS-based merge gates before then.

CHANGELOG.md

@@ -9,4 +9,5 @@
 
 ### Operations
 
+- Renamed the hardened Kubernetes deployment asset from `deploy/kubernetes/waf-ids-ai-soc.yaml` to `deploy/kubernetes/wardnet.yaml` without renaming in-cluster resources. Operators and GitOps/package references must use the new repository path; rollback to a pre-migration source revision uses that revision's old path.
 - Documented administrator credential provisioning, rotation, rollout verification, rollback, evidence handling, and the boundary with the separate runtime-authentication fail-closed work tracked in issue #78.

CLAUDE.md

@@ -71,7 +71,7 @@ Read in `run_from_env` (`src/lib.rs`): `BIND_ADDR` (default `127.0.0.1:8080`), `
 - Audit logs must never leak admin tokens (`scripts/smoke.sh` asserts this).
 - Untrusted-input surfaces (request scorer, state deserializer, admin-token parser, DNSBL zone export) are fuzzed; if you change one, keep its libFuzzer target and proptest mirror in sync (`docs/fuzzing.md` lists the invariants per target).
 - Block mode is route-scoped; default bind is localhost. See `docs/architecture.md` for security boundaries and the near-term adapter roadmap.
-- Deployment assets: `Dockerfile` (two-stage build, pinned base images, runs as non-root `wafids`), `deploy/docker-compose.yml`, `deploy/kubernetes/waf-ids-ai-soc.yaml`.
+- Deployment assets: `Dockerfile` (two-stage build, pinned base images, runs as non-root `wafids`), `deploy/docker-compose.yml`, `deploy/kubernetes/wardnet.yaml`.
 
 ## Further Docs
 

crates/waf-ids-core/src/lib.rs

@@ -1175,7 +1175,7 @@ pub fn commercial_readiness_snapshot_at(data: &AppData, now_unix: u64) -> Commer
         deployment_assets: vec![
             "Dockerfile".to_string(),
             "deploy/docker-compose.yml".to_string(),
-            "deploy/kubernetes/waf-ids-ai-soc.yaml".to_string(),
+            "deploy/kubernetes/wardnet.yaml".to_string(),
         ],
         buyer_evidence: vec![
             "docs/commercial/20b-krw-sale-readiness.md".to_string(),

docs/commercial/buyer-due-diligence.md

@@ -42,7 +42,7 @@
 
 - [Dockerfile](../../Dockerfile)
 - [Compose stack](../../deploy/docker-compose.yml)
-- [Kubernetes manifest](../../deploy/kubernetes/waf-ids-ai-soc.yaml)
+- [Kubernetes manifest](../../deploy/kubernetes/wardnet.yaml)
 
 ## Buyer Lab Script
 

docs/deployment/production.md

@@ -42,9 +42,11 @@ The Deployment binds `ADMIN_TOKEN` only through that `secretKeyRef` with `option
 After the external secret controller reports successful synchronization, apply the complete manifest. Its Namespace object remains in the declarative asset so later applies retain the same ownership boundary:
 
 ```bash
-kubectl apply -f deploy/kubernetes/waf-ids-ai-soc.yaml
+kubectl apply -f deploy/kubernetes/wardnet.yaml
 ```
 
+The repository path changed from `deploy/kubernetes/waf-ids-ai-soc.yaml` to `deploy/kubernetes/wardnet.yaml`. This is a source-tree/operator path migration only: namespace, Deployment, Service, PVC, image, labels, ports, probes, security context, and Secret coordinates remain unchanged, so applying the renamed file updates the same in-cluster resources. Update scripts, GitOps sources, and packaging rules that referenced the old path before rollout. Rollback to a repository version before this path migration uses that version's old filename; do not create parallel Kubernetes resources as a workaround.
+
 When rotating `ADMIN_TOKEN`, wait for the updated Secret to synchronize, then restart the Deployment because environment-variable-backed Secret values are fixed when a container starts. Verify the rollout and readiness before revoking the previous token:
 
 ```bash

docs/doctoring/kubernetes-admin-secret-boundary.md

@@ -31,7 +31,7 @@ kubectl create namespace waf-ids-ai-soc --dry-run=client -o yaml | kubectl apply
 
 The deployment authority must then confirm that its external secret manager/controller has materialized `waf-ids-ai-soc-admin` in that namespace with a non-empty `ADMIN_TOKEN` key. The repository does not prescribe a vendor-specific controller; the integration boundary is the Kubernetes Secret coordinates above.
 
-Apply `deploy/kubernetes/waf-ids-ai-soc.yaml` only after synchronization succeeds. The manifest retains its Namespace object so fresh installs and upgrades converge on the same declarative namespace ownership. Kubernetes resolves the `secretKeyRef` when creating the container. Because the reference is explicitly non-optional, absence of the Secret or key is an operator-visible startup failure instead of an authentication downgrade.
+Apply `deploy/kubernetes/wardnet.yaml` only after synchronization succeeds. The repository-path rename does not rename namespace, Deployment, Service, PVC, image, labels, ports, probes, security context, or Secret coordinates. The manifest retains its Namespace object so fresh installs and upgrades converge on the same declarative namespace ownership. Kubernetes resolves the `secretKeyRef` when creating the container. Because the reference is explicitly non-optional, absence of the Secret or key is an operator-visible startup failure instead of an authentication downgrade.
 
 ## Rotation
 
@@ -48,7 +48,7 @@ If rollout or authentication verification fails, keep or restore the previous cr
 
 ## Verification contract
 
-`tests/deployment_manifest.rs` is the permanent regression boundary. It fails if the shipped manifest contains a `kind: Secret` document or the historical placeholder value. It structurally selects Deployment `waf-ids-ai-soc`, scopes the lookup to the `gateway` runtime container, requires exactly one `ADMIN_TOKEN` environment entry, rejects literal fallback values and duplicate `ADMIN_TOKEN` entries, and validates the expected namespace, Secret name, key, and non-optional reference. Decoy Deployments, `initContainers`, comments, duplicate environment entries, literal fallbacks, and `optional: true` cannot satisfy the contract. The same regression suite requires the production guide to bootstrap the namespace before namespaced Secret provisioning.
+`tests/deployment_manifest.rs` is the permanent regression boundary. It fails if the shipped manifest contains a `kind: Secret` document or the historical placeholder value. It structurally selects Deployment `waf-ids-ai-soc`, scopes the lookup to the `gateway` runtime container, requires exactly one `ADMIN_TOKEN` environment entry, rejects literal fallback values and duplicate `ADMIN_TOKEN` entries, and validates the expected namespace, Secret name, key, and non-optional reference. Decoy Deployments, `initContainers`, comments, duplicate environment entries, literal fallbacks, and `optional: true` cannot satisfy the contract. The same regression suite requires the production guide to bootstrap the namespace before namespaced Secret provisioning and rejects restoration of the pre-migration Kubernetes repository path.
 
 For release evidence, run the repository's normal formatting, workspace test, Clippy, fuzz, SAST, and Security Scan gates on the exact PR head. A predecessor-head success, skipped required job, or security scan from another merge tree is not evidence for the current artifact.
 

docs/index.md

@@ -0,0 +1,32 @@
+---
+title: Wardnet
+---
+
+# Wardnet
+
+Wardnet is a Rust-first gateway and security-operations control plane for governed traffic policy, threat evidence, DNSBL operations, request enforcement, and operator handoff.
+
+[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/ContextualWisdomLab/wardnet)
+
+## Start here
+
+Use the [repository README](https://github.com/ContextualWisdomLab/wardnet#readme) for the current product boundary, maturity, local quick start, management APIs, deployment guidance, and verification posture. Wardnet deliberately does not present its current source as a complete hardened WAF, IDS, SIEM, or SOAR.
+
+## Product responsibility
+
+Wardnet owns its gateway and SOC control-plane surface: route policy, current local threat and DNSBL evidence, request scoring and enforcement mode, operational evidence, support handoff, and bounded management APIs. Proven external WAF/IDS engines, SIEM and telemetry destinations, threat-intelligence providers, model routing, identity, TLS, secrets, and deployment topology remain independently authoritative.
+
+## Documentation
+
+- [README](https://github.com/ContextualWisdomLab/wardnet#readme) — product overview, quick start, maturity, security and verification.
+- [Architecture](https://github.com/ContextualWisdomLab/wardnet/blob/main/docs/architecture.md) — system boundaries and integration responsibilities.
+- [Buyer due diligence](https://github.com/ContextualWisdomLab/wardnet/blob/main/docs/commercial/buyer-due-diligence.md) — current buyer-facing evidence surfaces and their verification boundaries.
+- [Operations](https://github.com/ContextualWisdomLab/wardnet/tree/main/docs/runbooks) — operator and recovery guidance.
+- [Releases](https://github.com/ContextualWisdomLab/wardnet/releases) — immutable release evidence when published.
+- [Ask DeepWiki](https://deepwiki.com/ContextualWisdomLab/wardnet) — repository-grounded navigation and questions.
+
+## Evidence boundary
+
+A source version, readiness endpoint, passing test, support bundle, or open pull request is not by itself a production deployment, certification, customer adoption, or published release. Repository-facing claims should remain bound to protected source and the applicable immutable release, deployment, and verification evidence.
+
+This file is a GitHub Pages source prerequisite. Its presence does not mean GitHub Pages is published; publication is complete only after repository settings are reconciled, deployment succeeds, and the live HTTPS site is verified.

tests/deployment_manifest.rs

@@ -2,7 +2,7 @@
 
 use std::borrow::Cow;
 
-const MANIFEST: &str = include_str!("../deploy/kubernetes/waf-ids-ai-soc.yaml");
+const MANIFEST: &str = include_str!("../deploy/kubernetes/wardnet.yaml");
 const PRODUCTION_GUIDE: &str = include_str!("../docs/deployment/production.md");
 
 /// Secret coordinates the gateway Deployment must consume for `ADMIN_TOKEN`.
@@ -648,3 +648,13 @@ fn fresh_install_bootstraps_namespace_before_secret_provisioning() {
         "namespace bootstrap must precede namespaced Secret provisioning"
     );
 }
+
+#[test]
+fn legacy_manifest_path_is_absent() {
+    let legacy_manifest = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("deploy/kubernetes/waf-ids-ai-soc.yaml");
+    assert!(
+        !legacy_manifest.exists(),
+        "the pre-rename Kubernetes manifest path must not remain in the distributable tree"
+    );
+}

tests/documentation_landing.rs

@@ -0,0 +1,75 @@
+//! Repository contract for links published by the GitHub Pages landing source.
+
+use std::fs;
+use std::path::{Component, Path};
+
+const REPOSITORY_ROOT_README_URL: &str = "https://github.com/ContextualWisdomLab/wardnet#readme";
+const REPOSITORY_BLOB_PREFIX: &str = "https://github.com/ContextualWisdomLab/wardnet/blob/main/";
+const REPOSITORY_TREE_PREFIX: &str = "https://github.com/ContextualWisdomLab/wardnet/tree/main/";
+
+fn repository_target(target: &str) -> Option<(&str, bool)> {
+    if target == REPOSITORY_ROOT_README_URL {
+        Some(("README.md", false))
+    } else if let Some(relative) = target.strip_prefix(REPOSITORY_BLOB_PREFIX) {
+        Some((relative, false))
+    } else if let Some(relative) = target.strip_prefix(REPOSITORY_TREE_PREFIX) {
+        Some((relative, true))
+    } else {
+        None
+    }
+}
+
+fn validated_repository_relative_path(relative: &str) -> &Path {
+    let path = Path::new(relative);
+    let stays_inside_repository = !path.is_absolute()
+        && path
+            .components()
+            .all(|component| matches!(component, Component::Normal(_) | Component::CurDir));
+    assert!(
+        stays_inside_repository,
+        "Pages landing repository link must stay inside repository: {relative}"
+    );
+    path
+}
+
+#[test]
+fn repository_root_readme_target_is_checked() {
+    assert_eq!(
+        repository_target(REPOSITORY_ROOT_README_URL),
+        Some(("README.md", false))
+    );
+}
+
+#[test]
+#[should_panic(expected = "must stay inside repository")]
+fn repository_link_rejects_parent_escape() {
+    let _ = validated_repository_relative_path("../outside.md");
+}
+
+#[test]
+fn pages_landing_repository_links_resolve_in_source_tree() {
+    let repository = Path::new(env!("CARGO_MANIFEST_DIR"));
+    let landing = fs::read_to_string(repository.join("docs/index.md"))
+        .expect("docs/index.md must remain readable as the Pages landing source");
+
+    for target in landing
+        .split("](")
+        .skip(1)
+        .filter_map(|candidate| candidate.split(')').next())
+    {
+        if let Some((relative, is_directory)) = repository_target(target) {
+            let candidate = repository.join(validated_repository_relative_path(relative));
+            if is_directory {
+                assert!(
+                    candidate.is_dir(),
+                    "Pages landing links to a missing repository directory: {relative}"
+                );
+            } else {
+                assert!(
+                    candidate.is_file(),
+                    "Pages landing links to a missing repository file: {relative}"
+                );
+            }
+        }
+    }
+}