[WAF-00] Epic: Zig WAF v1 stable-union roadmap

[chrisbbreuer]

Objective

Track the complete greenfield implementation of a high-performance Zig WAF, modern proxy integrations, PostgreSQL fleet control plane, and embedded STX operations console.

Deliverables

• Implement the complete scoped behavior described above.
• Keep request-path work independent from UI, PostgreSQL, and blocking audit I/O.
• Use Zig 0.17-dev and dependencies pinned through Pantry; do not add Git submodules.
• Keep public APIs explicit about ownership, resource limits, errors, security policy, and compatibility.
• Add focused unit, integration, differential, fuzz, benchmark, and documentation coverage as applicable.

Acceptance criteria

• The scoped implementation and tests are merged on main in small conventional commits.
• Zig formatting, focused tests, and the relevant CI suite pass.
• Compatibility claims have executable evidence and no unexplained skips or silent fallbacks.
• Untrusted inputs have deterministic bounds; hot paths have benchmark evidence.
• Documentation and the machine-readable compatibility matrix are updated.

Relationships

• Parent: Top-level tracking epic

Blocked by

None

Blocks

None

Roadmap

Foundation

• WAF-01: Create the executable ModSecurity and Coraza feature matrix
• WAF-02: Bootstrap the MIT Zig 0.17 Pantry workspace
• WAF-03: Define allocator, ownership, concurrency, and hot-reload contracts
• WAF-04: Establish CI, reproducible builds, SBOMs, and no-submodule checks
• WAF-05: Build the ModSecurity, Coraza, and zig-waf benchmark laboratory

Engine and SecLang

• WAF-06: Implement the five-phase transaction lifecycle and interventions
• WAF-07: Implement scalar transaction variables
• WAF-08: Implement collection variables, selectors, origins, and macros
• WAF-09: Implement TX and persistent IP, SESSION, USER, and GLOBAL collections
• WAF-10: Implement the SecLang lexer, parser, diagnostics, and includes
• WAF-11: Compile immutable, cache-efficient execution plans
• WAF-12: Implement the complete stable directive union
• WAF-13: Implement rule defaults, removals, updates, markers, and remote rules
• WAF-14: Implement metadata and non-disruptive actions
• WAF-15: Implement disruptive, flow, chain, skip, and ctl actions
• WAF-16: Implement all stable transformations and aliases
• WAF-17: Implement numeric, string, and zig-regex operators
• WAF-18: Implement phrase, dataset, Aho-Corasick, and IP operators
• WAF-19: Integrate zig-injection SQLi and XSS operators
• WAF-20: Implement validation, GeoIP, RBL, file, identity, and hash operators
• WAF-21: Implement Lua, exec, sanitization, hashing, and content mutation
• WAF-22: Implement native Zig and C plugin registries

HTTP and bodies

• WAF-23: Parse request targets, headers, cookies, and URL encoding
• WAF-24: Implement bounded request buffering and disk spooling
• WAF-25: Implement strict multipart and upload handling
• WAF-26: Implement JSON, URL-encoded, and raw body processors
• WAF-27: Implement XML, XPath, XSD, and DTD processing
• WAF-28: Implement response-header and body inspection and mutation

Logging and APIs

• WAF-29: Implement native, legacy JSON, JSON, and OCSF audit formats
• WAF-30: Implement serial, concurrent, syslog, HTTPS, and callback writers
• WAF-31: Add redaction, debug logs, Prometheus, and OpenTelemetry
• WAF-32: Publish a versioned C connector ABI
• WAF-33: Build validate, format, test, explain, replay, and benchmark CLI tools

Compatibility and performance

• WAF-34: Pass the complete SecRules Test Set
• WAF-35: Add ModSecurity 3.0.16 differential regression tests
• WAF-36: Add Coraza 3.7.0 differential and HTTP E2E tests
• WAF-37: Reach 100 percent CRS 4.28 FTW compatibility
• WAF-38: Add parser, body, ABI, HTTP, and storage fuzzing
• WAF-39: Enforce request-path throughput, p99, and RSS release gates

Proxy and connectors

• WAF-40: Implement the HTTP/1.1 reverse proxy
• WAF-41: Implement the HTTP/2 nghttp2 adapter
• WAF-42: Integrate zig-tls for frontend, upstream, and mTLS traffic
• WAF-43: Add routing, health checks, retries, backpressure, and graceful drain
• WAF-44: Ship the Nginx connector
• WAF-45: Ship the Caddy connector
• WAF-46: Ship the Envoy proxy-WASM connector
• WAF-47: Ship the HAProxy SPOE connector

PostgreSQL fleet

• WAF-48: Define and implement the versioned API v1 OpenAPI contract
• WAF-49: Implement node enrollment, mTLS rotation, heartbeats, and inventory
• WAF-50: Implement the Pantry-managed PostgreSQL deployment profile
• WAF-51: Implement the PostgreSQL schema and transactional migrations
• WAF-52: Implement PostgreSQL repositories and isolated connection pools
• WAF-53: Implement signed policy bundles and rollout orchestration
• WAF-54: Implement disk-backed event queues and batched PostgreSQL ingestion
• WAF-55: Implement partitioned event search, retention, and export
• WAF-56: Implement SQLite test and demo repositories
• WAF-57: Implement local authentication, RBAC, API tokens, sessions, and OIDC
• WAF-58: Implement alerts, signed webhooks, and fleet telemetry
• WAF-59: Add PostgreSQL backup, restore, failover guidance, and recovery drills

STX console

• WAF-60: Establish the STX local-link, pinned-CI, and embedded-asset pipeline
• WAF-61: Build the design system, application shell, auth, and onboarding
• WAF-62: Build fleet overview, enrollment, and node-detail views
• WAF-63: Build ruleset authoring, validation, diff, rollout, and rollback
• WAF-64: Build the event-driven exclusion wizard
• WAF-65: Build the live security event and transaction-detail experience
• WAF-66: Build partition-aware audit search and export
• WAF-67: Build metrics, dashboards, alerts, and webhook management
• WAF-68: Build the rule playground, phase trace, and replay laboratory
• WAF-69: Build users, roles, OIDC, tokens, certificates, PostgreSQL, and retention settings
• WAF-70: Add UI E2E, accessibility, visual, security, and performance tests

Release

• WAF-71: Package binaries, libraries, containers, system services, and Helm deployment
• WAF-72: Publish migration, operator, API, plugin, PostgreSQL, and security documentation
• WAF-73: Complete v1.0 compatibility, performance, soak, recovery, and security qualification

Baselines

• ModSecurity 3.0.16
• Coraza 3.7.0
• OWASP CRS 4.28.0
• libinjection 4.0.0
• Zig 0.17-dev resolved and locked through Pantry