[Epic] Node SDK parity + PHP-native deception (v2.2)

[cport1]

Tracking issue for milestone v2.2 — Node SDK parity & deception enforcement.

Over the last two weeks @webdecoy/node shipped stealth-browser detection (F1), tripwire rules + honeytokens (F4), and both SDK halves of the clearance loop (WebDecoy/app#128 silent wd_clearance minting, WebDecoy/app#136 clearance forwarding on tripwire violations) — with the WordPress plugin explicitly named as the follow-on surface. Meanwhile the plugin (2.x local-first pivot) has strong bones — PoW challenge, behavioral scoring, WooCommerce carding defense, trusted-proxy IP model, admin UI — but no deterministic deception primitives at all: no tripwires, no honeytokens, no rules engine, no violation reporting, no clearance participation.

This milestone closes that gap, then goes past parity where server-side PHP has structural advantages node middleware doesn't: full-response deception (fake decoy content with canary credentials), WordPress-native traps, and WooCommerce honeytokens.

Task list

Foundation

• Make this repo canonical — sync v2.1.0 from the app monorepo + version hygiene #1 Make this repo canonical — sync v2.1.0 + version hygiene
• Rule engine core — ordered rules, ALLOW/DENY/THROTTLE, dry-run, violation recording #2 Rule engine core (ALLOW/DENY/THROTTLE, dry-run, violations)

Deception primitives (parity)

• Tripwire rules — deterministic scanner-bait paths (zero-FP DENY) #3 Tripwire rules — deterministic scanner-bait paths
• Honeytoken hidden links — automatic sitewide injection #4 Honeytoken hidden links — automatic sitewide injection

Clearance enforcement loop

• wd_clearance server half — cookie capture + forwarding on tripwire violations #5 wd_clearance server half — tripwire violation forwarding
• wd_clearance client half — bundle @webdecoy/client for silent minting #6 wd_clearance client half — bundle @webdecoy/client

Cloud pipeline (parity)

• Violation event batch reporting to ingest #7 Violation event batch reporting
• IP enrichment client — VPN/proxy/Tor, geo, ASN, abuse score #8 IP enrichment client
• Filter rules — expression DSL + admin rule builder #9 Filter rules — expression DSL + admin rule builder
• Rate limiting parity — sliding window, custom keys, THROTTLE semantics #10 Rate limiting — sliding window, keys, THROTTLE

Detection (parity)

• Stealth-browser detection (F1) — converge browser payload on @webdecoy/client #11 Stealth-browser detection (F1) — converge on @webdecoy/client

Beyond parity (PHP/WP advantages)

• Deceptive tripwire responses — fake content, canary credentials, tarpit #12 Deceptive tripwire responses — fake content, canaries, tarpit
• WordPress-native tripwires — XML-RPC, user enumeration, fake vulnerable-plugin paths #13 WordPress-native tripwires — XML-RPC, enumeration, fake plugin paths
• WooCommerce deception — honeytoken coupons + carding tripwires #14 WooCommerce deception — honeytoken coupons + carding tripwires

Cleanup

• Consolidation & cleanup — wire WebDecoy_Forms, single detector, dead cron, allowlist UI #15 Consolidation — WebDecoy_Forms, single detector, dead cron, allowlist UI

Sequencing

#1 → #2 → #3 is the critical path. Then in parallel: #4/#12/#13 build on #3; #7 → #5 completes the enforcement loop with #6 (independent, ship early — it needs only a site key setting + script enqueue); #8 → #9; #10 and #11 anytime after #2/#6 respectively; #14/#15 fit anywhere.

Free vs cloud gating (keep the 2.0 local-first promise)

Capability	Free (no key)	Cloud
Tripwires, honeytokens, rate limiting, req.* filter rules, deceptive responses, WP traps, stealth detection	✅ local enforce	dashboard visibility via #7
Violation reporting (#7)	—	API key
IP enrichment + ip.* filter fields (#8/#9)	degrade to false	API key
wd_clearance mint (#6)	—	site key (publishable)
Tripwire → durable fp deny-list (#5)	—	site key + edge validator

Mirrors @webdecoy/node: rules run locally without a key; reporter/enrichment wire up only when a key is present; everything fails open.

Definition of done for the milestone

A WordPress site with the plugin + site key: real browsers silently carry wd_clearance; a scanner fetching /.env gets a believable decoy with canary credentials and its device fingerprint is durably denied within seconds; the whole event stream lands in the dashboard as Detections. Expression rules behave identically to @webdecoy/node on the shared test vectors.

[cport1]

Progress — 9 of 15 tasks done (P0 complete + most of P1).

Merged: #17 (sync), #20 (rule engine/tripwires/clearance-forwarding #2/#3/#5), #19 (clearance client #6), #21+#22 (hygiene/release-flow #1), #23 (honeytoken #4), #24 (filter rules + IP enrichment #8/#9). Tripwires + honeytoken are on by default.

Remaining: #7 (violation reporting resilience — a minimal shutdown-flush reporter already shipped with #5; this adds DB spool + cron retry), #11 (stealth/F1), #12 (deceptive responses), plus P2 #10/#13/#14/#15.

[cport1]

✅ Milestone complete — all 15 tasks shipped and merged to main.

Every issue closed via its own tested PR with green CI (PHP 7.4 compat / PHPCS / PHPStan):

Foundation & parity

• Make this repo canonical — sync v2.1.0 from the app monorepo + version hygiene #1 canonical repo + release flow + version hygiene (PRs chore: sync v2.1.0 from the app monorepo #17/chore: SDK User-Agent hygiene (#1) #21/chore: bring release flow into the canonical repo (#1) #22)
• Rule engine core — ordered rules, ALLOW/DENY/THROTTLE, dry-run, violation recording #2 rule engine · Tripwire rules — deterministic scanner-bait paths (zero-FP DENY) #3 tripwires · wd_clearance server half — cookie capture + forwarding on tripwire violations #5 clearance forwarding (PR feat: rule engine + tripwires + wd_clearance forwarding (#2 #3 #5) #20)
• wd_clearance client half — bundle @webdecoy/client for silent minting #6 clearance client bundle (PR feat: bundle @webdecoy/client for silent wd_clearance minting (#6) #19)
• Honeytoken hidden links — automatic sitewide injection #4 honeytoken auto-injection (PR feat: honeytoken hidden-link injection (#4) #23)
• IP enrichment client — VPN/proxy/Tor, geo, ASN, abuse score #8 IP enrichment · Filter rules — expression DSL + admin rule builder #9 filter DSL + rule builder (PR feat: filter expression rules + IP enrichment (#8 #9) #24)
• Violation event batch reporting to ingest #7 resilient violation reporting (PR feat: resilient violation reporting — DB spool + cron retry (#7) #25)
• Stealth-browser detection (F1) — converge browser payload on @webdecoy/client #11 stealth/F1 detection (PR feat: stealth-browser detection (F1) (#11) #27)
• Rate limiting parity — sliding window, custom keys, THROTTLE semantics #10 rate-limit parity — sliding window, keys, THROTTLE (PR feat: rate limiting parity — sliding window, keys, THROTTLE (#10) #28)

Beyond parity (PHP/WP-native deception)

• Deceptive tripwire responses — fake content, canary credentials, tarpit #12 deceptive responses + canary credentials (PR feat: deceptive tripwire responses + canary credentials (#12) #26)
• WordPress-native tripwires — XML-RPC, user enumeration, fake vulnerable-plugin paths #13 WordPress-native traps — fake plugins, XML-RPC, author enum → canary (PR feat: WordPress-native tripwires (#13) #29)
• WooCommerce deception — honeytoken coupons + carding tripwires #14 WooCommerce honeytoken coupons (PR feat: WooCommerce honeytoken coupons (#14) #30)

Cleanup

• Consolidation & cleanup — wire WebDecoy_Forms, single detector, dead cron, allowlist UI #15 single detector path, dead code/cron removal, allowlist UI (PR chore: consolidation & cleanup (#15) #31)

Tripwires + honeytoken ship on by default. Cloud features degrade to local-only enforcement without a key; everything fails open. Dependency-free test suite at 41 assertions plus stubbed-WP harnesses for each stateful component. Version is 2.1.0 in the header (2.2.0 unreleased) — tag v2.2.0 + CDN upload happen at release via release.sh / RELEASING.md.

Closing.