Ga naar inhoud

Wanderer documentation

Wanderer is a passive sovereignty-posture scanner: it observes what a public-facing deployment exposes — TLS chains, egress destinations, host configuration — and turns that into findings and DICTU scores you can act on. This is the documentation set; the project-level README covers what Wanderer is and why it exists, and spec-driven change proposals live in openspec/.

Status: draft. These pages were reorganised into the handbook docs contract and carry status: draft until each is reviewed on its own merits.

Start here

  • Tutorial — hands-on walkthrough. Run your first scan, read the output, understand what each finding means.

How-to

  • Operator guide — install, flags, env vars, troubleshooting. The full configuration surface.
  • Scheduling — cron-driven scans inside wanderer serve, schedules file format, SIGHUP semantics.
  • Releasing — cut a release and keep the downstream ExApp in sync.

Reference

  • Findings reference — every ProbeID, severity, and attribute shape. Use this when interpreting output or when writing code that consumes findings.
  • Assessor — how DICTU scores are produced from findings, how to read an Assessment, and how to extend the rule set.
  • Exporters — CSV and JSONL export from the local store, with composable selectors.
  • MCP server — drive scans and read findings from Claude Code or Claude Desktop via the Model Context Protocol.
  • Drift — what counts as posture drift between two scans, the rule set, the wanderer diff CLI.
  • Egress — what the egress probe catches and misses, the redaction guarantee, classifier rules.
  • Observability — logs, Prometheus metrics, OpenTelemetry (deferred).

Explanation

  • Architecture — how the components fit together, key design decisions, how to add a probe.
  • Agent — wanderer agent host-side inspectors, config, least-privilege user setup, HMAC remote transport.
  • Maintainability — single entry point for contributors: CHANGELOG, ADRs, API stability, testing baseline, dependency policy, commit style.
  • Architecture Decision Records — the decisions that shape the project, append-only.