Metadata-Version: 2.5
Name: wraithwall
Version: 0.2.0
Summary: Production deception-and-threat-intelligence platform
Author-email: Adewale Babalola <contact@wraithwall.online>
License: MIT
License-File: LICENSE
Requires-Python: >=3.12
Requires-Dist: apscheduler<4,>=3
Requires-Dist: argon2-cffi>=23
Requires-Dist: bcrypt<5,>=4
Requires-Dist: bleach<7,>=6
Requires-Dist: cryptography>=42
Requires-Dist: flask-bcrypt<2,>=1
Requires-Dist: flask-cors<7,>=4
Requires-Dist: flask-limiter<4,>=3
Requires-Dist: flask-sqlalchemy<4,>=3
Requires-Dist: flask-talisman<2,>=1
Requires-Dist: flask-wtf<2,>=1
Requires-Dist: flask<4,>=3
Requires-Dist: gunicorn<24,>=21
Requires-Dist: httpx>=0.27
Requires-Dist: numpy<3,>=1.26
Requires-Dist: psycopg2-binary<3,>=2.9
Requires-Dist: pyotp<3,>=2
Requires-Dist: python-jose<4,>=3
Requires-Dist: pyyaml<7,>=6
Requires-Dist: redis<6,>=5
Requires-Dist: requests<3,>=2
Requires-Dist: sqlalchemy<3,>=2
Requires-Dist: typer<1,>=0.12
Requires-Dist: user-agents<3,>=2
Requires-Dist: validators>=0.22
Provides-Extra: all
Requires-Dist: pytest-cov; extra == 'all'
Requires-Dist: pytest>=8; extra == 'all'
Requires-Dist: ruff; extra == 'all'
Provides-Extra: dev
Requires-Dist: pytest-cov; extra == 'dev'
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff; extra == 'dev'
Description-Content-Type: text/markdown

# WraithWall

[![License: MIT](https://img.shields.io/badge/License-MIT-blue?style=flat-square)](LICENSE)
[![Donate](https://img.shields.io/badge/Support-Open%20Collective-7FADF2?style=flat-square&logo=opencollective&logoColor=white)](https://opencollective.com/wraithwall)

Production deception-and-threat-intelligence platform and companion packages.

## Ecosystem

| Package | Install | Purpose | Status |
|---------|---------|---------|--------|
| **wraithwall** | `pip install wraithwall` | Flask platform — gateway, link intel, cowrie, BGP, canaries | PyPI 0.2.0 |
| **ravenscan** | `pip install ravenscan` | Engineering intelligence CLI (`raven`) and library | PyPI 0.1.0 |
| **canary-kit** | `pip install canary-kit` | Supply-chain canary token minting and detection | PyPI 0.1.0 |
| **honeypot-mitre** | `pip install honeypot-mitre` | Cowrie logs → MITRE ATT&CK scoring | PyPI 0.1.0 |
| **dml-spec** | `pip install dml-spec` | Signed deception markup language validator | PyPI 1.0.0 |
| **wraithmesh** | `pip install packages/wraithmesh` (local) | Distributed sensor mesh / signed observations | **v2 ready** 0.2.0 (not on PyPI yet) |
| **wraithwall-sdk** | source only | Official HTTP API client | Not published yet |

Packages are independent — none imports another.

## Quick start

```bash
git clone https://github.com/niffyhunt/wraithwall.git
cd wraithwall
./install.sh
cp .env.example .env
docker compose up -d
wraithwall check
wraithwall serve
```

## Run the local secure sandbox

The sandbox ships in this package: `sandbox_kit/` (launcher), `compose.sandbox.yml`,
digest-pinned Dockerfiles, and a deterministic synthetic-telemetry seed. No
cloud account, no API keys, no internet exposure.

```bash
./sandbox.sh up --profile app-only      # T0: gates + state only, no containers
./sandbox.sh up --profile local-sandbox # T1: build, boot, self-check (one-time ack)
./sandbox.sh verify                     # fail-closed self-check of the running sandbox
./sandbox.sh destroy --yes              # stop services and delete all sandbox state
```

Every command is fail-closed: a missing prerequisite, a digest mismatch or an
ambiguous confirmation stops the launcher instead of starting something inert.
Telemetry it produces is **synthetic and marked LOCAL** on every record, so it
can never be mistaken for attacker data.

This is not a guaranteed malware-containment environment unless separately
isolated by a VM or dedicated host. Read
[docs/sandbox/quickstart.md](docs/sandbox/quickstart.md) and
[docs/sandbox/security-model.md](docs/sandbox/security-model.md) before
pointing it at anything you did not write yourself.

## Python API

```python
from wraithwall import create_app, Client
from wraithwall.link_checker import analyze
from wraithwall.gateway import Gateway

app = create_app()
client = Client("http://localhost:8000", api_key="...")
print(client.health())
result = analyze("https://example.com")
blocked = Gateway.is_ip_blocked("203.0.113.1")
```

```python
from ravenscan import scan
from canary_kit import create_canary

profile = scan(".")
token = create_canary("my-sdk", "1.0.0")
```

## CLI

```bash
wraithwall check
wraithwall serve --port 8000
wraithwall routes
raven scan .
canary-kit mint my-pkg 1.0.0 --type runtime
honeypot-mitre sample.json
dml validate traps.yaml
```

## Configuration

All secrets and infrastructure endpoints come from environment variables (see `.env.example`). Nothing is hardcoded to a specific deployment.

## Documentation

- **[docs/sandbox/quickstart.md](docs/sandbox/quickstart.md)** — Local sandbox in five minutes
- **[docs/sandbox/security-model.md](docs/sandbox/security-model.md)** — What is isolated, what is not (read this first)
- **[docs/sandbox/profiles.md](docs/sandbox/profiles.md)** — Profiles T0–T3 and confirmation gates
- **[docs/sandbox/lifecycle.md](docs/sandbox/lifecycle.md)** — up / status / verify / replay / reset / destroy
- **[docs/sandbox/troubleshooting.md](docs/sandbox/troubleshooting.md)** — E-code catalog → cause → fix
- **[docs/sandbox/network.md](docs/sandbox/network.md)** — Zones, default-deny, how to verify nothing leaves
- **[docs/sandbox/data-policy.md](docs/sandbox/data-policy.md)** — What may enter or leave, synthetic marking
- **[docs/sandbox/vs-production.md](docs/sandbox/vs-production.md)** — How the sandbox differs from the production deployment
- **[docs/sandbox/platforms.md](docs/sandbox/platforms.md)** — Platform support matrix
- **[CHANGELOG.md](CHANGELOG.md)** — Version history
- **[DEVELOPER_DOCUMENTATION_PLAN.md](DEVELOPER_DOCUMENTATION_PLAN.md)** — Documentation contracts and freshness rules

## Contributing

Install the full stack with `./install.sh`, run `pytest`, then open a PR. Each package under `packages/` has its own README and examples. See [CONTRIBUTING.md](CONTRIBUTING.md) for details.

Working on the local sandbox? Read [CONTRIBUTING.md](CONTRIBUTING.md) § local sandbox first — it states which profile to test hostile content against.
