[Epic] Node SDK parity + PHP-native deception (v2.2) #16

Tracking issue for milestone v2.2 — Node SDK parity & deception enforcement.

Over the last two weeks @webdecoy/node shipped stealth-browser detection (F1), tripwire rules + honeytokens (F4), and both SDK halves of the clearance loop (WebDecoy/app#128 silent wd_clearance minting, WebDecoy/app#136 clearance forwarding on tripwire violations) — with the WordPress plugin explicitly named as the follow-on surface. Meanwhile the plugin (2.x local-first pivot) has strong bones — PoW challenge, behavioral scoring, WooCommerce carding defense, trusted-proxy IP model, admin UI — but no deterministic deception primitives at all: no tripwires, no honeytokens, no rules engine, no violation reporting, no clearance participation.

This milestone closes that gap, then goes past parity where server-side PHP has structural advantages node middleware doesn't: full-response deception (fake decoy content with canary credentials), WordPress-native traps, and WooCommerce honeytokens.

Task list

Foundation

• Make this repo canonical — sync v2.1.0 from the app monorepo + version hygiene #1 Make this repo canonical — sync v2.1.0 + version hygiene
• Rule engine core — ordered rules, ALLOW/DENY/THROTTLE, dry-run, violation recording #2 Rule engine core (ALLOW/DENY/THROTTLE, dry-run, violations)

Deception primitives (parity)

• Tripwire rules — deterministic scanner-bait paths (zero-FP DENY) #3 Tripwire rules — deterministic scanner-bait paths
• Honeytoken hidden links — automatic sitewide injection #4 Honeytoken hidden links — automatic sitewide injection

Clearance enforcement loop

• wd_clearance server half — cookie capture + forwarding on tripwire violations #5 wd_clearance server half — tripwire violation forwarding
• wd_clearance client half — bundle @webdecoy/client for silent minting #6 wd_clearance client half — bundle @webdecoy/client

Cloud pipeline (parity)

• Violation event batch reporting to ingest #7 Violation event batch reporting
• IP enrichment client — VPN/proxy/Tor, geo, ASN, abuse score #8 IP enrichment client
• Filter rules — expression DSL + admin rule builder #9 Filter rules — expression DSL + admin rule builder
• Rate limiting parity — sliding window, custom keys, THROTTLE semantics #10 Rate limiting — sliding window, keys, THROTTLE

Detection (parity)

• Stealth-browser detection (F1) — converge browser payload on @webdecoy/client #11 Stealth-browser detection (F1) — converge on @webdecoy/client

Beyond parity (PHP/WP advantages)

• Deceptive tripwire responses — fake content, canary credentials, tarpit #12 Deceptive tripwire responses — fake content, canaries, tarpit
• WordPress-native tripwires — XML-RPC, user enumeration, fake vulnerable-plugin paths #13 WordPress-native tripwires — XML-RPC, enumeration, fake plugin paths
• WooCommerce deception — honeytoken coupons + carding tripwires #14 WooCommerce deception — honeytoken coupons + carding tripwires

Cleanup

• Consolidation & cleanup — wire WebDecoy_Forms, single detector, dead cron, allowlist UI #15 Consolidation — WebDecoy_Forms, single detector, dead cron, allowlist UI

Sequencing

#1 → #2 → #3 is the critical path. Then in parallel: #4/#12/#13 build on #3; #7 → #5 completes the enforcement loop with #6 (independent, ship early — it needs only a site key setting + script enqueue); #8 → #9; #10 and #11 anytime after #2/#6 respectively; #14/#15 fit anywhere.

Free vs cloud gating (keep the 2.0 local-first promise)

Mirrors @webdecoy/node: rules run locally without a key; reporter/enrichment wire up only when a key is present; everything fails open.

Definition of done for the milestone

A WordPress site with the plugin + site key: real browsers silently carry wd_clearance; a scanner fetching /.env gets a believable decoy with canary credentials and its device fingerprint is durably denied within seconds; the whole event stream lands in the dashboard as Detections. Expression rules behave identically to @webdecoy/node on the shared test vectors.