Recipes
Recipes are short task pages. Each recipe solves one task. Each recipe ends with a check you can run. The recipes rise in difficulty. Recipe 1 installs Trishula on a local Docker provider and reads the first verdict. Recipe 2 applies a WAFPolicy and reads the verdict line. Recipes 3 to 12 carry the advanced lanes: verdicts, budgets, exclusions, bans, kernel maps and the bench. The later lanes carry the manual ban rule, the shield runner, the challenge and the release verification.
The categories
The sidebar carries the five folders; every recipe = one page.
| Folder | Recipes |
|---|---|
| Getting started | 1, 2, 3 |
| Policy and rules | 4, 9, 11 |
| Kernel enforcement | 6, 7, 10 |
| CRS and the bench | 5, 8 |
| Release and supply chain | 12 |
The recipe ramp
The table lists the planned ramp. Simple tasks sit first. Advanced tasks sit last. Every recipe = one page; the categories = the sidebar folders. A planned recipe stays PENDING until a worked pin and a smoke run exist.
| # | Recipe | Level | Feeds from |
|---|---|---|---|
| 1 | Install Trishula on a kind cluster and see the first verdict | easy | the DX1 lab path, lab/dx1/ |
| 2 | Apply your first WAFPolicy: CR plus one curl, the verdict line | easy | §11.3, the CRD surface |
| 3 | Read the verdicts: the OTel record shape (trishula.verdict.v1) |
easy | §15.2, the verdict signals |
| 4 | Write a CEL rule at S3 with a cost budget | medium | §11.3, §8.1 |
| 5 | Tune the CRS exclusion set without dropping the reference posture | medium | §11.2, §11.8 |
| 6 | Run the ban ladder: ScoredWindowBan shadow, then enforce | hard | §13.3 |
| 7 | Pre-seed the kernel maps from the operator bundle | hard | §16.4, the seed pack |
| 8 | Run the CRS differential and the bench harness on your own node | hard | §11.8, §17 |
| 9 | Ban an offender manually: a CEL rule with action: ban |
medium | §13.7, §13.3 |
| 10 | Watch the dynamic DoS signature: the shield runner end to end | hard | §13.7, §9.3 |
| 11 | Enable bot detection and the challenge: the consensus verdict, the redirect, the proof | medium | §12.2, §13.7 |
| 12 | Verify a release: the SLSA provenance check before you deploy | easy | SECURITY.md, the attest chain (TR-81) |
The categories
| Recipes | Page |
|---|---|
| 1, 2, 3 | the Getting started folder |
| 4, 9, 11 | the Policy and rules folder |
| 6, 7, 10 | the Kernel enforcement folder |
| 5, 8 | the CRS and the bench folder |
| 12 | the Release and supply chain folder |
The folders live in the sidebar (the page tree under the navbar).
The recipe form
Every recipe carries the same parts:
- A header strip table. The columns: Tool, Section, Level, Time, Layer, Tags.
- Problem — the task and its walls.
- Solution — numbered steps. Each step quotes a real command.
- Discussion — what the step did. What to watch. What to tune.
- See also — the linked surfaces.
- Expected output shows shapes and placeholders only. A recipe never prints an invented transcript.
- The provenance footer records the pin, the date and the smoke status.
Level is metadata: easy, medium or hard. Level never becomes a navigation layer. The prose follows ASD-STE100:
- One thought per sentence. 20 words at most.
- Active voice. Present tense. Approved verbs. Digits for numbers.
- Steps read imperative.