fix(deploy): rename hardened Kubernetes manifest to wardnet.yaml

[seonghobae]

Fixes #75 only after this exact bounded slice reaches protected main.

Buyer / operator outcome

This branch is the foundation-first repository-path migration for the hardened Kubernetes asset plus its public/operator documentation landing:

• move the hardened source asset to deploy/kubernetes/wardnet.yaml without renaming live Kubernetes resource identities;
• make README/operator/buyer/security references use the canonical repository path;
• retain a strict stale-path regression with only bounded migration/rollback-history exceptions;
• add a bounded docs/index.md landing and repository-link validation;
• preserve the externally provisioned administrator-Secret boundary and current non-production/release truth.

The latest pre-restack source repair, 8d656d313c18c2b304d3e1a563317a967c23e250, is valid intervening delta rather than a race: it only rewrites one iterator closure in tests/kubernetes_manifest_path.rs to satisfy the Rust 1.98 Clippy contract without changing the asserted path semantics.

Fresh protected-main adoption — 2026-09-08 KST

This branch previously adopted protected main@5829a0f08d78de464dd24393ce5d0f25fba9d126 through merge 04692b24c179d1c067113f83c52a4ad1b4af7c5a. Protected truth later advanced through #171 to exact a52ccd0a24a727d9349bb32def7713882d8cad1e.

Fresh compare of predecessor 04692b24... against current protected main proved the protected-only intervening delta is #171's two ADR files and that this candidate's effective 13-path Kubernetes/documentation slice is otherwise unchanged. There is no source-path overlap with the protected ADR delta.

The branch therefore adopted exact protected main non-destructively with two-parent commit f5383585d3588d7b63b00a11bba61fa0d875743e, preserving predecessor 04692b24... as first parent and protected a52ccd0... as second parent. Its tree preserves the predecessor branch exactly and adds the two protected ADR blobs byte-for-byte. No force push, destructive rebase, source reconstruction, or central-workflow rewrite was used.

Fresh compare is now behind_by=0, merge base exactly a52ccd0..., and the protected-main-relative effective delta remains 13 paths: AGENTS/CHANGELOG/CLAUDE/README, one core documentation string, the manifest rename, buyer/deployment/doctoring docs, docs/index.md, and three path/deployment/documentation regressions.

Stack / single-writer decision

This narrower path-only migration is the prerequisite for broad rename PR #114. #114 also renames the same Kubernetes asset and many surrounding product/runtime identities, so it must remain Draft and later non-force adopt the protected result of this PR rather than racing two overlapping rename authorities. If this slice is replaced, the successor must prove complete transfer of every unique path/documentation/test delta before #144 can be retired.

Exact-current gate

Current exact head is f5383585d3588d7b63b00a11bba61fa0d875743e. All predecessor checks are historical after the ancestry movement.

• CI 34169523123 — SUCCESS;
• Fuzz 34169523073 — SUCCESS;
• Security Scan 34169523087 — SUCCESS;
• SAST Semgrep 34169523105 — SUCCESS;
• CodeQL PR 34169523094 — FAILURE at the central delegated terminal-receipt boundary, not a Wardnet Kubernetes-path/source finding.

This unchanged head remains a Wardnet consumer specimen for canonical central owner issue .github#1929. The active repair is .github#1902; because its head remains mutable until protected, this product PR no longer pins a stale central candidate or treats it as dependency authority. Re-read the live owner path before any integration decision. Wardnet does not source-churn this clean head or synthesize delegated evidence.

Live ruleset 18156473 still carries the solo-maintainer generic approval defect tracked by .github#772; self/model approval and routine administrator bypass remain forbidden.

Keep Draft until one unchanged exact current head has terminal then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence and fresh protected-base compatibility. No gate weakening, force push, destructive rebase, mutable foreign dependency, source copy, cross-service SQL, no-op redispatch or predecessor-evidence reuse.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 75030a2e-29f3-4ab3-ba1e-6792591fc4fc

📥 Commits

Reviewing files that changed from the base of the PR and between 9616b94 and b07e4d2.

📒 Files selected for processing (1)

• tests/kubernetes_manifest_path.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Kubernetes 매니페스트를 deploy/kubernetes/wardnet.yaml로 추가하고 저장소의 경로 참조를 갱신했습니다. 기존 Kubernetes 리소스와 외부 관리자 시크릿 참조는 유지합니다. 경로 회귀 검사는 이전 파일과 허용되지 않은 레거시 참조를 차단합니다.

Changes

Kubernetes 매니페스트 경로 마이그레이션

Layer / File(s)	Summary
새 Kubernetes 매니페스트 deploy/kubernetes/wardnet.yaml	네임스페이스, 2Gi PVC, gateway Deployment, 비선택적 ADMIN_TOKEN Secret 참조, 헬스 프로브, 보안 컨텍스트 및 HTTP Service를 정의합니다.
운영 참조 및 문서 갱신 AGENTS.md, CLAUDE.md, README.md, CHANGELOG.md, crates/waf-ids-core/src/lib.rs, docs/commercial/..., docs/deployment/..., docs/doctoring/..., docs/index.md	매니페스트 경로를 deploy/kubernetes/wardnet.yaml로 변경합니다. README와 문서 랜딩 페이지에 Wardnet의 제품 범위, 운영 정보 및 증거 경계를 반영합니다.
경로 회귀 검증 tests/deployment_manifest.rs, tests/kubernetes_manifest_path.rs, tests/documentation_landing.rs	새 매니페스트를 검사 대상으로 등록합니다. 이전 파일의 부재와 문서 링크의 실제 경로를 검증합니다. 명시적 마이그레이션·롤백 문맥만 레거시 경로를 허용합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to b07e4

This change completes the Wardnet manifest-path migration while retaining controlled migration and rollback references. No concrete current-head merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	변경 사항은 이슈 [#75]의 주요 요구사항과 일치합니다. 새 경로를 추가하고 기존 Secret 경계, 리소스 식별자, 프로브, 포트 및 보안 컨텍스트를 유지했습니다. 운영 문서, 구매자 검토 문서, 배포 자산 참조, 회귀 테스트 및 경로 검증을 갱신했습니다. 마이그레이션과 롤백 시 파일 경로와 클러스터 리소스 식별자가 다르다는 점도 문서화했습니다.
Out of Scope Changes check	✅ Passed	README 전면 개편, docs/index.md 추가 및 문서 링크 검증은 PR 목표와 이슈 [#75]에 명시된 제품 문서화 및 탐색성 개선 범위에 포함됩니다. 제공된 변경 요약에는 관련 없는 런타임 리소스, API, 패키지 또는 제품 기능 변경이 없습니다.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 hardened Kubernetes 매니페스트를 deploy/kubernetes/wardnet.yaml로 변경하는 PR의 주요 변경 사항을 정확하고 간결하게 설명합니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kubernetes-manifest-path-20260901

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[cwl-noema-review]

Noema LLM review

The PR correctly renames the hardened Kubernetes manifest from deploy/kubernetes/waf-ids-ai-soc.yaml to deploy/kubernetes/wardnet.yaml and updates all corresponding references in documentation, agent guides, and source code. Crucially, it introduces a structural regression contract in tests/kubernetes_manifest_path.rs to prevent the accidental reintroduction of the legacy path in operational contexts, while allowing it for explicit migration history. It also adds tests/documentation_landing.rs to ensure GitHub Pages links resolve correctly, addressing a previously identified 404 risk.

Reviewed changed lines

• AGENTS.md:20 (RIGHT): Correctly updates the remediation path for k8s/IaC misconfigs to the new filename.
• tests/deployment_manifest.rs:651 (RIGHT): Adds a concrete test to ensure the legacy manifest file is physically absent from the distributable tree.
• tests/kubernetes_manifest_path.rs:78 (RIGHT): Implements a granular allowlist for legacy paths, distinguishing between dangerous operational references (e.g., kubectl apply) and safe historical documentation.
• tests/documentation_landing.rs:63 (RIGHT): Implements a repository-wide link validator for the landing page to prevent broken links to the main branch.

Adversarial validation

• tests/kubernetes_manifest_path.rs:145 (RIGHT) falsified: The stale-reference scanner can be bypassed by placing the legacy path in a non-text file. — The scanner explicitly iterates over TEXT_EXTENSIONS; however, the legacy path is a source-tree reference typically found in docs/scripts, which are covered.
• tests/kubernetes_manifest_path.rs:102 (RIGHT) falsified: The scanner fails if the test file itself contains the legacy path literal as a negative test case. — The test uses runtime fragment concatenation (lines 138-140) to avoid literal matches, ensuring the test file remains subject to the scan without triggering it.
• Residual risk: low

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 9616b94ac1ecf70038071a8c9395348694e6312c
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]

[devin-ai-integration]

Devin Review found 0 new potential issues.