@chain305/x-security 0.2.6 → 0.3.0

package/bin/xsecurity.mjs

@@ -978,7 +978,7 @@ function buildAuthzLua(authz, ctx) {
       `  if ${condition} then`,
       `    kong.log.warn("[${SS_BOLA_TAG}] rule ${i5 + 1} (${rule.field} ${rule.operator}) denied")`,
       `    return kong.response.exit(403, {`,
-      `      message = "Writ: BOLA denied",`,
+      `      message = "XSecurity: BOLA denied",`,
       `      tag = "${SS_BOLA_TAG}",`,
       `      rule = ${i5 + 1}`,
       `    })`,
@@ -997,12 +997,12 @@ function buildAuthzLua(authz, ctx) {
     });
   }
   const head = [
-    `-- Writ K-1 BOLA pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity K-1 BOLA pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `local cjson = require("cjson.safe")`,
     `local principal = ${refToLuaExpr("jwt.sub").expr}`,
     `if not principal then`,
     `  kong.log.warn("[${SS_BOLA_TAG}] no authenticated principal; denying")`,
-    `  return kong.response.exit(401, {message = "Writ: no authenticated principal", tag = "${SS_BOLA_TAG}"})`,
+    `  return kong.response.exit(401, {message = "XSecurity: no authenticated principal", tag = "${SS_BOLA_TAG}"})`,
     `end`,
     ``
   ];
@@ -1011,21 +1011,21 @@ function buildAuthzLua(authz, ctx) {
     const idExpr = refToLuaExpr(lookup.identifierFrom).expr;
     head.push(
       `-- W10-11: shared_dict cache (key=principal:resource_id, TTL=${SS_BOLA_CACHE_TTL_SECONDS}s)`,
-      `local ss_cache = ngx.shared.writ_bola_cache`,
+      `local ss_cache = ngx.shared.x_security_bola_cache`,
       `local ss_resource_id = tostring(${idExpr} or "")`,
       `local ss_cache_key = tostring(principal) .. ":" .. ss_resource_id`,
       `local ss_cached_owner = ss_cache and ss_cache:get(ss_cache_key) or nil`,
       `local ss_resource = nil`,
       `if ss_cached_owner ~= nil then`,
-      `  kong.log.warn("[writ-bola] cache_hit key=" .. ss_cache_key .. " owner=" .. tostring(ss_cached_owner))`,
+      `  kong.log.warn("[x-security-bola] cache_hit key=" .. ss_cache_key .. " owner=" .. tostring(ss_cached_owner))`,
       `  ss_resource = { ownerId = ss_cached_owner, _ss_cached = true }`,
       `else`,
       `  -- resource lookup: ${lookup.endpoint} (identifier from ${lookup.identifierFrom})`,
-      `  kong.log.warn("[writ-bola] cache_miss key=" .. ss_cache_key)`,
+      `  kong.log.warn("[x-security-bola] cache_miss key=" .. ss_cache_key)`,
       `  local ok_req, http = pcall(require, "resty.http")`,
       `  if not ok_req then`,
       `    kong.log.warn("[${SS_BOLA_TAG}] resty.http not available; failing closed")`,
-      `    return kong.response.exit(403, {message = "Writ: resource access denied", tag = "${SS_BOLA_TAG}", reason = "resty_http_missing"})`,
+      `    return kong.response.exit(403, {message = "XSecurity: resource access denied", tag = "${SS_BOLA_TAG}", reason = "resty_http_missing"})`,
       `  end`,
       `  local httpc = http.new()`,
       `  httpc:set_timeout(2000)`,
@@ -1035,19 +1035,19 @@ function buildAuthzLua(authz, ctx) {
       `      method = "GET",`,
       `      headers = {`,
       `        ["Authorization"] = kong.request.get_header("Authorization"),`,
-      `        ["X-Writ-Internal"] = "rule-lookup"`,
+      `        ["X-XSecurity-Internal"] = "rule-lookup"`,
       `      },`,
       `      ssl_verify = false`,
       `    })`,
       `  end)`,
       `  if not ok_call or not res or res.status ~= 200 then`,
-      `    kong.log.warn("[writ-bola] resource lookup failed status=" .. tostring(res and res.status or "no_response"))`,
-      `    return kong.response.exit(403, {message = "Writ: resource access denied", tag = "${SS_BOLA_TAG}", reason = "lookup_failed"})`,
+      `    kong.log.warn("[x-security-bola] resource lookup failed status=" .. tostring(res and res.status or "no_response"))`,
+      `    return kong.response.exit(403, {message = "XSecurity: resource access denied", tag = "${SS_BOLA_TAG}", reason = "lookup_failed"})`,
       `  end`,
       `  local ok_decode, body = pcall(cjson.decode, res.body or "{}")`,
       `  if not ok_decode or type(body) ~= "table" then`,
-      `    kong.log.warn("[writ-bola] decode failed for " .. lookup_url)`,
-      `    return kong.response.exit(403, {message = "Writ: invalid resource response", tag = "${SS_BOLA_TAG}", reason = "decode_failed"})`,
+      `    kong.log.warn("[x-security-bola] decode failed for " .. lookup_url)`,
+      `    return kong.response.exit(403, {message = "XSecurity: invalid resource response", tag = "${SS_BOLA_TAG}", reason = "decode_failed"})`,
       `  end`,
       `  ss_resource = body`,
       `  if ss_cache and body.ownerId ~= nil then`,
@@ -1112,7 +1112,7 @@ function buildSsrfPreFunctionPlugins(request9, ctx = {}) {
   }
   if (items.length === 0) return [];
   const lines = [
-    `-- Writ W19-A SSRF url-allowlist pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W19-A SSRF url-allowlist pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `-- W21-C: pure Kong PDK + Lua stdlib (no external module loads). Hardened`,
     `-- OSS deployments restrict the untrusted_lua sandbox; this snippet runs there.`,
     ``,
@@ -1142,13 +1142,13 @@ function buildSsrfPreFunctionPlugins(request9, ctx = {}) {
       lines.push(`    local ss_allow = ${luaHostSet(it.allow)}`);
       lines.push(`    if not host or not ss_allow[host] then`);
       lines.push(`      kong.log.warn("[${SS_SSRF_TAG}] host '" .. tostring(host) .. "' not in domainAllowlist for ${it.field}")`);
-      lines.push(`      return kong.response.exit(403, {message = "Writ: SSRF url not in domainAllowlist", tag = "${SS_SSRF_TAG}", field = ${luaStr(it.field)}})`);
+      lines.push(`      return kong.response.exit(403, {message = "XSecurity: SSRF url not in domainAllowlist", tag = "${SS_SSRF_TAG}", field = ${luaStr(it.field)}})`);
       lines.push(`    end`);
     }
     if (it.block) {
       lines.push(`    if ss_is_private(host) then`);
       lines.push(`      kong.log.warn("[${SS_SSRF_PRIVATE_TAG}] private-range host '" .. tostring(host) .. "' on ${it.field}")`);
-      lines.push(`      return kong.response.exit(403, {message = "Writ: SSRF blocked private/loopback host", tag = "${SS_SSRF_PRIVATE_TAG}", field = ${luaStr(it.field)}})`);
+      lines.push(`      return kong.response.exit(403, {message = "XSecurity: SSRF blocked private/loopback host", tag = "${SS_SSRF_PRIVATE_TAG}", field = ${luaStr(it.field)}})`);
       lines.push(`    end`);
     }
     lines.push(`  end`);
@@ -1185,7 +1185,7 @@ function buildMassAssignPreFunctionPlugins(request9, ctx = {}) {
   if (!allow) return [];
   const luaAllowTable = "{" + allow.map((k5) => `[${luaStr(k5)}]=true`).join(", ") + "}";
   const lua = [
-    `-- Writ K-3 mass-assignment pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity K-3 mass-assignment pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `-- Allowlist sourced from ${explicitAllow ? "request.allowedFields" : "request.schema top-level keys"}.`,
     `local ss_allow = ${luaAllowTable}`,
     `local body = kong.request.get_body()`,
@@ -1194,7 +1194,7 @@ function buildMassAssignPreFunctionPlugins(request9, ctx = {}) {
     `    if not ss_allow[k] then`,
     `      kong.log.warn("[${SS_MASS_ASSIGN_TAG}] unknown field '" .. tostring(k) .. "' rejected")`,
     `      return kong.response.exit(403, {`,
-    `        message = "Writ: unknown field rejected",`,
+    `        message = "XSecurity: unknown field rejected",`,
     `        tag = "${SS_MASS_ASSIGN_TAG}",`,
     `        field = tostring(k)`,
     `      })`,
@@ -1219,7 +1219,7 @@ function buildSqliPreFunctionPlugins(request9, ctx = {}) {
     checks.push(`      if vl:match(${luaStr(SQLI_LUA_PATTERNS[i5])}) then return k, ${i5 + 1} end`);
   }
   const lua = [
-    `-- Writ K-4 SQLi heuristic pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity K-4 SQLi heuristic pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `-- Scans JSON body string values for classic SQLi patterns; rejects on hit.`,
     `local body = kong.request.get_body()`,
     `if type(body) == "table" then`,
@@ -1235,7 +1235,7 @@ function buildSqliPreFunctionPlugins(request9, ctx = {}) {
     `  if hit_field ~= nil then`,
     `    kong.log.warn("[${SS_SQLI_TAG}] sqli pattern " .. tostring(hit_rule) .. " in field '" .. tostring(hit_field) .. "'")`,
     `    return kong.response.exit(403, {`,
-    `      message = "Writ: SQLi pattern rejected",`,
+    `      message = "XSecurity: SQLi pattern rejected",`,
     `      tag = "${SS_SQLI_TAG}",`,
     `      field = tostring(hit_field),`,
     `      rule = hit_rule`,
@@ -1252,7 +1252,7 @@ function buildSqliPreFunctionPlugins(request9, ctx = {}) {
 function buildDeprecatedEndpointPlugins(policy, ctx = {}) {
   if (policy.deprecated !== true) return [];
   const bodyFields = [
-    `message = "Writ: endpoint is deprecated"`,
+    `message = "XSecurity: endpoint is deprecated"`,
     `tag = "${SS_DEPRECATED_TAG}"`
   ];
   if (policy.sunsetDate) bodyFields.push(`sunset = ${luaStr(policy.sunsetDate)}`);
@@ -1271,7 +1271,7 @@ function buildDeprecatedEndpointPlugins(policy, ctx = {}) {
 }`);
   }
   const lua = [
-    `-- Writ K-5 deprecated-endpoint block for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity K-5 deprecated-endpoint block for endpoint=${ctx.endpoint ?? "?"}`,
     `kong.log.warn("[${SS_DEPRECATED_TAG}] request to deprecated endpoint blocked")`,
     `return kong.response.exit(${exitArgs.join(", ")})`
   ].join("\n");
@@ -1517,12 +1517,12 @@ var init_plugins = __esm({
       "hmac-sha384",
       "hmac-sha512"
     ]);
-    SS_BOLA_TAG = "writ-rule-bola-403";
+    SS_BOLA_TAG = "x-security-rule-bola-403";
     SS_BOLA_CACHE_TTL_SECONDS = 60;
-    SS_BOLA_CACHE_DICT = "writ_bola_cache";
+    SS_BOLA_CACHE_DICT = "x_security_bola_cache";
     SS_BOLA_CACHE_DICT_SIZE = "10m";
-    SS_SSRF_TAG = "writ-rule-ssrf-403";
-    SS_SSRF_PRIVATE_TAG = "writ-rule-ssrf-private-403";
+    SS_SSRF_TAG = "x-security-rule-ssrf-403";
+    SS_SSRF_PRIVATE_TAG = "x-security-rule-ssrf-private-403";
     SSRF_PRIVATE_LUA_PATTERNS = [
       "^10%.",
       "^127%.",
@@ -1540,8 +1540,8 @@ var init_plugins = __esm({
       "^%[fd",
       "^%[fe80"
     ];
-    SS_MASS_ASSIGN_TAG = "writ-mass-assign-403";
-    SS_SQLI_TAG = "writ-sqli-403";
+    SS_MASS_ASSIGN_TAG = "x-security-mass-assign-403";
+    SS_SQLI_TAG = "x-security-sqli-403";
     SQLI_LUA_PATTERNS = [
       `[' "]%s*or%s+%d+%s*=%s*%d+`,
       // ' OR 1=1
@@ -1562,10 +1562,10 @@ var init_plugins = __esm({
       "0x%x+"
       // hex literal (loose; matched only when combined w/ above in practice)
     ];
-    SS_DEPRECATED_TAG = "writ-deprecated-endpoint-block";
+    SS_DEPRECATED_TAG = "x-security-deprecated-endpoint-block";
     DEFAULT_BURST_MULTIPLIER = 3;
     DEFAULT_BURST_MINIMUM_HEADROOM = 20;
-    SS_PER_ROUTE_RATELIMIT_TAG_PREFIX = "writ-per-route-ratelimit";
+    SS_PER_ROUTE_RATELIMIT_TAG_PREFIX = "x-security-per-route-ratelimit";
     SEMANTIC_TO_JSON = {
       string: { type: "string" },
       integer: { type: "integer" },
@@ -1709,7 +1709,7 @@ function buildBolaRule(endpoint, param, method, ruleId, kind, profile) {
     return m3[1] === param ? "([^/?]+)" : "[^/]+";
   }).join("/");
   const captureRx = `^(?:/[^/]+)?/${rebuilt}(?:[/?]|$)`;
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const term = profile.legalCollections.has("user") ? "" : ' "t:none"';
   return [
     header2(
@@ -1717,13 +1717,13 @@ function buildBolaRule(endpoint, param, method, ruleId, kind, profile) {
 lifted from W13-C identity-conf; emitted because authorization.rules
 declares request.params.${param} equals principal.id (BOLA defense).`
     ),
-    `SecRule REQUEST_METHOD "@streq ${method}" "id:${ruleId},phase:1,deny,status:403,log,auditlog,msg:'Writ B1: BOLA-${kind} denied (path-${param} != ${TRUSTED_PRINCIPAL_HEADER})',tag:'${esc(tag2)}',tag:'writ/b1/bola-${kind}',chain"`,
+    `SecRule REQUEST_METHOD "@streq ${method}" "id:${ruleId},phase:1,deny,status:403,log,auditlog,msg:'x-security B1: BOLA-${kind} denied (path-${param} != ${TRUSTED_PRINCIPAL_HEADER})',tag:'${esc(tag2)}',tag:'x-security/b1/bola-${kind}',chain"`,
     `  SecRule REQUEST_URI "@rx ${escRx(captureRx)}" "capture,chain"`,
     `    SecRule TX:1 "!@streq %{REQUEST_HEADERS.${TRUSTED_PRINCIPAL_HEADER}}"${term}`
   ].join("\n");
 }
 function buildBflaRules(endpoint, role, baseId, profile) {
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const term = profile.legalCollections.has("user") ? "" : ' "t:none"';
   const escapedPath = endpoint.path.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
   const withParams = escapedPath.replace(/\\\{[^/]+?\\\}/g, "[^/]+");
@@ -1737,7 +1737,7 @@ function buildBflaRules(endpoint, role, baseId, profile) {
 case (a): no authenticated principal. Upstream gate should have
 returned 401, but we deny defensively in case the gate is bypassed.`
       ),
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idMissing},phase:1,deny,status:403,log,auditlog,msg:'Writ B1: BFLA denied (${role}-only route, no authenticated principal)',tag:'${esc(tag2)}',tag:'writ/b1/bfla',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idMissing},phase:1,deny,status:403,log,auditlog,msg:'x-security B1: BFLA denied (${role}-only route, no authenticated principal)',tag:'${esc(tag2)}',tag:'x-security/b1/bfla',chain"`,
       `  SecRule REQUEST_URI "@rx ${escRx(pathRx)}" "chain"`,
       `    SecRule &REQUEST_HEADERS:${TRUSTED_PRINCIPAL_HEADER} "@eq 0"${term}`
     ].join("\n"),
@@ -1746,7 +1746,7 @@ returned 401, but we deny defensively in case the gate is bypassed.`
         `B1: BFLA \u2014 ${endpoint.method} ${endpoint.path}
 case (b): authenticated but ${TRUSTED_PRINCIPAL_HEADER} != '${role}'.`
       ),
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idNonRole},phase:1,deny,status:403,log,auditlog,msg:'Writ B1: BFLA denied (${role}-only route, non-${role} principal)',tag:'${esc(tag2)}',tag:'writ/b1/bfla',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idNonRole},phase:1,deny,status:403,log,auditlog,msg:'x-security B1: BFLA denied (${role}-only route, non-${role} principal)',tag:'${esc(tag2)}',tag:'x-security/b1/bfla',chain"`,
       `  SecRule REQUEST_URI "@rx ${escRx(pathRx)}" "chain"`,
       `    SecRule REQUEST_HEADERS:${TRUSTED_PRINCIPAL_HEADER} "!@streq ${role}" "t:none"`
     ].join("\n")
@@ -1823,7 +1823,7 @@ function buildCorsRules(endpoint, profile = CORAZA_GO_PROFILE) {
   if (!cors || !Array.isArray(cors.allowedOrigins) || cors.allowedOrigins.length === 0) {
     return [];
   }
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm(profile);
   const slot = endpointHash3(endpoint.method, endpoint.path) % 1e3;
@@ -1839,7 +1839,7 @@ msg carries the literal substring 'id:339' so scorer attribution
 (scoring_lib/attribution.py) maps the firing to cors-policy regardless
 of audit-log format (libmodsec3 writes [id "339NNN"], not id:339NNN).`
       ),
-      `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${originId},phase:1,deny,status:403,msg:'Writ id:339 CORS origin not allowed',tag:'${esc2(tag2)}',tag:'writ-cors-policy',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${originId},phase:1,deny,status:403,msg:'x-security id:339 CORS origin not allowed',tag:'${esc2(tag2)}',tag:'x-security-cors-policy',chain"`,
       `  SecRule &REQUEST_HEADERS:Origin "@gt 0" "chain"`,
       `    SecRule REQUEST_HEADERS:Origin "!@rx ${esc2(originRx)}"${term}`
     ].join("\n")
@@ -1854,7 +1854,7 @@ of audit-log format (libmodsec3 writes [id "339NNN"], not id:339NNN).`
 phase:1 \u2014 on OPTIONS, deny when Access-Control-Request-Method is set
 and not in allowedMethods. msg carries 'id:332' for attribution.`
       ),
-      `SecRule REQUEST_METHOD "@streq OPTIONS" "id:${preflightMethodId},phase:1,deny,status:403,msg:'Writ id:332 CORS preflight method not allowed',tag:'${esc2(tag2)}',tag:'writ-cors-policy',chain"`,
+      `SecRule REQUEST_METHOD "@streq OPTIONS" "id:${preflightMethodId},phase:1,deny,status:403,msg:'x-security id:332 CORS preflight method not allowed',tag:'${esc2(tag2)}',tag:'x-security-cors-policy',chain"`,
       `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
       `    SecRule REQUEST_HEADERS:Access-Control-Request-Method "!@rx ^(${methodAlt})$"${term}`
     ].join("\n")
@@ -1871,7 +1871,7 @@ phase:1 \u2014 on OPTIONS, deny when Access-Control-Request-Headers is
 anything other than a comma-list of allowedHeaders (case-insensitive).
 RE2-safe: no negative lookahead \u2014 match the allow form and negate.`
         ),
-        `SecRule REQUEST_METHOD "@streq OPTIONS" "id:${preflightHeadersId},phase:1,deny,status:403,msg:'Writ id:332 CORS preflight header not allowed',tag:'${esc2(tag2)}',tag:'writ-cors-policy',chain"`,
+        `SecRule REQUEST_METHOD "@streq OPTIONS" "id:${preflightHeadersId},phase:1,deny,status:403,msg:'x-security id:332 CORS preflight header not allowed',tag:'${esc2(tag2)}',tag:'x-security-cors-policy',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
         `    SecRule REQUEST_HEADERS:Access-Control-Request-Headers "!@rx ${esc2(allowedListRx)}" "t:lowercase${term ? ",t:none" : ""}"`
       ].join("\n")
@@ -1885,7 +1885,7 @@ RE2-safe: no negative lookahead \u2014 match the allow form and negate.`
           `CORS credentials advertisement for ${endpoint.method} ${endpoint.path}
 phase:3 \u2014 setenv Access-Control-Allow-Credentials:true for upstream add_header.`
         ),
-        `SecAction "id:${id},phase:3,pass,nolog,msg:'Writ id:333 CORS credentials true',tag:'${esc2(tag2)}',tag:'writ-cors-policy',setenv:Access-Control-Allow-Credentials=true"`
+        `SecAction "id:${id},phase:3,pass,nolog,msg:'x-security id:333 CORS credentials true',tag:'${esc2(tag2)}',tag:'x-security-cors-policy',setenv:Access-Control-Allow-Credentials=true"`
       ].join("\n")
     );
   }
@@ -1898,7 +1898,7 @@ phase:3 \u2014 setenv Access-Control-Allow-Credentials:true for upstream add_hea
           `CORS expose-headers advertisement for ${endpoint.method} ${endpoint.path}
 phase:3 \u2014 setenv Access-Control-Expose-Headers:<list> for upstream add_header.`
         ),
-        `SecAction "id:${id},phase:3,pass,nolog,msg:'Writ id:334 CORS expose-headers',tag:'${esc2(tag2)}',tag:'writ-cors-policy',setenv:Access-Control-Expose-Headers=${esc2(list2)}"`
+        `SecAction "id:${id},phase:3,pass,nolog,msg:'x-security id:334 CORS expose-headers',tag:'${esc2(tag2)}',tag:'x-security-cors-policy',setenv:Access-Control-Expose-Headers=${esc2(list2)}"`
       ].join("\n")
     );
   }
@@ -1910,7 +1910,7 @@ phase:3 \u2014 setenv Access-Control-Expose-Headers:<list> for upstream add_head
           `CORS max-age advertisement for ${endpoint.method} ${endpoint.path}
 phase:3 \u2014 setenv Access-Control-Max-Age:<seconds> for upstream add_header.`
         ),
-        `SecAction "id:${id},phase:3,pass,nolog,msg:'Writ id:335 CORS max-age',tag:'${esc2(tag2)}',tag:'writ-cors-policy',setenv:Access-Control-Max-Age=${cors.maxAge}"`
+        `SecAction "id:${id},phase:3,pass,nolog,msg:'x-security id:335 CORS max-age',tag:'${esc2(tag2)}',tag:'x-security-cors-policy',setenv:Access-Control-Max-Age=${cors.maxAge}"`
       ].join("\n")
     );
   }
@@ -1965,7 +1965,7 @@ function buildOutputSanitizationRules(endpoint, profile = CORAZA_GO_PROFILE, war
     });
     return [];
   }
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm2(profile);
   const rules = [];
@@ -1980,7 +1980,7 @@ phase:4 \u2014 deny when RESPONSE_BODY contains a stack-frame shape
 (common across Python / Node / Java / Go runtimes). msg carries 'id:268'
 for scorer attribution.`
         ),
-        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'Writ id:268 output sanitization (stack trace leak)',tag:'${esc3(tag2)}',tag:'writ-output-sanitization',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'x-security id:268 output sanitization (stack trace leak)',tag:'${esc3(tag2)}',tag:'x-security-output-sanitization',chain"`,
         // Match the most common stack-frame markers: `at File.method`,
         // `Traceback (most recent call last):`, `\tat com.example.Foo`,
         // `Exception in thread`, `goroutine \d+ [running]:`.
@@ -1998,7 +1998,7 @@ phase:3 \u2014 strip Server / X-Powered-By response headers. ModSec has no
 native header-rewrite primitive on Coraza-Go (action 'setenv'/'setvar'
 do not touch response headers); we deny the response instead, msg carries 'id:268'.`
         ),
-        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:3,deny,status:500,msg:'Writ id:268 output sanitization (server-version leak)',tag:'${esc3(tag2)}',tag:'writ-output-sanitization',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:3,deny,status:500,msg:'x-security id:268 output sanitization (server-version leak)',tag:'${esc3(tag2)}',tag:'x-security-output-sanitization',chain"`,
         `  SecRule RESPONSE_HEADERS:Server|RESPONSE_HEADERS:X-Powered-By "@rx ^.+$"${term}`
       ].join("\n")
     );
@@ -2012,7 +2012,7 @@ do not touch response headers); we deny the response instead, msg carries 'id:26
 phase:4 \u2014 deny when RESPONSE_BODY exposes raw DB/runtime error keywords
 (SQL state, file paths, "syntax error near"). msg carries 'id:268'.`
         ),
-        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'Writ id:268 output sanitization (raw error leak)',tag:'${esc3(tag2)}',tag:'writ-output-sanitization',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'x-security id:268 output sanitization (raw error leak)',tag:'${esc3(tag2)}',tag:'x-security-output-sanitization',chain"`,
         `  SecRule RESPONSE_BODY "@rx (?i)(?:syntax error near|ORA-\\d+|ER_\\w+|psycopg2\\.|SQLSTATE|\\bENOENT\\b|undefined method|NullPointerException|panic:\\s)"${term}`
       ].join("\n")
     );
@@ -2035,7 +2035,7 @@ function buildDataExposurePiiRules(endpoint, profile = CORAZA_GO_PROFILE, warnin
     ([name, spec]) => spec?.pii === true || isSensitiveFieldName(name)
   );
   if (sensitiveFields.length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm2(profile);
   const rules = [];
@@ -2049,8 +2049,8 @@ function buildDataExposurePiiRules(endpoint, profile = CORAZA_GO_PROFILE, warnin
 phase:4 \u2014 deny when sensitive-named field appears in RESPONSE_BODY with
 a non-empty string value. msg carries 'id:428' for scorer attribution.`
         ),
-        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'Writ id:428 data-exposure: response leaked sensitive field ${esc3(field)}',tag:'${esc3(tag2)}',tag:'writ-data-exposure',chain"`,
-        `    SecRule RESPONSE_BODY "@rx \\"${esc3(field)}\\"\\s*:\\s*\\"[^\\"]+\\""${term}`
+        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'x-security id:428 data-exposure: response leaked sensitive field ${esc3(field)}',tag:'${esc3(tag2)}',tag:'x-security-data-exposure',chain"`,
+        `    SecRule RESPONSE_BODY "@rx \\x22${esc3(field)}\\x22\\s*:\\s*\\x22[^\\x22]+\\x22"${term}`
       ].join("\n")
     );
   }
@@ -2100,7 +2100,7 @@ function header5(comment) {
 function buildLifecycleRules(endpoint, _profile = CORAZA_GO_PROFILE) {
   const policy = endpoint.policy;
   const rules = [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const slot = endpointHash3(endpoint.method, endpoint.path) % 1e3;
   if (policy.deprecated === true) {
     const id = DEPRECATED_BASE_ID + slot;
@@ -2109,9 +2109,9 @@ function buildLifecycleRules(endpoint, _profile = CORAZA_GO_PROFILE) {
         header5(
           `lifecycle: endpoint deprecated for ${endpoint.method} ${endpoint.path}
 phase:1 \u2014 deny with HTTP 410 Gone per RFC 8594 deprecation disposition.
-msg carries 'id:269' substring for scorer attribution (writ-lifecycle-410).`
+msg carries 'id:269' substring for scorer attribution (x-security-lifecycle-410).`
         ),
-        `SecAction "id:${id},phase:1,deny,status:410,msg:'Writ id:269 endpoint deprecated',tag:'${esc4(tag2)}',tag:'writ-lifecycle-410'"`
+        `SecAction "id:${id},phase:1,deny,status:410,msg:'x-security id:269 endpoint deprecated',tag:'${esc4(tag2)}',tag:'x-security-lifecycle-410'"`
       ].join("\n")
     );
   }
@@ -2122,9 +2122,9 @@ msg carries 'id:269' substring for scorer attribution (writ-lifecycle-410).`
         header5(
           `lifecycle: Sunset header for ${endpoint.method} ${endpoint.path}
 phase:3 \u2014 setenv:Sunset=<iso> so the upstream proxy can add_header it.
-msg carries 'id:270' substring (writ-lifecycle-sunset).`
+msg carries 'id:270' substring (x-security-lifecycle-sunset).`
         ),
-        `SecAction "id:${id},phase:3,pass,nolog,msg:'Writ id:270 sunset header',tag:'${esc4(tag2)}',tag:'writ-lifecycle-sunset',setenv:Sunset=${esc4(policy.sunsetDate)}"`
+        `SecAction "id:${id},phase:3,pass,nolog,msg:'x-security id:270 sunset header',tag:'${esc4(tag2)}',tag:'x-security-lifecycle-sunset',setenv:Sunset=${esc4(policy.sunsetDate)}"`
       ].join("\n")
     );
   }
@@ -2136,9 +2136,9 @@ msg carries 'id:270' substring (writ-lifecycle-sunset).`
         header5(
           `lifecycle: Link successor-version for ${endpoint.method} ${endpoint.path}
 phase:3 \u2014 setenv:Link=<replacement>; rel="successor-version" per RFC 8594.
-msg carries 'id:271' substring (writ-lifecycle-replacement).`
+msg carries 'id:271' substring (x-security-lifecycle-replacement).`
         ),
-        `SecAction "id:${id},phase:3,pass,nolog,msg:'Writ id:271 replacement endpoint',tag:'${esc4(tag2)}',tag:'writ-lifecycle-replacement',setenv:Link=${esc4(linkValue)}"`
+        `SecAction "id:${id},phase:3,pass,nolog,msg:'x-security id:271 replacement endpoint',tag:'${esc4(tag2)}',tag:'x-security-lifecycle-replacement',setenv:Link=${esc4(linkValue)}"`
       ].join("\n")
     );
   }
@@ -2174,7 +2174,7 @@ function buildCsrfRules(endpoint, profile = CORAZA_GO_PROFILE) {
   const csrf = endpoint.policy.csrf;
   if (!csrf) return [];
   if (!STATE_CHANGING.has(endpoint.method.toUpperCase())) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm3(profile);
   const slot = endpointHash3(endpoint.method, endpoint.path) % 1e3;
@@ -2189,9 +2189,9 @@ function buildCsrfRules(endpoint, profile = CORAZA_GO_PROFILE) {
         header6(
           `csrf: origin-check for ${endpoint.method} ${endpoint.path}
 phase:1 \u2014 deny when Origin missing or not in allowedOrigins.
-msg carries 'id:272' substring (writ-csrf).`
+msg carries 'id:272' substring (x-security-csrf).`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'Writ id:272 CSRF origin not allowed',tag:'${esc5(tag2)}',tag:'writ-csrf',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'x-security id:272 CSRF origin not allowed',tag:'${esc5(tag2)}',tag:'x-security-csrf',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
         `    SecRule REQUEST_HEADERS:Origin "!@rx ${esc5(originRx)}"${term}`
       ].join("\n")
@@ -2202,14 +2202,14 @@ msg carries 'id:272' substring (writ-csrf).`
     if (!cookieName || !headerName) return [];
     const captureId = CSRF_BASE_ID + 1e3 + slot;
     const denyId = CSRF_BASE_ID + 2e3 + slot;
-    const txVar = `writ_csrf_${slot}`;
+    const txVar = `x_security_csrf_${slot}`;
     rules.push(
       [
         header6(
           `csrf: double-submit capture for ${endpoint.method} ${endpoint.path}
 phase:1 \u2014 capture cookie '${esc5(cookieName)}' into TX:${txVar} for the equality check.`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${captureId},phase:1,pass,nolog,tag:'${esc5(tag2)}',tag:'writ-csrf',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${captureId},phase:1,pass,nolog,tag:'${esc5(tag2)}',tag:'x-security-csrf',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
         `    SecRule REQUEST_COOKIES:${cookieName} "@rx .+" "capture,setvar:tx.${txVar}=%{MATCHED_VAR}${term ? ",t:none" : ""}"`
       ].join("\n")
@@ -2219,9 +2219,9 @@ phase:1 \u2014 capture cookie '${esc5(cookieName)}' into TX:${txVar} for the equ
         header6(
           `csrf: double-submit verify for ${endpoint.method} ${endpoint.path}
 phase:1 \u2014 deny when header '${esc5(headerName)}' missing OR != TX:${txVar}.
-msg carries 'id:272' substring (writ-csrf).`
+msg carries 'id:272' substring (x-security-csrf).`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${denyId},phase:1,deny,status:403,msg:'Writ id:272 CSRF token mismatch',tag:'${esc5(tag2)}',tag:'writ-csrf',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${denyId},phase:1,deny,status:403,msg:'x-security id:272 CSRF token mismatch',tag:'${esc5(tag2)}',tag:'x-security-csrf',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
         `    SecRule REQUEST_HEADERS:${headerName} "!@streq %{TX.${txVar}}"${term}`
       ].join("\n")
@@ -2235,9 +2235,9 @@ msg carries 'id:272' substring (writ-csrf).`
         header6(
           `csrf: custom-header for ${endpoint.method} ${endpoint.path}
 phase:1 \u2014 deny when '${esc5(headerName)}' header missing/empty.
-msg carries 'id:272' substring (writ-csrf).`
+msg carries 'id:272' substring (x-security-csrf).`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'Writ id:272 CSRF custom header missing',tag:'${esc5(tag2)}',tag:'writ-csrf',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'x-security id:272 CSRF custom header missing',tag:'${esc5(tag2)}',tag:'x-security-csrf',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
         `    SecRule &REQUEST_HEADERS:${headerName} "@eq 0"${term}`
       ].join("\n")
@@ -2270,7 +2270,7 @@ function buildDuplicateParamRules(endpoint, profile = CORAZA_GO_PROFILE) {
   const req = endpoint.policy.request;
   if (!req || req.duplicateParamPolicy !== "reject") return [];
   if (!req.schema) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm4(profile);
   const rules = [];
@@ -2283,9 +2283,9 @@ function buildDuplicateParamRules(endpoint, profile = CORAZA_GO_PROFILE) {
         header7(
           `request.duplicateParamPolicy=reject for ${endpoint.method} ${endpoint.path} field=${field}
 phase:2 \u2014 deny when ARGS:${field} appears more than once (HPP defense).
-msg carries 'id:275' substring (writ-hpp-reject).`
+msg carries 'id:275' substring (x-security-hpp-reject).`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ id:275 duplicate parameter ${esc6(field)}',tag:'${esc6(tag2)}',tag:'writ-hpp-reject',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security id:275 duplicate parameter ${esc6(field)}',tag:'${esc6(tag2)}',tag:'x-security-hpp-reject',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
         `    SecRule &ARGS:${field} "@gt 1"${term}`
       ].join("\n")
@@ -2316,7 +2316,7 @@ function chainTerm5(profile) {
 function buildResponseContentTypeRules(endpoint, profile = CORAZA_GO_PROFILE) {
   const resp = endpoint.policy.response;
   if (!resp || !Array.isArray(resp.contentType) || resp.contentType.length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm5(profile);
   const slot = endpointHash3(endpoint.method, endpoint.path) % 1e3;
@@ -2328,9 +2328,9 @@ function buildResponseContentTypeRules(endpoint, profile = CORAZA_GO_PROFILE) {
       header8(
         `response.contentType allowlist for ${endpoint.method} ${endpoint.path}
 phase:3 \u2014 deny when RESPONSE_HEADERS:Content-Type not in allowlist.
-msg carries 'id:276' substring (writ-response-ct).`
+msg carries 'id:276' substring (x-security-response-ct).`
       ),
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:3,deny,status:500,msg:'Writ id:276 response content-type not allowed',tag:'${esc7(tag2)}',tag:'writ-response-ct',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:3,deny,status:500,msg:'x-security id:276 response content-type not allowed',tag:'${esc7(tag2)}',tag:'x-security-response-ct',chain"`,
       `  SecRule REQUEST_FILENAME "@rx ${pathRx}" "chain"`,
       `    SecRule RESPONSE_HEADERS:Content-Type "!@rx ${esc7(allowRx)}"${term}`
     ].join("\n")
@@ -2422,10 +2422,10 @@ PARTIAL \u2014 edge serialization only: a crude same-key cap in a 1s window,
 NOT an in-handler mutex. Does NOT provide transaction atomicity.`
       ),
       // 1. open + increment the same-key counter for a 1s edge window.
-      `SecRule REQUEST_URI "@rx ${pathRx}" "id:${initId},phase:1,pass,nolog,tag:'writ-serialize',initcol:${initcolArg},setvar:${col}.${varName}=+1,expirevar:${col}.${varName}=1,chain"`,
+      `SecRule REQUEST_URI "@rx ${pathRx}" "id:${initId},phase:1,pass,nolog,tag:'x-security-serialize',initcol:${initcolArg},setvar:${col}.${varName}=+1,expirevar:${col}.${varName}=1,chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${term}`,
       // 2. deny when the same-key in-window count exceeds the concurrency cap.
-      `SecRule REQUEST_URI "@rx ${pathRx}" "id:${checkId},phase:1,deny,status:429,msg:'Writ: serializeBy concurrency cap (${limit}) exceeded (edge serialization, not in-handler atomicity)',tag:'writ-serialize',log,chain"`,
+      `SecRule REQUEST_URI "@rx ${pathRx}" "id:${checkId},phase:1,deny,status:429,msg:'x-security: serializeBy concurrency cap (${limit}) exceeded (edge serialization, not in-handler atomicity)',tag:'x-security-serialize',log,chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule ${col.toUpperCase()}:${varName} "@gt ${limit}"${term}`
     ].join("\n")
@@ -2452,7 +2452,7 @@ introspection meta-fields __schema / __type. A WAF cannot fully
 validate GraphQL semantics, but the introspection token check is
 genuinely enforcing at the byte level.`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: GraphQL introspection disabled',tag:'writ-graphql',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: GraphQL introspection disabled',tag:'x-security-graphql',chain"`,
         `  SecRule REQUEST_URI "@rx ${pathRx}" "chain"`,
         `    SecRule REQUEST_BODY|ARGS "@rx (?i)__(?:schema|type)\\b"${term}`
       ].join("\n")
@@ -2468,7 +2468,7 @@ genuinely enforcing at the byte level.`
 PARTIAL \u2014 crude non-parsing alias-token count (heuristic): deny when
 >${g5.maxAliases} alias-shaped '<ident>:' tokens appear in the body.`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: GraphQL alias cap (${g5.maxAliases}) exceeded',tag:'writ-graphql',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: GraphQL alias cap (${g5.maxAliases}) exceeded',tag:'x-security-graphql',chain"`,
         `  SecRule REQUEST_URI "@rx ${pathRx}" "chain"`,
         `    SecRule REQUEST_BODY "@rx (?s)(?:[A-Za-z_][A-Za-z0-9_]*\\s*:\\s*[A-Za-z_][A-Za-z0-9_]*[^:]*){${min},}"${term}`
       ].join("\n")
@@ -2491,9 +2491,9 @@ PARTIAL \u2014 crude non-parsing alias-token count (heuristic): deny when
 PARTIAL \u2014 crude non-parsing batch count: deny when >${g5.batchLimit}
 '"query"' members appear (batched array of operations).`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: GraphQL batch cap (${g5.batchLimit}) exceeded',tag:'writ-graphql',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: GraphQL batch cap (${g5.batchLimit}) exceeded',tag:'x-security-graphql',chain"`,
         `  SecRule REQUEST_URI "@rx ${pathRx}" "chain"`,
-        `    SecRule REQUEST_BODY "@rx (?s)(?:\\"query\\"\\s*:[^:]*){${min},}"${term}`
+        `    SecRule REQUEST_BODY "@rx (?s)(?:\\x22query\\x22\\s*:[^:]*){${min},}"${term}`
       ].join("\n")
     );
     warnings?.push({
@@ -2536,7 +2536,7 @@ function buildResidualScaffolding(endpoint) {
 OVERRIDE-ONLY \u2014 SCAFFOLDING, NOT ENFORCED.
 Per-resolver authorization requires an operator-supplied GraphQL-aware
 processor: a WAF cannot parse the query, bind the resolved object to an
-identity claim, and evaluate ownership/role per operation. Writ
+identity claim, and evaluate ownership/role per operation. x-security
 emits NO enforcing SecRule for these. Operator contract \u2014 wire each
 operation's authz in your GraphQL gateway / resolver middleware:
 ` + named
@@ -2588,7 +2588,7 @@ function supportsStatefulNamedCollection(profile) {
 function buildPasswordPolicyRules(endpoint, profile = CORAZA_GO_PROFILE) {
   const pol = endpoint.policy.authentication?.passwordPolicy;
   if (!pol) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seedBase = endpointHash3(endpoint.method, `${endpoint.path}|pwpolicy`);
   const term = chainTerm7(profile);
@@ -2616,7 +2616,7 @@ function buildPasswordPolicyRules(endpoint, profile = CORAZA_GO_PROFILE) {
 Body-carried password strength (API2:2023). PCRE !@rx on the password
 field \u2014 rejects a present-but-weak password. FULL (plain @rx).`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'Writ: ${esc9(c5.reason)}',tag:'${esc9(tag2)}',tag:'writ-rule-password-policy',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'x-security: ${esc9(c5.reason)}',tag:'${esc9(tag2)}',tag:'x-security-rule-password-policy',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "chain"`,
         `    SecRule ${selector} "!@rx ${escRx2(c5.rx)}"${term}`
       ].join("\n")
@@ -2628,7 +2628,7 @@ field \u2014 rejects a present-but-weak password. FULL (plain @rx).`
     out.push(
       [
         header10(`v0.7 passwordPolicy: blocklisted password for ${endpoint.method} ${endpoint.path}`),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'Writ: password is on the blocklist',tag:'${esc9(tag2)}',tag:'writ-rule-password-policy',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'x-security: password is on the blocklist',tag:'${esc9(tag2)}',tag:'x-security-rule-password-policy',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "chain"`,
         `    SecRule ${selector} "@rx ${escRx2(`(?i)^(?:${alt})$`)}"${term}`
       ].join("\n")
@@ -2658,7 +2658,7 @@ function buildAccountLockoutRules(endpoint, profile = CORAZA_GO_PROFILE, warning
     });
     return [];
   }
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const window2 = parseDurationSec(lock.window) || 900;
   const { expansion, keyPhase } = lockoutVar(lock.identifier);
@@ -2679,7 +2679,7 @@ populated); increment at phase:5 on a >=400 auth response. FULL on ${profile.nam
       `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base},phase:${keyPhase},pass,nolog,tag:'${esc9(tag2)}',${initcol},chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${term}`,
       // 2. Deny while locked out — counter already over budget.
-      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base + 1},phase:${keyPhase},deny,status:429,log,msg:'Writ: account locked (>${lock.attempts} failed logins / ${esc9(lock.window)})',tag:'${esc9(tag2)}',tag:'writ-rule-account-lockout',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base + 1},phase:${keyPhase},deny,status:429,log,msg:'x-security: account locked (>${lock.attempts} failed logins / ${esc9(lock.window)})',tag:'${esc9(tag2)}',tag:'x-security-rule-account-lockout',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule GLOBAL:${counterKey} "@gt ${lock.attempts}"${term}`,
       // 3. On a failed-auth response (>=400), increment + refresh the TTL (phase:5).
@@ -2702,7 +2702,7 @@ function buildForbidArrayRootRules(endpoint, profile = CORAZA_GO_PROFILE, warnin
     });
     return [];
   }
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(endpoint.method, `${endpoint.path}|arrayroot`);
   const id = FORBID_ARRAY_ROOT_BASE_ID + seed % 999;
@@ -2715,7 +2715,7 @@ JSON-hijacking defense (API3:2023). phase:4 RESPONSE_BODY @rx on the first
 non-whitespace byte; an array-rooted body is denied (wrap in an object instead).
 FULL on ${profile.name} (supportsResponseBodyAccess).`
       ),
-      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'Writ: bare top-level JSON array response (forbidArrayRoot)',tag:'${esc9(tag2)}',tag:'writ-rule-forbid-array-root',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'x-security: bare top-level JSON array response (forbidArrayRoot)',tag:'${esc9(tag2)}',tag:'x-security-rule-forbid-array-root',chain"`,
       `  SecRule RESPONSE_BODY "@rx ^[\\s\\xef\\xbb\\xbf]*\\["${term}`
     ].join("\n")
   ];
@@ -2724,7 +2724,7 @@ function buildIdempotencyKeyRules(endpoint, profile = CORAZA_GO_PROFILE, warning
   const idem = endpoint.policy.request?.idempotencyKey;
   if (!idem) return [];
   const epId = `${endpoint.method} ${endpoint.path}`;
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const ttl = parseDurationSec(idem.ttl) || 300;
   const seed = endpointHash3(endpoint.method, `${endpoint.path}|idempotency`);
@@ -2739,7 +2739,7 @@ function buildIdempotencyKeyRules(endpoint, profile = CORAZA_GO_PROFILE, warning
         `v0.7 idempotencyKey: require header ${idem.header} for ${endpoint.method} ${endpoint.path}
 (API6:2023). Header-presence check \u2014 FULL on ${profile.name}.`
       ),
-      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base},phase:1,deny,status:400,log,msg:'Writ: missing ${esc9(idem.header)} header',tag:'${esc9(tag2)}',tag:'writ-rule-idempotency-key',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base},phase:1,deny,status:400,log,msg:'x-security: missing ${esc9(idem.header)} header',tag:'${esc9(tag2)}',tag:'x-security-rule-idempotency-key',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule &REQUEST_HEADERS:${esc9(idem.header)} "@eq 0"${term}`
     ].join("\n")
@@ -2771,7 +2771,7 @@ flight races (no atomic check-and-set at the WAF; handle that in the store).`
       `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base + 2},phase:1,pass,nolog,tag:'${esc9(tag2)}',setvar:global.${counterKey}=+1,expirevar:global.${counterKey}=${ttl},chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${term}`,
       // Deny the replay — second+ request with this key inside the ttl window.
-      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base + 3},phase:1,deny,status:409,log,msg:'Writ: replayed idempotency key (${esc9(idem.header)})',tag:'${esc9(tag2)}',tag:'writ-rule-idempotency-key',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${base + 3},phase:1,deny,status:409,log,msg:'x-security: replayed idempotency key (${esc9(idem.header)})',tag:'${esc9(tag2)}',tag:'x-security-rule-idempotency-key',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule GLOBAL:${counterKey} "@gt 1"${term}`
     ].join("\n")
@@ -2781,7 +2781,7 @@ flight races (no atomic check-and-set at the WAF; handle that in the store).`
 function buildLoggingRules(endpoint, profile = CORAZA_GO_PROFILE) {
   const log = endpoint.policy.logging;
   if (!log || !Array.isArray(log.events) || log.events.length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(endpoint.method, `${endpoint.path}|logging`);
   const id = LOGGING_BASE_ID + seed % 999;
@@ -2791,7 +2791,7 @@ function buildLoggingRules(endpoint, profile = CORAZA_GO_PROFILE) {
   const notes = [];
   notes.push(`events declared: ${log.events.join(", ")}`);
   notes.push(`auth-failure / authz-deny / injection-block / rate-limit-trip are`);
-  notes.push(`already audit-logged by the corresponding Writ deny rules.`);
+  notes.push(`already audit-logged by the corresponding x-security deny rules.`);
   if (log.sink && log.sink !== "stdout") {
     notes.push(`sink='${log.sink}' is NOT enforced at the WAF \u2014 configure it at the`);
     notes.push(`log-shipping layer (SecAuditLogStorageDir + syslog/fluent-bit sidecar).`);
@@ -2813,7 +2813,7 @@ function buildLoggingRules(endpoint, profile = CORAZA_GO_PROFILE) {
           `v0.7 logging (SSEC-AUDIT): force audit log for ${endpoint.method} ${endpoint.path}
 ` + notes.join("\n")
         ),
-        `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${id},phase:5,pass,log,auditlog,msg:'Writ: audit (request/response) for ${esc9(endpoint.method)} ${esc9(endpoint.path)}',tag:'${esc9(tag2)}',tag:'writ-audit'${partsCtl},chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx2(rx)}" "id:${id},phase:5,pass,log,auditlog,msg:'x-security: audit (request/response) for ${esc9(endpoint.method)} ${esc9(endpoint.path)}',tag:'${esc9(tag2)}',tag:'x-security-audit'${partsCtl},chain"`,
         `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${term}`
       ].join("\n")
     );
@@ -2907,7 +2907,7 @@ function buildContentType(ctx, allowed, profile = CORAZA_GO_PROFILE) {
   const term = chainTerm8(profile);
   return [
     header11(`request.contentType allowlist for ${endpoint.method} ${endpoint.path}`),
-    `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:415,msg:'Writ: unsupported Content-Type',tag:'${esc10(tag2)}',chain"`,
+    `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:415,msg:'x-security: unsupported Content-Type',tag:'${esc10(tag2)}',chain"`,
     `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
     `    SecRule REQUEST_HEADERS:Content-Type "!@rx ^(${alt})(;.*)?$"${term}`
   ].join("\n");
@@ -2918,7 +2918,7 @@ function buildBodySize(ctx, bytes, profile = CORAZA_GO_PROFILE) {
   const term = chainTerm8(profile);
   return [
     header11(`request.maxBodySize=${bytes} bytes for ${endpoint.method} ${endpoint.path}`),
-    `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:413,msg:'Writ: request body exceeds endpoint limit',tag:'${esc10(tag2)}',chain"`,
+    `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:413,msg:'x-security: request body exceeds endpoint limit',tag:'${esc10(tag2)}',chain"`,
     `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
     `    SecRule REQUEST_HEADERS:Content-Length "@gt ${bytes}"${term}`
   ].join("\n");
@@ -2930,7 +2930,7 @@ function buildAuth(ctx, headerName, profile = CORAZA_GO_PROFILE) {
   const term = chainTerm8(profile);
   return [
     header11(`authentication required (${hdr}) for ${endpoint.method} ${endpoint.path}`),
-    `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:401,msg:'Writ: missing ${esc10(hdr)} header',tag:'${esc10(tag2)}',chain"`,
+    `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:401,msg:'x-security: missing ${esc10(hdr)} header',tag:'${esc10(tag2)}',chain"`,
     `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
     `    SecRule &REQUEST_HEADERS:${hdr} "@eq 0"${term}`
   ].join("\n");
@@ -2946,7 +2946,7 @@ function buildIpPolicy(ctx, ipPolicy, profile = CORAZA_GO_PROFILE) {
     out.push(
       [
         header11(`ipPolicy.allow for ${endpoint.method} ${endpoint.path}`),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'Writ: source IP not in allowlist',tag:'${esc10(tag2)}',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'x-security: source IP not in allowlist',tag:'${esc10(tag2)}',chain"`,
         `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
         `    SecRule REMOTE_ADDR "!@ipMatch ${allow.join(",")}"${term}`
       ].join("\n")
@@ -2957,7 +2957,7 @@ function buildIpPolicy(ctx, ipPolicy, profile = CORAZA_GO_PROFILE) {
     out.push(
       [
         header11(`ipPolicy.deny for ${endpoint.method} ${endpoint.path}`),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'Writ: source IP in denylist',tag:'${esc10(tag2)}',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'x-security: source IP in denylist',tag:'${esc10(tag2)}',chain"`,
         `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
         `    SecRule REMOTE_ADDR "@ipMatch ${deny.join(",")}"${term}`
       ].join("\n")
@@ -3085,7 +3085,7 @@ pattern: initcol \u2192 setvar/expirevar \u2192 @gt check (Coraza v3 collection
     `SecRule REQUEST_URI "@rx ${pathRx}" "id:${counterId},phase:1,pass,nolog,tag:'${esc10(tag2)}',setvar:${col}.${counterKey}=+1,expirevar:${col}.${counterKey}=${window2},chain"`,
     `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${chainTerm9}`,
     // 3. check — deny when counter exceeds the configured limit.
-    `SecRule REQUEST_URI "@rx ${pathRx}" "id:${checkId},phase:1,deny,status:429,msg:'Writ: rate limit exceeded (${rl.requests}/${esc10(rl.window)})',tag:'${esc10(tag2)}',log,chain"`,
+    `SecRule REQUEST_URI "@rx ${pathRx}" "id:${checkId},phase:1,deny,status:429,msg:'x-security: rate limit exceeded (${rl.requests}/${esc10(rl.window)})',tag:'${esc10(tag2)}',log,chain"`,
     `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
     `    SecRule ${col.toUpperCase()}:${counterKey} "@gt ${rl.requests}"${chainTerm9}`
   ];
@@ -3102,7 +3102,7 @@ pattern: initcol \u2192 setvar/expirevar \u2192 @gt check (Coraza v3 collection
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${chainTerm9}`,
       `SecRule REQUEST_URI "@rx ${pathRx}" "id:${burstCounterId},phase:1,pass,nolog,tag:'${esc10(tag2)}',setvar:${col}.${burstCounterKey}=+1,expirevar:${col}.${burstCounterKey}=1,chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${chainTerm9}`,
-      `SecRule REQUEST_URI "@rx ${pathRx}" "id:${burstCheckId},phase:1,deny,status:429,msg:'Writ: rate limit burst exceeded (${rl.burst}/1s)',tag:'${esc10(tag2)}',log,chain"`,
+      `SecRule REQUEST_URI "@rx ${pathRx}" "id:${burstCheckId},phase:1,deny,status:429,msg:'x-security: rate limit burst exceeded (${rl.burst}/1s)',tag:'${esc10(tag2)}',log,chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule ${col.toUpperCase()}:${burstCounterKey} "@gt ${rl.burst}"${chainTerm9}`
     );
@@ -3120,7 +3120,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.minLength=${ps.minLength} for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} too short',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} too short',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field} "@lt ${ps.minLength}" "t:length"`
         ].join("\n")
@@ -3131,7 +3131,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.maxLength=${ps.maxLength} for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} too long',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} too long',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field} "@gt ${ps.maxLength}" "t:length"`
         ].join("\n")
@@ -3142,7 +3142,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.fixedLength=${ps.fixedLength} for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} wrong length',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} wrong length',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field} "!@eq ${ps.fixedLength}" "t:length"`
         ].join("\n")
@@ -3153,7 +3153,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.min=${ps.min} for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} below min',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} below min',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field} "@lt ${ps.min}"${term}`
         ].join("\n")
@@ -3164,7 +3164,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.max=${ps.max} for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} above max',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} above max',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field} "@gt ${ps.max}"${term}`
         ].join("\n")
@@ -3175,7 +3175,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.pattern for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} pattern mismatch',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} pattern mismatch',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field} "!@rx ${esc10(ps.pattern)}"${term}`
         ].join("\n")
@@ -3188,7 +3188,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
         rules.push(
           [
             header11(`request.schema.${field}.type=${ps.type} for ${endpoint.method} ${endpoint.path}`),
-            `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'Writ: field ${esc10(field)} not ${spec.what}',tag:'${esc10(tag2)}',chain"`,
+            `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:400,msg:'x-security: field ${esc10(field)} not ${spec.what}',tag:'${esc10(tag2)}',chain"`,
             // REQUEST_FILENAME (path-only), not REQUEST_URI (path+query): an
             // anchored `^/path$` against REQUEST_URI never matches once the
             // request carries a query string, so the type check would silently
@@ -3206,7 +3206,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.allowedMimeTypes (request Content-Type) for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${ctId},phase:1,deny,status:415,msg:'Writ: field ${esc10(field)} Content-Type not in allowedMimeTypes',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${ctId},phase:1,deny,status:415,msg:'x-security: field ${esc10(field)} Content-Type not in allowedMimeTypes',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule REQUEST_HEADERS:Content-Type "!@rx ^(${alt})(;.*)?$"${term}`
         ].join("\n")
@@ -3215,7 +3215,7 @@ function buildSchemaRules(ctx, schema, profile = CORAZA_GO_PROFILE) {
       rules.push(
         [
           header11(`request.schema.${field}.allowedMimeTypes (multipart part MIME) for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${fileId},phase:2,deny,status:415,msg:'Writ: field ${esc10(field)} upload MIME not allowed',tag:'${esc10(tag2)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${fileId},phase:2,deny,status:415,msg:'x-security: field ${esc10(field)} upload MIME not allowed',tag:'${esc10(tag2)}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule FILES_TMP_CONTENT:${field}|FILES:${field} "!@rx ^(${alt})$"${term}`
         ].join("\n")
@@ -3228,7 +3228,7 @@ function buildSsrfRules(endpoint, profile = CORAZA_GO_PROFILE, phase = 2) {
   const schema = endpoint.policy.request?.schema;
   if (!schema) return [];
   const term = chainTerm8(profile);
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rules = [];
   const slot = endpointHash3(endpoint.method, endpoint.path) % 4500;
   let offset = 0;
@@ -3244,7 +3244,7 @@ function buildSsrfRules(endpoint, profile = CORAZA_GO_PROFILE, phase = 2) {
       rules.push(
         [
           header11(`W19-A SSRF: ${field} must match domainAllowlist for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:${phase},deny,status:403,msg:'Writ: ${esc10(field)} host not in domainAllowlist',tag:'${esc10(tag2)}',tag:'writ-rule-ssrf-403',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:${phase},deny,status:403,msg:'x-security: ${esc10(field)} host not in domainAllowlist',tag:'${esc10(tag2)}',tag:'x-security-rule-ssrf-403',chain"`,
           // W22-B: REQUEST_FILENAME (path-only), not REQUEST_URI. libmodsec3's
           // REQUEST_URI is path *+ query string* — an anchored `^/path$` rx
           // never matches once the endpoint receives the very ?url= it is
@@ -3263,7 +3263,7 @@ function buildSsrfRules(endpoint, profile = CORAZA_GO_PROFILE, phase = 2) {
       rules.push(
         [
           header11(`W19-A SSRF: ${field} blockPrivateRanges for ${endpoint.method} ${endpoint.path}`),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:${phase},deny,status:403,msg:'Writ: ${esc10(field)} resolves to private/loopback host',tag:'${esc10(tag2)}',tag:'writ-rule-ssrf-private-403',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:${phase},deny,status:403,msg:'x-security: ${esc10(field)} resolves to private/loopback host',tag:'${esc10(tag2)}',tag:'x-security-rule-ssrf-private-403',chain"`,
           // W22-B: REQUEST_FILENAME — see comment on the domainAllowlist rule above.
           `  SecRule REQUEST_FILENAME "@rx ${pathRegex(endpoint.path)}" "chain"`,
           // W22-B: escRx — see comment on escRx. Same reasoning as the allowlist rule.
@@ -3281,7 +3281,7 @@ function hasJsonContentType(contentTypes) {
 function buildJsonBodyProcessor(endpoint, profile = CORAZA_GO_PROFILE) {
   const policy = endpoint.policy;
   if (!hasJsonContentType(policy.request?.contentType)) return null;
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const ctlId = BODY_ALLOWLIST_BASE_ID + 1e4 + endpointHash3(endpoint.method, endpoint.path) % 9e3;
   const term = chainTerm8(profile);
   return [
@@ -3320,7 +3320,7 @@ function buildBodyFieldAllowlistRules(endpoint, profile = CORAZA_GO_PROFILE) {
     }
   }
   if (safe.length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const id = BODY_ALLOWLIST_BASE_ID + endpointHash3(endpoint.method, endpoint.path) % 9e3;
   const alt = safe.join("|");
   const argsRegex = `^json\\.(${alt})$`;
@@ -3344,7 +3344,7 @@ function buildBodyFieldAllowlistRules(endpoint, profile = CORAZA_GO_PROFILE) {
   out.push(
     [
       header11(headerLines.join("\n")),
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: request body contains field outside allowlist (mass-assignment)',tag:'${esc10(tag2)}',tag:'writ-api6-mass-assignment',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: request body contains field outside allowlist (mass-assignment)',tag:'${esc10(tag2)}',tag:'x-security-api6-mass-assignment',chain"`,
       `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
       // Content-Type guard: only enforce the json.<key> allowlist when the body
       // is actually JSON. Without this, a POST carrying query-string/form args
@@ -3380,7 +3380,7 @@ function buildResponseInspectionRules(endpoint, profile = CORAZA_GO_PROFILE, war
     reason: `response inspection enabled (phase 4); expect ~10-15% throughput cost on libmodsecurity3 and an extra SPOE round-trip on coraza-spoa. Acceptable for high-value endpoints; disable response.schema on hot paths if latency budget is tight.`,
     detail: { mechanism: "SecResponseBodyAccess", phase: 4 }
   });
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const base = RESPONSE_INSPECT_BASE_ID + endpointHash3(endpoint.method, endpoint.path) % 9e3 * 1;
   const pathRx = pathRegex(endpoint.path);
   const term = chainTerm8(profile);
@@ -3399,16 +3399,16 @@ function buildResponseInspectionRules(endpoint, profile = CORAZA_GO_PROFILE, war
               `C-1 response.schema.${field}.maxLength=${ps.maxLength} for ${endpoint.method} ${endpoint.path}
 phase:4 inspects RESPONSE_BODY for "${field}":"<value of length > ${cap2}>". Heuristic regex-over-JSON; nested / escaped values may not match.`
             ),
-            `SecRule REQUEST_URI "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'Writ: response.${esc10(field)} exceeds maxLength=${ps.maxLength} (data exposure)',tag:'${esc10(tag2)}',tag:'writ-api3-bopla',chain"`,
+            `SecRule REQUEST_URI "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'x-security: response.${esc10(field)} exceeds maxLength=${ps.maxLength} (data exposure)',tag:'${esc10(tag2)}',tag:'x-security-api3-bopla',chain"`,
             `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
-            `    SecRule RESPONSE_BODY "@rx \\"${esc10(field)}\\"\\s*:\\s*\\"[^\\"]{${cap2 + 1},}\\""${term}`
+            `    SecRule RESPONSE_BODY "@rx \\x22${esc10(field)}\\x22\\s*:\\s*\\x22[^\\x22]{${cap2 + 1},}\\x22"${term}`
           ].join("\n")
         );
       }
       if (ps.pattern) {
         const captureId = nextId++;
         const denyId = nextId++;
-        const txVar = `writ_${safeVarName2(field)}`;
+        const txVar = `x_security_${safeVarName2(field)}`;
         rules.push(
           [
             header11(
@@ -3417,7 +3417,7 @@ phase:4 rule A: extract response.${field} value into TX:${txVar} for the inverse
             ),
             `SecRule REQUEST_URI "@rx ${pathRx}" "id:${captureId},phase:4,pass,nolog,chain"`,
             `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
-            `    SecRule RESPONSE_BODY "@rx \\"${esc10(field)}\\"\\s*:\\s*\\"([^\\"]*)\\"" "capture,setvar:tx.${txVar}=%{TX.1}${term ? ",t:none" : ""}"`
+            `    SecRule RESPONSE_BODY "@rx \\x22${esc10(field)}\\x22\\s*:\\s*\\x22([^\\x22]*)\\x22" "capture,setvar:tx.${txVar}=%{TX.1}${term ? ",t:none" : ""}"`
           ].join("\n")
         );
         rules.push(
@@ -3426,7 +3426,7 @@ phase:4 rule A: extract response.${field} value into TX:${txVar} for the inverse
               `C-1 response.schema.${field}.pattern (deny) for ${endpoint.method} ${endpoint.path}
 phase:4 rule B: deny when TX:${txVar} does not match the required pattern (RE2-safe; no lookahead)`
             ),
-            `SecRule TX:${txVar} "!@rx ${esc10(ps.pattern)}" "id:${denyId},phase:4,deny,status:500,msg:'Writ: response.${esc10(field)} pattern mismatch (data exposure)',tag:'${esc10(tag2)}',tag:'writ-api3-bopla'"`
+            `SecRule TX:${txVar} "!@rx ${esc10(ps.pattern)}" "id:${denyId},phase:4,deny,status:500,msg:'x-security: response.${esc10(field)} pattern mismatch (data exposure)',tag:'${esc10(tag2)}',tag:'x-security-api3-bopla'"`
           ].join("\n")
         );
       }
@@ -3440,14 +3440,14 @@ phase:4 rule B: deny when TX:${txVar} does not match the required pattern (RE2-s
           `C-1 stored-XSS guard for ${endpoint.method} ${endpoint.path}
 phase:4 \u2014 response.contentType is application/json, so raw <script> or
 javascript: URIs in the body indicate a stored-XSS echo. msg carries
-'writ-xss-stored' for scorer attribution.`
+'x-security-xss-stored' for scorer attribution.`
         ),
         // REQUEST_FILENAME (path-only) — REQUEST_URI on Coraza/libmodsec3
         // includes the query string, so an anchored `^/path$` rx fails for
         // any request carrying `?foo=bar`. The vAPI XSS attack hits
         // /vapi/stickynotes?format=html; REQUEST_FILENAME strips the query
         // and matches cleanly. (Same fix W22-B applied to the SSRF rules.)
-        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'Writ: stored-XSS payload in JSON response body',tag:'${esc10(tag2)}',tag:'writ-xss-stored',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'x-security: stored-XSS payload in JSON response body',tag:'${esc10(tag2)}',tag:'x-security-xss-stored',chain"`,
         `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
         `    SecRule RESPONSE_BODY "@rx (?i)(?:<script\\b|javascript:)"${term}`
       ].join("\n")
@@ -3486,9 +3486,9 @@ phase:4 denies when the response body contains a top-level JSON key NOT in the d
 Note: this is a deny-on-unknown rule, NOT a strip \u2014 true stripping requires a Lua plugin.
 PCRE-only (uses negative lookahead); RE2-backed engines (coraza-go/spoa) skip this rule.`
             ),
-            `SecRule REQUEST_URI "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'Writ: response contains undeclared field (stripUnknownFields)',tag:'${esc10(tag2)}',tag:'writ-api3-bopla',chain"`,
+            `SecRule REQUEST_URI "@rx ${pathRx}" "id:${id},phase:4,deny,status:500,msg:'x-security: response contains undeclared field (stripUnknownFields)',tag:'${esc10(tag2)}',tag:'x-security-api3-bopla',chain"`,
             `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
-            `    SecRule RESPONSE_BODY "@rx \\"(?!(?:${allowAlt})\\")[A-Za-z_][A-Za-z0-9_]*\\"\\s*:"${term}`
+            `    SecRule RESPONSE_BODY "@rx \\x22(?!(?:${allowAlt})\\x22)[A-Za-z_][A-Za-z0-9_]*\\x22\\s*:"${term}`
           ].join("\n")
         );
       }
@@ -3503,7 +3503,7 @@ function buildSqliHeuristics(endpoint, profile = CORAZA_GO_PROFILE) {
   const policy = endpoint.policy;
   const req = policy.request;
   if (!req || !req.schema) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const term = chainTerm8(profile);
   const out = [];
   for (const [field, ps] of Object.entries(req.schema)) {
@@ -3516,7 +3516,7 @@ function buildSqliHeuristics(endpoint, profile = CORAZA_GO_PROFILE) {
       const m3 = INJECTION_SINK_MATCHERS[sink];
       const idSeed = endpointHash3(`${endpoint.method}|${endpoint.path}|${field}|${sink}`, "");
       const id = INJECTION_GUARD_BASE_ID + idSeed % 9e3;
-      const classTag = `writ-${m3.category}`;
+      const classTag = `x-security-${m3.category}`;
       const ssecId = m3.category === "prompt" ? "SSEC-PROMPT" : "SSEC-INJECTION";
       out.push(
         [
@@ -3525,7 +3525,7 @@ function buildSqliHeuristics(endpoint, profile = CORAZA_GO_PROFILE) {
 Author-declared injectionGuard sink; phase:2 denies the payload at write
 time over the body/query field. Attributed to ${ssecId} by the reporter.`
           ),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: ${m3.msg} detected in ${esc10(field)}',tag:'${esc10(tag2)}',tag:'${classTag}',tag:'${classTag}-${m3.tagSuffix}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: ${m3.msg} detected in ${esc10(field)}',tag:'${esc10(tag2)}',tag:'${classTag}',tag:'${classTag}-${m3.tagSuffix}',chain"`,
           `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
           `    SecRule ARGS:${field}|ARGS:json.${field} "${m3.operator}"${term}`
         ].join("\n")
@@ -3539,7 +3539,7 @@ function buildXssHeuristics(endpoint, profile = CORAZA_GO_PROFILE) {
   const req = policy.request;
   if (!req || !req.schema) return [];
   if (!hasJsonContentType(req.contentType)) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const term = chainTerm8(profile);
   const out = [];
   for (const [field, ps] of Object.entries(req.schema)) {
@@ -3554,7 +3554,7 @@ phase:2 \u2014 denies when the free-text field carries a literal <script tag
 or javascript: URI. Stops the payload at write time so the GET-side echo
 (which coraza-spoa cannot inspect \u2014 no response body via SPOE) is moot.`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: stored-XSS payload in ${esc10(field)}',tag:'${esc10(tag2)}',tag:'writ-xss-stored',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: stored-XSS payload in ${esc10(field)}',tag:'${esc10(tag2)}',tag:'x-security-xss-stored',chain"`,
         `  SecRule REQUEST_URI "@rx ${pathRegex(endpoint.path)}" "chain"`,
         `    SecRule ARGS:json.${field} "@rx (?i)(?:<script\\b|javascript:)"${term}`
       ].join("\n")
@@ -3565,7 +3565,7 @@ or javascript: URI. Stops the payload at write time so the GET-side echo
 function buildPolicyRules(endpoint, profile = CORAZA_GO_PROFILE, warnings) {
   const policy = endpoint.policy;
   const base = ruleBase(endpoint);
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const ctx = { endpoint, base, tag: tag2 };
   const out = [];
   out.push(buildScopeMarker(ctx));
@@ -3637,7 +3637,7 @@ var init_rules = __esm({
     RESPONSE_INSPECT_BASE_ID = 42e4;
     SLOT = {
       scope: 0,
-      // path/method match flag (tx.writ_match)
+      // path/method match flag (tx.x_security_match)
       ctype: 1,
       // content-type allowlist
       bodySize: 2,
@@ -3942,7 +3942,7 @@ function buildHaproxyStickTables(spec, engine, warnings, peers = []) {
       const key = resolveKey(rl, engine, epId);
       if (key.warning) warnings.push(key.warning);
       const slug = slugify(ep.method, ep.path) + (rls.length > 1 ? `_${idx}` : "");
-      const backendName = `st_writ_${slug}`;
+      const backendName = `st_x_security_${slug}`;
       if (seenBackends.has(backendName)) return;
       seenBackends.add(backendName);
       const peersClause = peers.length > 0 ? ` peers ${PEER_GROUP}` : "";
@@ -4000,7 +4000,7 @@ ${burstMethodLine}`,
   }
   if (emissions.length === 0) return null;
   const out = [];
-  out.push("# Writ \u2192 HAProxy stick-tables \u2014 auto-generated. DO NOT EDIT BY HAND.");
+  out.push("# x-security \u2192 HAProxy stick-tables \u2014 auto-generated. DO NOT EDIT BY HAND.");
   out.push(`# engine:    ${engine}`);
   out.push(`# source:    ${spec.info.title} ${spec.info.version}`);
   out.push("#");
@@ -4011,7 +4011,7 @@ ${burstMethodLine}`,
   out.push("#");
   out.push("# How to integrate into an EXISTING haproxy.cfg:");
   out.push("#");
-  out.push("#   1. Append every `backend st_writ_*` block below to your");
+  out.push("#   1. Append every `backend st_x_security_*` block below to your");
   out.push("#      haproxy.cfg (they are self-contained \u2014 no listener needed).");
   out.push("#   2. Inside your existing `frontend` block, paste the ACL/track/deny");
   out.push('#      snippet from the "WRIT FRONTEND SNIPPET" section.');
@@ -4021,7 +4021,7 @@ ${burstMethodLine}`,
   if (peers.length > 0) {
     out.push("# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
     out.push(`# Peer replication (group: ${PEER_GROUP}) \u2014 ${peers.length} instance(s)`);
-    out.push("# Each stick-table below references `peers writ` so HAProxy");
+    out.push("# Each stick-table below references `peers x-security` so HAProxy");
     out.push("# replicates counters between the listed nodes in near-real-time.");
     out.push("# \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550");
     out.push(`peers ${PEER_GROUP}`);
@@ -4058,7 +4058,7 @@ var init_haproxy_stick_tables = __esm({
   "src/generators/coraza/templates/haproxy-stick-tables.ts"() {
     "use strict";
     init_rules();
-    PEER_GROUP = "writ";
+    PEER_GROUP = "x-security";
   }
 });
 
@@ -4130,7 +4130,7 @@ function buildModsecNginxServerConf(spec) {
   }
   if (!tlsFloor && !ciphers && endpointBlocks.length === 0) return null;
   const lines = [
-    "# Writ \u2192 modsec-nginx server-side directives \u2014 auto-generated.",
+    "# x-security \u2192 modsec-nginx server-side directives \u2014 auto-generated.",
     "# Merge inside your `server { ... }` block (not at http {} scope).",
     `# Source: ${spec.info.title} ${spec.info.version}`,
     ""
@@ -4195,12 +4195,12 @@ function smallestBodyLimit(endpoints) {
 function buildDirectives(spec, profile, warnings) {
   const lines = [];
   if (profile.name === "coraza-go") {
-    lines.push("# Writ \u2192 Coraza v3.x \u2014 auto-generated. DO NOT EDIT BY HAND.");
-    lines.push(`# generator: writ-coraza v${VERSION}`);
+    lines.push("# x-security \u2192 Coraza v3.x \u2014 auto-generated. DO NOT EDIT BY HAND.");
+    lines.push(`# generator: x-security-coraza v${VERSION}`);
     lines.push(`# source: ${spec.info.title} ${spec.info.version}`);
   } else {
-    lines.push("# Writ \u2192 Coraza/ModSecurity \u2014 auto-generated. DO NOT EDIT BY HAND.");
-    lines.push(`# generator: writ-coraza v${VERSION}`);
+    lines.push("# x-security \u2192 Coraza/ModSecurity \u2014 auto-generated. DO NOT EDIT BY HAND.");
+    lines.push(`# generator: x-security-coraza v${VERSION}`);
     lines.push(`# engine:    ${profile.name}`);
     lines.push(`# source:    ${spec.info.title} ${spec.info.version}`);
   }
@@ -4286,20 +4286,20 @@ function buildDirectives(spec, profile, warnings) {
 function buildIncludeSnippet(profile) {
   if (profile.name === "modsec-nginx") {
     return [
-      "# === Writ include for owasp/modsecurity-crs:nginx ===",
+      "# === x-security include for owasp/modsecurity-crs:nginx ===",
       "#",
-      "# Mount writ.conf to /etc/modsecurity.d/writ.conf and use",
+      "# Mount x-security.conf to /etc/modsecurity.d/x-security.conf and use",
       "# the entrypoint wrapper documented in deployment-recipes/modsec-nginx.md",
       "# to append this Include line after the image regenerates setup.conf:",
       "#",
-      "Include /etc/modsecurity.d/writ.conf",
+      "Include /etc/modsecurity.d/x-security.conf",
       ""
     ].join("\n");
   }
   if (profile.name === "modsec-apache") {
     return [
       "# Drop into Apache config (e.g. /etc/apache2/mods-enabled/security2.conf):",
-      "Include /etc/modsecurity/writ.conf",
+      "Include /etc/modsecurity/x-security.conf",
       ""
     ].join("\n");
   }
@@ -4307,7 +4307,7 @@ function buildIncludeSnippet(profile) {
 }
 function buildWarningsDoc(profile, warnings) {
   const lines = [
-    `# Writ \u2192 ${profile.name} \u2014 emission warnings`,
+    `# x-security \u2192 ${profile.name} \u2014 emission warnings`,
     "",
     `Generator version: ${VERSION}`,
     `Engine profile:    ${profile.name}`,
@@ -4368,21 +4368,21 @@ function createCorazaGenerator(opts = {}) {
       const artifacts = [];
       if (profile.fileExt === "conf") {
         artifacts.push({
-          path: "writ.conf",
+          path: "x-security.conf",
           content: directives + "\n",
           format: "conf"
         });
         const snippet = buildIncludeSnippet(profile);
         if (snippet) {
           artifacts.push({
-            path: "writ-include.conf",
+            path: "x-security-include.conf",
             content: snippet,
             format: "conf"
           });
         }
       } else {
         const meta = {
-          generator: "writ-coraza",
+          generator: "x-security-coraza",
           version: VERSION
         };
         if (profile.name !== "coraza-go") meta["engine"] = profile.name;
@@ -4490,7 +4490,7 @@ function createCorazaGenerator(opts = {}) {
           //                      python pickle \x80 opcode frame) [v0.7]
           //   ai-prompt  → @rx LLM prompt-injection marker denylist (jailbreak /
           //                system-prompt-leak / role-override). Distinct tag
-          //                writ-prompt → SSEC-PROMPT (NOT SSEC-INJECTION) [v0.7]
+          //                x-security-prompt → SSEC-PROMPT (NOT SSEC-INJECTION) [v0.7]
           // Every sink is a real enforcing matcher on all four profiles (sql/xss
           // need the dedicated operator, present on all shipping engines; the rest
           // are plain RE2-safe @rx). → full.
@@ -4716,10 +4716,10 @@ function buildRateLimitSettings(rl, url, index) {
     if (primaryIdentifier(r5) === "user-id") {
       const zoneName = `lazy_user_${n2}`;
       const rate = rateLimitToBunkerRate(r5);
-      out[`CUSTOM_CONF_HTTP_LIMIT_REQ_USER_${n2}`] = `# Writ: per-user-id rate limit for ${url} (drift closure)
+      out[`CUSTOM_CONF_HTTP_LIMIT_REQ_USER_${n2}`] = `# x-security: per-user-id rate limit for ${url} (drift closure)
 limit_req_zone $http_x_forwarded_user zone=${zoneName}:10m rate=${rate};
 `;
-      out[`WRIT_USER_RL_ZONE_${n2}`] = `${zoneName}@${url}`;
+      out[`X_SECURITY_USER_RL_ZONE_${n2}`] = `${zoneName}@${url}`;
     }
   });
   return out;
@@ -4773,7 +4773,7 @@ function escMsec(s) {
 }
 function buildAuthModSecRules(auth) {
   const lines = [
-    `# Writ-generated authentication rules (${auth.type})`,
+    `# x-security-generated authentication rules (${auth.type})`,
     // initcol is for ip/global/resource collections; tx is request-scoped and
     // does not need initcol. We just zero the relevant TX var directly.
     `SecAction "id:990000,phase:1,nolog,pass,setvar:tx.jwt_invalid=0"`
@@ -4784,7 +4784,7 @@ function buildAuthModSecRules(auth) {
     case "oauth2": {
       lines.push(
         `SecRule REQUEST_HEADERS:${escMsec(header15)} "@rx ^Bearer (.+)$" "id:990010,phase:1,nolog,pass,capture,setvar:tx.bearer_token=%{TX.1}"`,
-        `SecRule &TX:bearer_token "@eq 0" "id:990011,phase:1,deny,status:401,log,msg:'Writ: missing bearer token (signature NOT verified \u2014 external auth layer required)'"`
+        `SecRule &TX:bearer_token "@eq 0" "id:990011,phase:1,deny,status:401,log,msg:'x-security: missing bearer token (signature NOT verified \u2014 external auth layer required)'"`
       );
       if (auth.type === "oauth2" && auth.scopes?.length) {
         lines.push(`# oauth2 required scopes (NOT enforced here \u2014 needs external auth): ${auth.scopes.join(" ")}`);
@@ -4794,13 +4794,13 @@ function buildAuthModSecRules(auth) {
     case "api-key": {
       lines.push(
         `SecRule REQUEST_HEADERS:${escMsec(header15)} "@rx ^.+$" "id:990020,phase:1,nolog,pass,setvar:tx.api_key_present=1"`,
-        `SecRule &TX:api_key_present "@eq 0" "id:990021,phase:1,deny,status:401,log,msg:'Writ: missing API key (${escMsec(header15)})'"`
+        `SecRule &TX:api_key_present "@eq 0" "id:990021,phase:1,deny,status:401,log,msg:'x-security: missing API key (${escMsec(header15)})'"`
       );
       break;
     }
     case "basic": {
       lines.push(
-        `SecRule REQUEST_HEADERS:Authorization "!@rx ^Basic [A-Za-z0-9+/=]+$" "id:990030,phase:1,deny,status:401,log,msg:'Writ: missing/invalid Basic credentials'"`
+        `SecRule REQUEST_HEADERS:Authorization "!@rx ^Basic [A-Za-z0-9+/=]+$" "id:990030,phase:1,deny,status:401,log,msg:'x-security: missing/invalid Basic credentials'"`
       );
       break;
     }
@@ -4826,13 +4826,13 @@ function buildAuthSettings(auth) {
       const header15 = auth.headerName ?? (auth.type === "api-key" ? "X-API-Key" : "Authorization");
       out.USE_MODSECURITY = "yes";
       out.CUSTOM_CONF_MODSEC_1 = buildAuthModSecRules(auth);
-      out.WRIT_AUTH_HEADER = header15;
-      out.WRIT_AUTH_TYPE = auth.type;
-      if (auth.jwksUri) out.WRIT_JWKS_URI = String(auth.jwksUri);
-      if (auth.issuer) out.WRIT_AUTH_ISSUER = String(auth.issuer);
-      if (auth.audience) out.WRIT_AUTH_AUDIENCE = String(auth.audience);
+      out.X_SECURITY_AUTH_HEADER = header15;
+      out.X_SECURITY_AUTH_TYPE = auth.type;
+      if (auth.jwksUri) out.X_SECURITY_JWKS_URI = String(auth.jwksUri);
+      if (auth.issuer) out.X_SECURITY_AUTH_ISSUER = String(auth.issuer);
+      if (auth.audience) out.X_SECURITY_AUTH_AUDIENCE = String(auth.audience);
       if (auth.type === "oauth2" && auth.scopes?.length) {
-        out.WRIT_AUTH_SCOPES = auth.scopes.join(" ");
+        out.X_SECURITY_AUTH_SCOPES = auth.scopes.join(" ");
       }
       const jwtSettings = buildJwtNativeSettings(auth);
       for (const [k5, v] of Object.entries(jwtSettings)) out[k5] = v;
@@ -4905,9 +4905,9 @@ function buildLifecycleRules2(endpoint) {
   const pathRx = pathRegex2(endpoint.path);
   const sunset = endpoint.policy.sunsetDate ? ` (sunset:${endpoint.policy.sunsetDate})` : "";
   const replacement = endpoint.policy.replacementEndpoint ? ` use ${endpoint.policy.replacementEndpoint}` : "";
-  const msg = `Writ: ${DEPRECATED_TAG} ${endpoint.method} ${endpoint.path}${sunset}${replacement}`;
+  const msg = `x-security: ${DEPRECATED_TAG} ${endpoint.method} ${endpoint.path}${sunset}${replacement}`;
   const lines = [
-    `# Writ-generated lifecycle rule (deprecated endpoint \u2192 410 Gone)`,
+    `# x-security-generated lifecycle rule (deprecated endpoint \u2192 410 Gone)`,
     `# Source: ${endpoint.method} ${endpoint.path}` + (endpoint.policy.sunsetDate ? ` (sunsetDate: ${endpoint.policy.sunsetDate})` : ""),
     `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:410,log,auditlog,msg:'${escMsec2(msg)}',tag:'${DEPRECATED_TAG}',chain"`,
     `  SecRule REQUEST_FILENAME "@rx ${escRx4(pathRx)}" "t:none"`
@@ -4919,7 +4919,7 @@ var init_lifecycle = __esm({
   "src/generators/bunkerweb/lifecycle.ts"() {
     "use strict";
     DEPRECATED_BASE_ID2 = 970500;
-    DEPRECATED_TAG = "writ-deprecated-endpoint-block";
+    DEPRECATED_TAG = "x-security-deprecated-endpoint-block";
   }
 });
 
@@ -4959,24 +4959,24 @@ function buildAuthzMultiRoleRules(endpoint) {
   const idMissing = base;
   const idNoMatch = base + 1;
   const altRx = `(?:^|,)(?:${safeRoles.map((r5) => r5.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("|")})(?:,|$)`;
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rolesStr = safeRoles.join(",");
   const lines = [];
   lines.push(
     [
-      `# Writ-generated authorization rules (rbac multi-role: ${rolesStr})`,
+      `# x-security-generated authorization rules (rbac multi-role: ${rolesStr})`,
       `# Source: ${endpoint.method} ${endpoint.path}`,
       `# Chain on X-Forwarded-Groups (set by upstream OIDC sidecar / Kong+OIDC).`,
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idMissing},phase:1,deny,status:403,log,auditlog,msg:'Writ rbac-multi-role denied (no ${TRUSTED_GROUPS_HEADER} header)',tag:'${escMsec3(tag2)}',tag:'writ-rule-rbac-multi-role',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idMissing},phase:1,deny,status:403,log,auditlog,msg:'x-security rbac-multi-role denied (no ${TRUSTED_GROUPS_HEADER} header)',tag:'${escMsec3(tag2)}',tag:'x-security-rule-rbac-multi-role',chain"`,
       `  SecRule REQUEST_FILENAME "@rx ${escRx5(pathRx)}" "chain"`,
       `    SecRule &REQUEST_HEADERS:${TRUSTED_GROUPS_HEADER} "@eq 0" "t:none"`
     ].join("\n")
   );
   lines.push(
     [
-      `# Writ-generated authorization rules (rbac multi-role: ${rolesStr})`,
+      `# x-security-generated authorization rules (rbac multi-role: ${rolesStr})`,
       `# Source: ${endpoint.method} ${endpoint.path}`,
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idNoMatch},phase:1,deny,status:403,log,auditlog,msg:'Writ rbac-multi-role denied (${TRUSTED_GROUPS_HEADER} lacks any of: ${escMsec3(rolesStr)})',tag:'${escMsec3(tag2)}',tag:'writ-rule-rbac-multi-role',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${idNoMatch},phase:1,deny,status:403,log,auditlog,msg:'x-security rbac-multi-role denied (${TRUSTED_GROUPS_HEADER} lacks any of: ${escMsec3(rolesStr)})',tag:'${escMsec3(tag2)}',tag:'x-security-rule-rbac-multi-role',chain"`,
       `  SecRule REQUEST_FILENAME "@rx ${escRx5(pathRx)}" "chain"`,
       `    SecRule REQUEST_HEADERS:${TRUSTED_GROUPS_HEADER} "!@rx ${escRx5(altRx)}" "t:none"`
     ].join("\n")
@@ -5034,16 +5034,16 @@ function buildPiiResponseRules(endpoint) {
   const fields = collectSensitiveFields(endpoint);
   if (fields.length === 0) return [];
   const pathRx = pathRegex4(endpoint.path);
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const h5 = stableHash(endpoint.method, endpoint.path);
   const rules = [];
   fields.forEach((field, i5) => {
     const id = DATA_EXPOSURE_PII_BASE + (h5 * 17 + 3 + i5) % 999;
     rules.push(
       [
-        `# Writ-generated response PII filter (id:428)`,
+        `# x-security-generated response PII filter (id:428)`,
         `# Source: ${endpoint.method} ${endpoint.path}, field: ${field}`,
-        `SecRule REQUEST_FILENAME "@rx ${escRx6(pathRx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'Writ id:428 data-exposure: response leaked sensitive field ${escMsec4(field)}',tag:'${escMsec4(tag2)}',tag:'writ-data-exposure',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx6(pathRx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'x-security id:428 data-exposure: response leaked sensitive field ${escMsec4(field)}',tag:'${escMsec4(tag2)}',tag:'x-security-data-exposure',chain"`,
         `  SecRule RESPONSE_BODY "@rx \\"${escMsec4(field)}\\"\\s*:\\s*\\"[^\\"]+\\"" "t:none"`
       ].join("\n")
     );
@@ -5054,7 +5054,7 @@ function buildErrorScrubbingRules(endpoint) {
   const scrub = endpoint.policy.response?.errorScrubbing;
   if (!scrub) return [];
   const pathRx = pathRegex4(endpoint.path);
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const h5 = stableHash(endpoint.method, endpoint.path);
   const rules = [];
   let slot = 0;
@@ -5062,9 +5062,9 @@ function buildErrorScrubbingRules(endpoint) {
     const id = OUTPUT_SANITIZE_BASE + (h5 * 31 + 7 + slot++) % 999;
     rules.push(
       [
-        `# Writ-generated response error-scrubbing (id:268, stack traces)`,
+        `# x-security-generated response error-scrubbing (id:268, stack traces)`,
         `# Source: ${endpoint.method} ${endpoint.path}`,
-        `SecRule REQUEST_FILENAME "@rx ${escRx6(pathRx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'Writ id:268 output sanitization (stack trace leak)',tag:'${escMsec4(tag2)}',tag:'writ-output-sanitization',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx6(pathRx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'x-security id:268 output sanitization (stack trace leak)',tag:'${escMsec4(tag2)}',tag:'x-security-output-sanitization',chain"`,
         // Common stack-frame markers across Python / Node / Java / Go.
         // RE2-safe: only character classes + non-capturing groups + bounded \\d+.
         `  SecRule RESPONSE_BODY "@rx (?:Traceback \\(most recent call last\\)|Exception in thread|\\bat\\s+[\\w.]+\\.[\\w$<>]+\\(|goroutine\\s+\\d+\\s+\\[)" "t:none"`
@@ -5075,9 +5075,9 @@ function buildErrorScrubbingRules(endpoint) {
     const id = OUTPUT_SANITIZE_BASE + (h5 * 31 + 7 + slot++) % 999;
     rules.push(
       [
-        `# Writ-generated response error-scrubbing (id:268, generic messages)`,
+        `# x-security-generated response error-scrubbing (id:268, generic messages)`,
         `# Source: ${endpoint.method} ${endpoint.path}`,
-        `SecRule REQUEST_FILENAME "@rx ${escRx6(pathRx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'Writ id:268 output sanitization (raw error leak)',tag:'${escMsec4(tag2)}',tag:'writ-output-sanitization',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx6(pathRx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'x-security id:268 output sanitization (raw error leak)',tag:'${escMsec4(tag2)}',tag:'x-security-output-sanitization',chain"`,
         `  SecRule RESPONSE_BODY "@rx (?i)(?:syntax error near|ORA-\\d+|ER_\\w+|psycopg2\\.|SQLSTATE|\\bENOENT\\b|undefined method|NullPointerException|panic:\\s)" "t:none"`
       ].join("\n")
     );
@@ -5139,7 +5139,7 @@ function buildRequestSchemaRules(endpoint) {
   const ctx = {
     endpoint,
     base: ruleBase(endpoint),
-    tag: `writ/${endpoint.method} ${endpoint.path}`
+    tag: `x-security/${endpoint.method} ${endpoint.path}`
   };
   return buildSchemaRules(ctx, schema, MODSEC_NGINX_PROFILE);
 }
@@ -5204,7 +5204,7 @@ function sinkRule(sink) {
         operator: "@rx (?i)(?:ignore\\s+(?:all\\s+)?(?:previous|prior|above)\\s+instructions|disregard\\s+(?:the\\s+)?(?:previous|above|system)|system\\s+prompt|you\\s+are\\s+now\\s+|act\\s+as\\s+(?:a\\s+)?(?:dan|developer\\s+mode)|reveal\\s+(?:your\\s+)?(?:system\\s+)?prompt|new\\s+instructions?\\s*:)",
         msg: "LLM prompt injection",
         slot: 8,
-        attrTag: "writ-ssec-prompt"
+        attrTag: "x-security-ssec-prompt"
       };
     default:
       return null;
@@ -5213,7 +5213,7 @@ function sinkRule(sink) {
 function buildInjectionGuardRules(endpoint) {
   const schema = endpoint.policy.request?.schema;
   if (!schema || Object.keys(schema).length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const out = [];
   for (const [field, ps] of Object.entries(schema)) {
@@ -5225,16 +5225,16 @@ function buildInjectionGuardRules(endpoint) {
       const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|${field}`, "");
       const id = INJECTION_GUARD_BASE_ID2 + seed % 1e3 * 9 + def.slot;
       const selector = `ARGS:json.${field}|ARGS:${field}`;
-      const attrTag = def.attrTag ?? "writ-ssec-injection";
-      const attrName = attrTag === "writ-ssec-prompt" ? "SSEC-PROMPT" : "SSEC-INJECTION";
+      const attrTag = def.attrTag ?? "x-security-ssec-injection";
+      const attrName = attrTag === "x-security-ssec-prompt" ? "SSEC-PROMPT" : "SSEC-INJECTION";
       out.push(
         [
           header12(
             `W19 injectionGuard[${sink}] on request.schema.${field} for ${endpoint.method} ${endpoint.path}
 Native libmodsec3 operator on the declared sink field. Attributed to
-${attrName} (Writ-native), not an OWASP-API cell.`
+${attrName} (x-security-native), not an OWASP-API cell.`
           ),
-          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'Writ: ${esc11(def.msg)} in ${esc11(field)}',tag:'${esc11(tag2)}',tag:'${esc11(attrTag)}',chain"`,
+          `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:403,msg:'x-security: ${esc11(def.msg)} in ${esc11(field)}',tag:'${esc11(tag2)}',tag:'${esc11(attrTag)}',chain"`,
           `  SecRule REQUEST_FILENAME "@rx ${escRx7(rx)}" "chain"`,
           `    SecRule ${selector} "${escRx7(def.operator)}"${CHAIN_TERM}`
         ].join("\n")
@@ -5254,7 +5254,7 @@ function redirectHostRx(domain) {
 function buildRedirectAllowlistRules(endpoint) {
   const schema = endpoint.policy.request?.schema;
   if (!schema || Object.keys(schema).length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const out = [];
   for (const [field, ps] of Object.entries(schema)) {
@@ -5270,7 +5270,7 @@ function buildRedirectAllowlistRules(endpoint) {
         header12(
           `S-15 open-redirect: ${field} must match redirectAllowedDomains for ${endpoint.method} ${endpoint.path}`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'Writ: ${esc11(field)} redirect target not in redirectAllowedDomains',tag:'${esc11(tag2)}',tag:'writ-rule-open-redirect-403',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:403,msg:'x-security: ${esc11(field)} redirect target not in redirectAllowedDomains',tag:'${esc11(tag2)}',tag:'x-security-rule-open-redirect-403',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${escRx7(rx)}" "chain"`,
         `    SecRule ARGS:${field}|ARGS:json.${field} "!@rx ${escRx7(allowRx)}"${CHAIN_TERM}`
       ].join("\n")
@@ -5284,7 +5284,7 @@ function buildXxeRules(endpoint) {
   const disallowXml = req.disallowXml === true;
   const disableEntities = req.disableExternalEntities === true;
   if (!disallowXml && !disableEntities) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|xxe`, "");
   const id = XXE_BASE_ID + seed % 9e3;
@@ -5295,7 +5295,7 @@ function buildXxeRules(endpoint) {
         `S-5 XXE: reject XML body for ${endpoint.method} ${endpoint.path}
 ${reason}`
       ),
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:415,msg:'Writ: ${esc11(reason)}',tag:'${esc11(tag2)}',tag:'writ-rule-xxe-415',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:415,msg:'x-security: ${esc11(reason)}',tag:'${esc11(tag2)}',tag:'x-security-rule-xxe-415',chain"`,
       `  SecRule REQUEST_FILENAME "@rx ${escRx7(rx)}" "chain"`,
       `    SecRule REQUEST_HEADERS:Content-Type "@rx ${escRx7(XML_CONTENT_TYPE_RX)}"${CHAIN_TERM}`
     ].join("\n")
@@ -5303,7 +5303,7 @@ ${reason}`
 }
 function buildPathCanonicalizationRules(endpoint) {
   if (endpoint.policy.request?.pathCanonicalization !== true) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|pathcanon`, "");
   const id = PATH_CANON_BASE_ID + seed % 9e3;
   return [
@@ -5313,7 +5313,7 @@ function buildPathCanonicalizationRules(endpoint) {
 Denies traversal / double-slash / percent-encoded separators so the
 canonical path every later SecRule matches against can't be bypassed.`
       ),
-      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:400,msg:'Writ: non-canonical request path',tag:'${esc11(tag2)}',tag:'writ-rule-path-canon-400',chain"`,
+      `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:1,deny,status:400,msg:'x-security: non-canonical request path',tag:'${esc11(tag2)}',tag:'x-security-rule-path-canon-400',chain"`,
       `  SecRule REQUEST_URI "@rx ${escRx7(PATH_TRAVERSAL_RX)}"${CHAIN_TERM}`
     ].join("\n")
   ];
@@ -5347,7 +5347,7 @@ function header13(comment) {
 function buildPasswordPolicyRules2(endpoint) {
   const pol = endpoint.policy.authentication?.passwordPolicy;
   if (!pol) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seedBase = endpointHash3(`${endpoint.method}|${endpoint.path}|pwpolicy`, "");
   const checks = [];
@@ -5374,7 +5374,7 @@ function buildPasswordPolicyRules2(endpoint) {
 Body-carried password strength (API2:2023). libmodsec3 PCRE !@rx on the
 password field \u2014 rejects a present-but-weak password.`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'Writ: ${esc12(c5.reason)}',tag:'${esc12(tag2)}',tag:'writ-rule-password-policy',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'x-security: ${esc12(c5.reason)}',tag:'${esc12(tag2)}',tag:'x-security-rule-password-policy',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "chain"`,
         `    SecRule ${selector} "!@rx ${escRx8(c5.rx)}"${CHAIN_TERM2}`
       ].join("\n")
@@ -5388,7 +5388,7 @@ password field \u2014 rejects a present-but-weak password.`
         header13(
           `v0.7 passwordPolicy: blocklisted password for ${endpoint.method} ${endpoint.path}`
         ),
-        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'Writ: password is on the blocklist',tag:'${esc12(tag2)}',tag:'writ-rule-password-policy',chain"`,
+        `SecRule REQUEST_METHOD "@streq ${endpoint.method}" "id:${id},phase:2,deny,status:422,log,msg:'x-security: password is on the blocklist',tag:'${esc12(tag2)}',tag:'x-security-rule-password-policy',chain"`,
         `  SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "chain"`,
         `    SecRule ${selector} "@rx ${escRx8(`(?i)^(?:${alt})$`)}"${CHAIN_TERM2}`
       ].join("\n")
@@ -5407,7 +5407,7 @@ function lockoutVar2(identifier) {
 function buildAccountLockoutRules2(endpoint) {
   const lock = endpoint.policy.authentication?.accountLockout;
   if (!lock) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const window2 = parseDurationSec(lock.window) || 900;
   const { expansion, collectKeyPhase } = lockoutVar2(lock.identifier);
@@ -5428,7 +5428,7 @@ identifier source is populated); increment at phase:5 on a >=400 auth response.`
       `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base},phase:${keyPhase},pass,nolog,tag:'${esc12(tag2)}',${initcol},chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${CHAIN_TERM2}`,
       // 2. Deny while locked out — counter already over budget.
-      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base + 1},phase:${keyPhase},deny,status:429,log,msg:'Writ: account locked (>${lock.attempts} failed logins / ${esc12(lock.window)})',tag:'${esc12(tag2)}',tag:'writ-rule-account-lockout',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base + 1},phase:${keyPhase},deny,status:429,log,msg:'x-security: account locked (>${lock.attempts} failed logins / ${esc12(lock.window)})',tag:'${esc12(tag2)}',tag:'x-security-rule-account-lockout',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule GLOBAL:${counterKey} "@gt ${lock.attempts}"${CHAIN_TERM2}`,
       // 3. On a failed-auth response (>=400), increment + refresh the TTL (phase:5).
@@ -5440,7 +5440,7 @@ identifier source is populated); increment at phase:5 on a >=400 auth response.`
 }
 function buildForbidArrayRootRules2(endpoint) {
   if (endpoint.policy.response?.forbidArrayRoot !== true) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|arrayroot`, "");
   const id = FORBID_ARRAY_ROOT_BASE_ID2 + seed % 999;
@@ -5451,7 +5451,7 @@ function buildForbidArrayRootRules2(endpoint) {
 JSON-hijacking defense (API3:2023). phase:4 RESPONSE_BODY @rx on the first
 non-whitespace byte; an array-rooted body is denied (wrap in an object instead).`
       ),
-      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'Writ: bare top-level JSON array response (forbidArrayRoot)',tag:'${esc12(tag2)}',tag:'writ-rule-forbid-array-root',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${id},phase:4,deny,status:500,log,auditlog,msg:'x-security: bare top-level JSON array response (forbidArrayRoot)',tag:'${esc12(tag2)}',tag:'x-security-rule-forbid-array-root',chain"`,
       `  SecRule RESPONSE_BODY "@rx ^[\\s\\xef\\xbb\\xbf]*\\[" "t:none"`
     ].join("\n")
   ];
@@ -5459,7 +5459,7 @@ non-whitespace byte; an array-rooted body is denied (wrap in an object instead).
 function buildIdempotencyKeyRules2(endpoint) {
   const idem = endpoint.policy.request?.idempotencyKey;
   if (!idem) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const ttl = parseDurationSec(idem.ttl) || 300;
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|idempotency`, "");
@@ -5476,7 +5476,7 @@ request replay via a persistent-collection seen-count, NOT concurrent in-
 flight races (no atomic check-and-set at the WAF; handle that in the store).`
       ),
       // 1. Require the idempotency-key header to be present at all.
-      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base},phase:1,deny,status:400,log,msg:'Writ: missing ${esc12(idem.header)} header',tag:'${esc12(tag2)}',tag:'writ-rule-idempotency-key',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base},phase:1,deny,status:400,log,msg:'x-security: missing ${esc12(idem.header)} header',tag:'${esc12(tag2)}',tag:'x-security-rule-idempotency-key',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule &REQUEST_HEADERS:${esc12(idem.header)} "@eq 0"${CHAIN_TERM2}`,
       // 2. Open the per-key persistent collection.
@@ -5486,7 +5486,7 @@ flight races (no atomic check-and-set at the WAF; handle that in the store).`
       `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base + 2},phase:1,pass,nolog,tag:'${esc12(tag2)}',setvar:global.${counterKey}=+1,expirevar:global.${counterKey}=${ttl},chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${CHAIN_TERM2}`,
       // 4. Deny the replay — second+ request with this key inside the ttl window.
-      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base + 3},phase:1,deny,status:409,log,msg:'Writ: replayed idempotency key (${esc12(idem.header)})',tag:'${esc12(tag2)}',tag:'writ-rule-idempotency-key',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${base + 3},phase:1,deny,status:409,log,msg:'x-security: replayed idempotency key (${esc12(idem.header)})',tag:'${esc12(tag2)}',tag:'x-security-rule-idempotency-key',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
       `    SecRule GLOBAL:${counterKey} "@gt 1"${CHAIN_TERM2}`
     ].join("\n")
@@ -5495,7 +5495,7 @@ flight races (no atomic check-and-set at the WAF; handle that in the store).`
 function buildLoggingRules2(endpoint) {
   const log = endpoint.policy.logging;
   if (!log || !Array.isArray(log.events) || log.events.length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|logging`, "");
   const id = LOGGING_BASE_ID2 + seed % 999;
@@ -5504,7 +5504,7 @@ function buildLoggingRules2(endpoint) {
   const notes = [];
   notes.push(`events declared: ${log.events.join(", ")}`);
   notes.push(`auth-failure / authz-deny / injection-block / rate-limit-trip are`);
-  notes.push(`already audit-logged by the corresponding Writ deny rules.`);
+  notes.push(`already audit-logged by the corresponding x-security deny rules.`);
   if (log.sink && log.sink !== "stdout") {
     notes.push(`sink='${log.sink}' is NOT enforced at libmodsec3 \u2014 configure it at`);
     notes.push(`the nginx/bw-scheduler log-shipping layer (syslog/fluent-bit sidecar).`);
@@ -5523,7 +5523,7 @@ function buildLoggingRules2(endpoint) {
           `v0.7 logging (SSEC-AUDIT): force audit log for ${endpoint.method} ${endpoint.path}
 ` + notes.join("\n")
         ),
-        `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${id},phase:5,pass,log,auditlog,msg:'Writ: audit (request/response) for ${esc12(endpoint.method)} ${esc12(endpoint.path)}',tag:'${esc12(tag2)}',tag:'writ-audit',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx8(rx)}" "id:${id},phase:5,pass,log,auditlog,msg:'x-security: audit (request/response) for ${esc12(endpoint.method)} ${esc12(endpoint.path)}',tag:'${esc12(tag2)}',tag:'x-security-audit',chain"`,
         `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${CHAIN_TERM2}`
       ].join("\n")
     );
@@ -5570,7 +5570,7 @@ function operationsWithAuthz(ops) {
 function buildGraphqlOperationAuthzRules(endpoint) {
   const ops = operationsWithAuthz(endpoint.policy.graphql?.operations);
   if (ops.length === 0) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|gqlops`, "");
   const id = GRAPHQL_OPS_BASE_ID + seed % 999;
@@ -5595,7 +5595,7 @@ Per-operation authz contract the processor MUST enforce:
       // Route marker: pass-through (NOT a deny) so we never claim enforcement
       // we don't have. The tag lets a downstream ext-filter / sidecar pick up
       // the request; on its own it changes nothing about the response.
-      `SecRule REQUEST_FILENAME "@rx ${escRx9(rx)}" "id:${id},phase:2,pass,nolog,msg:'Writ: graphql per-operation authz handoff (override-only)',tag:'${esc13(tag2)}',tag:'writ-graphql-ops-authz',tag:'writ-override-only',chain"`,
+      `SecRule REQUEST_FILENAME "@rx ${escRx9(rx)}" "id:${id},phase:2,pass,nolog,msg:'x-security: graphql per-operation authz handoff (override-only)',tag:'${esc13(tag2)}',tag:'x-security-graphql-ops-authz',tag:'x-security-override-only',chain"`,
       `  SecRule REQUEST_METHOD "@streq ${endpoint.method}"${CHAIN_TERM3}`
     ].join("\n")
   ];
@@ -5603,7 +5603,7 @@ Per-operation authz contract the processor MUST enforce:
 function buildGraphqlStaticLimitRules2(endpoint) {
   const g5 = endpoint.policy.graphql;
   if (!g5) return [];
-  const tag2 = `writ/${endpoint.method} ${endpoint.path}`;
+  const tag2 = `x-security/${endpoint.method} ${endpoint.path}`;
   const rx = pathRegex(endpoint.path);
   const seed = endpointHash3(`${endpoint.method}|${endpoint.path}|gqlstatic`, "");
   const base = GRAPHQL_STATIC_BASE_ID + seed % 498 * 2;
@@ -5621,7 +5621,7 @@ function buildGraphqlStaticLimitRules2(endpoint) {
 an introspection query MUST contain those meta-fields, so this is a real,
 non-parsing block (not a heuristic guess).`
         ),
-        `SecRule REQUEST_FILENAME "@rx ${escRx9(rx)}" "id:${base},phase:2,deny,status:403,log,msg:'Writ: GraphQL introspection disabled (graphql.disableIntrospection)',tag:'${esc13(tag2)}',tag:'writ-rule-graphql-introspection',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx9(rx)}" "id:${base},phase:2,deny,status:403,log,msg:'x-security: GraphQL introspection disabled (graphql.disableIntrospection)',tag:'${esc13(tag2)}',tag:'x-security-rule-graphql-introspection',chain"`,
         `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
         `    SecRule REQUEST_BODY "@rx (?i)__(?:schema|type)\\b"${CHAIN_TERM3}`
       ].join("\n")
@@ -5637,7 +5637,7 @@ parser, so we reject any top-level JSON-array body (batched GraphQL is
 [{...},{...}]). This caps batching at "none" \u2014 stricter than the numeric
 limit, not the exact semantics, hence partial.`
         ),
-        `SecRule REQUEST_FILENAME "@rx ${escRx9(rx)}" "id:${base + 1},phase:2,deny,status:403,log,msg:'Writ: GraphQL request batching rejected (graphql.batchLimit)',tag:'${esc13(tag2)}',tag:'writ-rule-graphql-batch',chain"`,
+        `SecRule REQUEST_FILENAME "@rx ${escRx9(rx)}" "id:${base + 1},phase:2,deny,status:403,log,msg:'x-security: GraphQL request batching rejected (graphql.batchLimit)',tag:'${esc13(tag2)}',tag:'x-security-rule-graphql-batch',chain"`,
         `  SecRule REQUEST_METHOD "@streq ${endpoint.method}" "chain"`,
         `    SecRule REQUEST_BODY "@rx ^[\\s]*\\[" "t:none"`
       ].join("\n")
@@ -5651,7 +5651,7 @@ ${unenforceable.join(", ")} require GraphQL query-depth/complexity/alias
 counting, which is NOT regular-language-expressible \u2014 libmodsec3 cannot
 enforce it without a parser. Wire a GraphQL-aware processor (the same
 sidecar the graphql.operations.authz scaffolding routes to) to enforce
-these. Writ does NOT fake them with regex (Rule D-1).`
+these. x-security does NOT fake them with regex (Rule D-1).`
       )
     );
   }
@@ -5673,7 +5673,7 @@ function buildSerializeByHttpSnippet(endpoint, index) {
   const limit = endpoint.policy.request?.concurrencyLimit;
   const conc = typeof limit === "number" && limit >= 1 ? limit : 1;
   const scope = ser.scope ?? "per-identifier";
-  const keyVar = scope === "global" ? `"writ_serial_global"` : serializeKeyToNginxVar(ser.key);
+  const keyVar = scope === "global" ? `"x_security_serial_global"` : serializeKeyToNginxVar(ser.key);
   const zoneName = `ss_serial_${index}`;
   const snippet = `# v0.8 request.serializeBy (API6:2023) for ${endpoint.method} ${endpoint.path}
 # PARTIAL \u2014 edge serialization only; does NOT provide in-handler transaction
@@ -5693,7 +5693,7 @@ function buildDataAtRestRules(endpoint) {
 ADVISORY-ONLY \u2014 NOT gateway-enforced. fields=[${dar.fields.join(", ")}] must be
 '${dar.protection}' at rest, but the WAF never sees the datastore write, so this
 compiles to NOTHING enforcing. Implement at-rest ${dar.protection} in the app's
-persistence layer. Writ surfaces this as an out-of-band SSEC-STORAGE
+persistence layer. x-security surfaces this as an out-of-band SSEC-STORAGE
 finding, not a control (Rule D-1: no fake 'full' for an unenforceable field).`
     )
   ];
@@ -5814,7 +5814,7 @@ function bunkerwebCapabilities() {
       // emits a native libmodsec3 operator per declared sink. v0.7 adds two
       // sinks that ride the SAME cell — both are real @rx denylists on the
       // field (deserialization preamble denylist; ai-prompt heuristic denylist,
-      // tagged writ-ssec-prompt) → cell stays 'full'.
+      // tagged x-security-ssec-prompt) → cell stays 'full'.
       // v0.7 (API2): authentication.passwordPolicy — phase:2 !@rx strength
       // SecRules (minLength/upper/digit/symbol/blocklist) on the body password
       // field. Real per-rule enforcement on a present password → full.
@@ -5880,7 +5880,7 @@ function bunkerwebCapabilities() {
       "request.dataAtRest": "unsupported",
       "mtls.pinnedCertificates": "unsupported",
       // Promoted: deprecated emits phase:1 SecRule returning 410 with
-      // writ-deprecated-endpoint-block tag (attribution.py:35).
+      // x-security-deprecated-endpoint-block tag (attribution.py:35).
       "deprecated": "full",
       "sunsetDate": "partial"
     }
@@ -5943,8 +5943,8 @@ function detectMixedJwtAudienceIssuer(per) {
   const audiences = /* @__PURE__ */ new Set();
   const issuers = /* @__PURE__ */ new Set();
   for (const { settings } of per) {
-    if (settings.WRIT_AUTH_AUDIENCE !== void 0) audiences.add(String(settings.WRIT_AUTH_AUDIENCE));
-    if (settings.WRIT_AUTH_ISSUER !== void 0) issuers.add(String(settings.WRIT_AUTH_ISSUER));
+    if (settings.X_SECURITY_AUTH_AUDIENCE !== void 0) audiences.add(String(settings.X_SECURITY_AUTH_AUDIENCE));
+    if (settings.X_SECURITY_AUTH_ISSUER !== void 0) issuers.add(String(settings.X_SECURITY_AUTH_ISSUER));
   }
   const errors = [];
   if (audiences.size > 1) errors.push(`mixed JWT audience values across service: ${Array.from(audiences).join(", ")}`);
@@ -6181,8 +6181,8 @@ function groupByService(spec) {
 }
 function serializeModsecConf(spec, service) {
   const lines = [];
-  lines.push(`# Generated by Writ from ${spec.info.title} v${spec.info.version}`);
-  lines.push("# Phase-1/phase-2 Writ ModSecurity rules.");
+  lines.push(`# Generated by x-security from ${spec.info.title} v${spec.info.version}`);
+  lines.push("# Phase-1/phase-2 x-security ModSecurity rules.");
   lines.push("# Place this file under bw-scheduler's /data/configs/modsec/ volume.");
   lines.push("# Do not edit by hand \u2014 regenerate via `lazy generate --target bunkerweb`.");
   lines.push("");
@@ -6190,10 +6190,10 @@ function serializeModsecConf(spec, service) {
     ([k5]) => /^CUSTOM_CONF_MODSEC_\d+$/.test(k5)
   );
   const ssrfBlocks = modsecEntries.filter(
-    ([, v]) => String(v).includes("writ-rule-ssrf")
+    ([, v]) => String(v).includes("x-security-rule-ssrf")
   );
   const otherBlocks = modsecEntries.filter(
-    ([, v]) => !String(v).includes("writ-rule-ssrf")
+    ([, v]) => !String(v).includes("x-security-rule-ssrf")
   );
   for (const [key, val] of [...ssrfBlocks, ...otherBlocks]) {
     const origins = service.provenance.get(key) ?? [];
@@ -6231,7 +6231,7 @@ function serializeModsecConf(spec, service) {
 }
 function serializeDeploymentMd(spec, warnings) {
   const lines = [
-    "# Writ \u2192 BunkerWeb deployment notes",
+    "# x-security \u2192 BunkerWeb deployment notes",
     "",
     `Generated from ${spec.info.title} v${spec.info.version}.`,
     "",
@@ -6257,11 +6257,11 @@ function serializeDeploymentMd(spec, warnings) {
     "  Settings like `USE_MODSECURITY`, `ALLOWED_METHODS`, rate-limit thresholds, etc.",
     "  belong in your **docker-compose.yml** as per-service environment variables",
     "  (`<SERVICE>_<KEY>=<value>` in multisite mode). See the comment block at the",
-    "  bottom of `configs/modsec/writ.conf` for the recommended values.",
+    "  bottom of `configs/modsec/x-security.conf` for the recommended values.",
     "",
     "## JWT signature validation",
     "",
-    "BunkerWeb 1.6+ ships `nginx_jwt_module`; Writ now emits the native",
+    "BunkerWeb 1.6+ ships `nginx_jwt_module`; x-security now emits the native",
     "`USE_AUTH_JWT`, `JWT_JWKS_URI`, and `JWT_ALGORITHMS` settings for every",
     "`bearer-jwt` / `oauth2` endpoint that declares `jwksUri`. The WAF-side",
     "header-presence SecRule chain (id:990010/990011) stays as defense-in-depth.",
@@ -6274,17 +6274,17 @@ function serializeDeploymentMd(spec, warnings) {
     "",
     "## Per-user rate limits (rateLimit.identifier=user-id)",
     "",
-    "For endpoints declaring `rateLimit.identifier: user-id`, Writ emits a",
+    "For endpoints declaring `rateLimit.identifier: user-id`, x-security emits a",
     "`CUSTOM_CONF_HTTP_LIMIT_REQ_USER_<n>` snippet that declares a dedicated",
     "`limit_req_zone` keyed on `$http_x_forwarded_user`. Paste the snippet into",
-    "`configs/http/writ-limit-user.conf` in your bw-scheduler volume, then",
+    "`configs/http/x-security-limit-user.conf` in your bw-scheduler volume, then",
     "wire the matching `limit_req zone=lazy_user_<n> burst=<b> nodelay;` into the",
     "per-location server block (BunkerWeb's `CUSTOM_CONF_SERVER_*` overrides).",
     "",
     "## Deprecated endpoints",
     "",
     "Endpoints with `deprecated: true` get a phase:1 SecRule returning **410 Gone**",
-    "with tag `writ-deprecated-endpoint-block` (consumed by the scorer's",
+    "with tag `x-security-deprecated-endpoint-block` (consumed by the scorer's",
     "attribution table). `sunsetDate` is surfaced in the deny message; emit a",
     "`Sunset:` response header via `CUSTOM_HEADER_*` if the client needs it.",
     "",
@@ -6314,7 +6314,7 @@ var init_bunkerweb = __esm({
     init_ssrf_policy_check();
     init_rules();
     init_profiles();
-    MODSEC_BLOCK_MARKER = "# Writ-generated authentication rules";
+    MODSEC_BLOCK_MARKER = "# x-security-generated authentication rules";
     bunkerwebGenerator = {
       name: "bunkerweb",
       targets: ["bunkerweb"],
@@ -6333,7 +6333,7 @@ var init_bunkerweb = __esm({
         const modsecBody = serializeModsecConf(spec, service);
         const artifacts = [
           {
-            path: "configs/modsec/writ.conf",
+            path: "configs/modsec/x-security.conf",
             content: modsecBody,
             format: "conf"
           },
@@ -6595,7 +6595,7 @@ function buildDoc(spec, opts = {}) {
   }
   if (hosts.size === 0) hosts.add("*");
   const specificRules = Array.from(hosts).map((host) => ({
-    name: `writ-asset-${sanitizeName(host) || "default"}`,
+    name: `x-security-asset-${sanitizeName(host) || "default"}`,
     host,
     triggers: [DEFAULT_TRIGGER],
     mode: "prevent-learn",
@@ -6615,7 +6615,7 @@ function buildDoc(spec, opts = {}) {
     practices,
     "log-triggers": [buildDefaultTrigger()],
     "custom-responses": [buildDefaultResponse()],
-    "writ-extended": {
+    "x-security-extended": {
       "schema-validation": schemaValidations
     }
   };
@@ -6642,10 +6642,10 @@ var DEFAULT_PRACTICE, DEFAULT_RATE_LIMIT_PRACTICE, DEFAULT_TRIGGER, DEFAULT_RESP
 var init_policy = __esm({
   "src/generators/openappsec/policy.ts"() {
     "use strict";
-    DEFAULT_PRACTICE = "writ-threat-prevention";
-    DEFAULT_RATE_LIMIT_PRACTICE = "writ-rate-limit";
-    DEFAULT_TRIGGER = "writ-log-trigger";
-    DEFAULT_RESPONSE = "writ-blocked-response";
+    DEFAULT_PRACTICE = "x-security-threat-prevention";
+    DEFAULT_RATE_LIMIT_PRACTICE = "x-security-rate-limit";
+    DEFAULT_TRIGGER = "x-security-log-trigger";
+    DEFAULT_RESPONSE = "x-security-blocked-response";
     BYTE_UNITS = {
       B: 1,
       KB: 1024,
@@ -6666,7 +6666,7 @@ var init_openappsec = __esm({
     init_ssrf_policy_check();
     openappsecLastWarnings = [];
     HEADER = [
-      "# Generated by Writ \u2014 DO NOT EDIT BY HAND.",
+      "# Generated by x-security \u2014 DO NOT EDIT BY HAND.",
       "# Target: open-appsec.io (flat local_policy.yaml format)",
       "# Source: annotated OpenAPI spec (x-security)",
       "#",
@@ -6676,7 +6676,7 @@ var init_openappsec = __esm({
       "#    practice as `openapi-schema-validation.files:`. Mount both files at",
       "#    the same path inside the agent container (default: /ext/appsec/).",
       "#  - Per-property `mitigates:` hints and the full property tree are also",
-      "#    preserved under `writ-extended:` for Writ drift detection",
+      "#    preserved under `x-security-extended:` for x-security drift detection",
       "#    (open-appsec ignores unknown top-level keys).",
       "#  - Authentication (JWT/OAuth), authorization (rule-based), and request",
       "#    HMAC signatures are NOT enforceable by open-appsec \u2014 it is an L7",
@@ -6688,7 +6688,7 @@ var init_openappsec = __esm({
       "#    declares the anti-bot block but does not configure a provider.",
       "#  - The ML model may block attacks not explicitly in our policy (its",
       "#    default web-attacks heuristics). Such blocks are open-appsec doing",
-      "#    its own job, NOT Writ enforcement.",
+      "#    its own job, NOT x-security enforcement.",
       ""
     ].join("\n");
     openappsecGenerator = {
@@ -6714,7 +6714,7 @@ var init_openappsec = __esm({
           noRefs: true,
           sortKeys: false
         });
-        const fragmentContent = "# Generated by Writ \u2014 DO NOT EDIT BY HAND.\n# OpenAPI schema fragment for open-appsec schema validation.\n# Referenced by practices[].openapi-schema-validation.files: in policy.yaml.\n# Mount this file at the path declared there (default: /ext/appsec/openapi-schema.yaml).\n" + fragmentYaml;
+        const fragmentContent = "# Generated by x-security \u2014 DO NOT EDIT BY HAND.\n# OpenAPI schema fragment for open-appsec schema validation.\n# Referenced by practices[].openapi-schema-validation.files: in policy.yaml.\n# Mount this file at the path declared there (default: /ext/appsec/openapi-schema.yaml).\n" + fragmentYaml;
         return [
           { path: "openappsec/policy.yaml", content: policyContent, format: "yaml" },
           { path: "openappsec/openapi-schema.yaml", content: fragmentContent, format: "yaml" }
@@ -6730,7 +6730,7 @@ var init_openappsec = __esm({
             // needs baseline traffic to reach steady-state recall — under
             // prevent-learn with no learned state, it lets some malformed
             // payloads through and (b) per-property `mitigates:` hints are
-            // Writ-internal and not consumed by the agent.
+            // x-security-internal and not consumed by the agent.
             "request.schema": "partial",
             "request.contentType": "partial",
             "request.maxBodySize": "partial",
@@ -6790,10 +6790,10 @@ var init_metadata_blocks = __esm({
 
 // src/generators/firewall/iptables.ts
 function provenanceComment(endpoint, field, label) {
-  return `# writ: ${endpoint} ${field} -- ${label}`;
+  return `# x-security: ${endpoint} ${field} -- ${label}`;
 }
 function blockRule(entry, uid, endpoint, field) {
-  const inlineComment = `writ/${endpoint}/${field}`;
+  const inlineComment = `x-security/${endpoint}/${field}`;
   return {
     comment: provenanceComment(endpoint, field, entry.label),
     line: `-A OUTPUT -d ${entry.cidr} -m owner --uid-owner ${uid} -m comment --comment "${inlineComment}" -j DROP`,
@@ -6801,10 +6801,10 @@ function blockRule(entry, uid, endpoint, field) {
   };
 }
 function allowlistRule(fqdn, uid, endpoint, field) {
-  const inlineComment = `writ/${endpoint}/${field}/allow=${fqdn}`;
+  const inlineComment = `x-security/${endpoint}/${field}/allow=${fqdn}`;
   return {
     comment: provenanceComment(endpoint, field, `allow ${fqdn} (resolved at deploy)`),
-    line: `-A OUTPUT @@WRIT_RESOLVE:${fqdn}@@ -m owner --uid-owner ${uid} -m comment --comment "${inlineComment}" -j ACCEPT`,
+    line: `-A OUTPUT @@X_SECURITY_RESOLVE:${fqdn}@@ -m owner --uid-owner ${uid} -m comment --comment "${inlineComment}" -j ACCEPT`,
     family: "v4"
   };
 }
@@ -6860,11 +6860,11 @@ function buildIptablesV6(spec, opts = {}) {
 function renderRuleset(rules, family, uid) {
   const filtered = rules.filter((r5) => r5.family === family);
   const header15 = [
-    `# Generated by Writ \u2014 DO NOT EDIT.`,
+    `# Generated by XSecurity \u2014 DO NOT EDIT.`,
     `# Family: IP${family === "v4" ? "v4" : "v6"}`,
     `# Apply with: ${family === "v4" ? "iptables-restore" : "ip6tables-restore"} < this-file`,
-    `# Deploy wrapper must substitute @@WRIT_RESOLVE:<fqdn>@@ tokens`,
-    `# and ${"${WRIT_APP_UID}"} before applying.`,
+    `# Deploy wrapper must substitute @@X_SECURITY_RESOLVE:<fqdn>@@ tokens`,
+    `# and ${"${X_SECURITY_APP_UID}"} before applying.`,
     `*filter`,
     `:INPUT ACCEPT [0:0]`,
     `:FORWARD ACCEPT [0:0]`,
@@ -6875,9 +6875,9 @@ function renderRuleset(rules, family, uid) {
     body.push(rule.comment);
     body.push(rule.line);
   }
-  body.push(`# writ: * default-deny -- fail-closed terminator`);
+  body.push(`# x-security: * default-deny -- fail-closed terminator`);
   body.push(
-    `-A OUTPUT -m owner --uid-owner ${uid} -m comment --comment "writ/default-deny" -j DROP`
+    `-A OUTPUT -m owner --uid-owner ${uid} -m comment --comment "x-security/default-deny" -j DROP`
   );
   return [...header15, ...body, `COMMIT`, ``].join("\n");
 }
@@ -6886,7 +6886,7 @@ var init_iptables = __esm({
   "src/generators/firewall/iptables.ts"() {
     "use strict";
     init_metadata_blocks();
-    DEFAULT_UID = "${WRIT_APP_UID}";
+    DEFAULT_UID = "${X_SECURITY_APP_UID}";
   }
 });
 
@@ -6908,28 +6908,28 @@ function read(name) {
 function loadWrapperScripts() {
   return [
     {
-      filename: "writ-resolve.sh",
-      content: read("writ-resolve.sh"),
+      filename: "x-security-resolve.sh",
+      content: read("x-security-resolve.sh"),
       format: "text"
     },
     {
-      filename: "writ-refresh.sh",
-      content: read("writ-refresh.sh"),
+      filename: "x-security-refresh.sh",
+      content: read("x-security-refresh.sh"),
       format: "text"
     },
     {
-      filename: "writ-refresh.service",
-      content: read("writ-refresh.service"),
+      filename: "x-security-refresh.service",
+      content: read("x-security-refresh.service"),
       format: "conf"
     },
     {
-      filename: "writ-refresh.timer",
-      content: read("writ-refresh.timer"),
+      filename: "x-security-refresh.timer",
+      content: read("x-security-refresh.timer"),
       format: "conf"
     },
     {
-      filename: "writ.logrotate",
-      content: read("writ.logrotate"),
+      filename: "x-security.logrotate",
+      content: read("x-security.logrotate"),
       format: "conf"
     },
     {
@@ -7139,7 +7139,7 @@ var init_clusters = __esm({
   "src/generators/envoy/templates/clusters.ts"() {
     "use strict";
     init_yaml_util();
-    UPSTREAM_CLUSTER = "writ_upstream";
+    UPSTREAM_CLUSTER = "x_security_upstream";
     JWKS_CLUSTER = "jwks_cluster";
   }
 });
@@ -7184,7 +7184,7 @@ function denyLiteral(ruleClass) {
     "{",
     `    "allowed": false,`,
     `    "http_status": 403,`,
-    `    "headers": {"x-writ-rule": ${regoString(marker)}},`,
+    `    "headers": {"x-x-security-rule": ${regoString(marker)}},`,
     `    "body": ${regoString(marker)}`,
     "  }"
   ].join("\n  ");
@@ -7626,7 +7626,7 @@ function emitExtAuthzFilter(lines) {
   lines.push("        timeout: 0.5s");
   lines.push("      failure_mode_allow: false");
   lines.push("      include_peer_certificate: false");
-  lines.push("      # W17-A: forward OPA-emitted x-writ-rule marker downstream.");
+  lines.push("      # W17-A: forward OPA-emitted x-x-security-rule marker downstream.");
   lines.push("      with_request_body:");
   lines.push("        max_request_bytes: 8192");
   lines.push("        allow_partial_message: true");
@@ -7660,11 +7660,11 @@ function buildRegoPolicyInner(cfg) {
   const ssrf = cfg.ssrfPolicy ?? [];
   const abac = cfg.abac ?? [];
   const lines = [];
-  lines.push("# Writ \u2192 OPA \u2014 auto-generated. DO NOT EDIT BY HAND.");
-  lines.push(`# generator: writ-envoy/extauthz v${VERSION2}`);
+  lines.push("# x-security \u2192 OPA \u2014 auto-generated. DO NOT EDIT BY HAND.");
+  lines.push(`# generator: x-security-envoy/extauthz v${VERSION2}`);
   lines.push(`# source: ${cfg.specTitle} ${cfg.specVersion}`);
   lines.push("# Wave-10 E-3: rule-based authorization \u2192 ext_authz + OPA sidecar.");
-  lines.push("# Wave-17 W17-A: structured decision object emits per-class x-writ-rule");
+  lines.push("# Wave-17 W17-A: structured decision object emits per-class x-x-security-rule");
   lines.push("# headers (opa-bola-403, opa-jwt-claim-403, opa-default-403) so the scorer's");
   lines.push("# intent-attribution layer can map a denial back to the right defense-class.");
   lines.push("# Wave-18 W18-A: + opa-bfla-403 (rbac admin-only routes, principal-role check)");
@@ -7787,13 +7787,13 @@ function buildResponseSchemaConfig(items, specTitle, specVersion) {
     };
   });
   const cfg = {
-    $comment: "Writ \u2192 Envoy ext_proc response-schema contract. Auto-generated. DO NOT EDIT BY HAND. Consumed by an operator-supplied ext_proc gRPC ExternalProcessor that parses the response body as JSON and enforces these per-field typed constraints on the parsed value. Writ does NOT ship that processor; this file + the envoy.yaml ext_proc filter are scaffolding. No regex over raw bytes \u2014 the processor MUST JSON.parse.",
-    generator: "writ-envoy/ext_proc",
+    $comment: "x-security \u2192 Envoy ext_proc response-schema contract. Auto-generated. DO NOT EDIT BY HAND. Consumed by an operator-supplied ext_proc gRPC ExternalProcessor that parses the response body as JSON and enforces these per-field typed constraints on the parsed value. x-security does NOT ship that processor; this file + the envoy.yaml ext_proc filter are scaffolding. No regex over raw bytes \u2014 the processor MUST JSON.parse.",
+    generator: "x-security-envoy/ext_proc",
     source: `${specTitle} ${specVersion}`,
     enforcement: {
       status: "override-only",
       enforcedBy: `operator-supplied ext_proc gRPC ExternalProcessor (cluster ${EXT_PROC_CLUSTER}, host ${EXT_PROC_HOST}:${EXT_PROC_PORT})`,
-      operatorMustSupply: "A gRPC service implementing envoy.service.ext_proc.v3.ExternalProcessor that JSON-parses the response body and evaluates the rules below. Writ does not bundle it; the OPA sidecar (opa_grpc) is ext_authz-only.",
+      operatorMustSupply: "A gRPC service implementing envoy.service.ext_proc.v3.ExternalProcessor that JSON-parses the response body and evaluates the rules below. x-security does not bundle it; the OPA sidecar (opa_grpc) is ext_authz-only.",
       dataPath: "Envoy ext_proc filter streams the response body (processing_mode: response_body_mode=BUFFERED) to the processor, which returns an ImmediateResponse(502) to block a schema-violating body or continues otherwise."
     },
     routes
@@ -7803,7 +7803,7 @@ function buildResponseSchemaConfig(items, specTitle, specVersion) {
 function emitExtProcFilter(lines) {
   lines.push("  # response.schema validation (override-only): real JSON parse happens in the");
   lines.push("  # operator-supplied ext_proc processor; this filter only delivers the body.");
-  lines.push("  # Writ does NOT ship the processor \u2014 see ext_proc/response-schema.json.");
+  lines.push("  # x-security does NOT ship the processor \u2014 see ext_proc/response-schema.json.");
   lines.push("  - name: envoy.filters.http.ext_proc");
   lines.push("    typed_config:");
   lines.push('      "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor');
@@ -7842,9 +7842,9 @@ var init_ext_proc = __esm({
   "src/generators/envoy/templates/ext_proc.ts"() {
     "use strict";
     init_extauthz_rego_util();
-    EXT_PROC_CLUSTER = "writ_ext_proc";
+    EXT_PROC_CLUSTER = "x_security_ext_proc";
     EXT_PROC_PORT = 9292;
-    EXT_PROC_HOST = "writ-respval";
+    EXT_PROC_HOST = "x-security-respval";
   }
 });
 
@@ -7903,7 +7903,7 @@ function emitSinkTypedConfig(lines, indent, r5) {
     lines.push(`${indent}  typed_config:`);
     lines.push(`${indent}    "@type": type.googleapis.com/envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig`);
     lines.push(`${indent}    common_config:`);
-    lines.push(`${indent}      log_name: writ_access`);
+    lines.push(`${indent}      log_name: x_security_access`);
     lines.push(`${indent}      grpc_service:`);
     lines.push(`${indent}        envoy_grpc:`);
     lines.push(`${indent}          cluster_name: ${ALS_CLUSTER}`);
@@ -7929,11 +7929,11 @@ function eventFilter(event) {
   ];
   switch (event) {
     case "auth-failure":
-      return f5(401, "writ_log_401");
+      return f5(401, "x_security_log_401");
     case "authz-deny":
-      return f5(403, "writ_log_403");
+      return f5(403, "x_security_log_403");
     case "rate-limit-trip":
-      return f5(429, "writ_log_429");
+      return f5(429, "x_security_log_429");
     // injection-block / request / response have no single-status signature: they
     // ride the always-on base logger (which records every transaction). Faking a
     // narrower filter would mis-route, so we keep them on the base logger.
@@ -7954,7 +7954,7 @@ function emitAccessLog(lines, spec, prefix = "                ") {
     lines.push(`${prefix}          inline_string: "${DEFAULT_FORMAT}"`);
     return;
   }
-  lines.push(`${prefix}  # Writ logging (SSEC-AUDIT) \u2014 NATIVE/full.`);
+  lines.push(`${prefix}  # x-security logging (SSEC-AUDIT) \u2014 NATIVE/full.`);
   lines.push(`${prefix}  # events: ${r5.events.join(", ")}`);
   lines.push(`${prefix}  # sink: ${r5.sink}${r5.sinkRef ? ` (sinkRef ${r5.sinkRef})` : ""}; piiRedaction: ${r5.piiRedaction}`);
   if (r5.sink === "syslog") {
@@ -8002,9 +8002,9 @@ var init_access_log = __esm({
   "src/generators/envoy/templates/access_log.ts"() {
     "use strict";
     init_yaml_util();
-    ALS_CLUSTER = "writ_access_log";
+    ALS_CLUSTER = "x_security_access_log";
     ALS_PORT = 9001;
-    ALS_HOST = "writ-log-collector";
+    ALS_HOST = "x-security-log-collector";
     DEFAULT_FORMAT = '[%START_TIME%] \\"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%\\" %RESPONSE_CODE% %RESPONSE_FLAGS% %RESPONSE_CODE_DETAILS% bytes=%BYTES_RECEIVED%/%BYTES_SENT% ua=\\"%REQ(USER-AGENT)%\\"\\n';
   }
 });
@@ -8156,7 +8156,7 @@ function emitRouteIpPolicy(lines, pol) {
   if (pol.deny.length) {
     lines.push("                action: DENY");
     lines.push("                policies:");
-    lines.push("                  writ-ip-deny:");
+    lines.push("                  x-security-ip-deny:");
     lines.push("                    permissions: [{ any: true }]");
     lines.push("                    principals:");
     for (const c5 of pol.deny) {
@@ -8167,7 +8167,7 @@ function emitRouteIpPolicy(lines, pol) {
   } else {
     lines.push("                action: ALLOW");
     lines.push("                policies:");
-    lines.push("                  writ-ip-allow:");
+    lines.push("                  x-security-ip-allow:");
     lines.push("                    permissions: [{ any: true }]");
     lines.push("                    principals:");
     for (const c5 of pol.allow) {
@@ -8210,7 +8210,7 @@ function collectJwtEndpoints(spec) {
   }
   if (!jwt.length || !jwksUri) return null;
   return {
-    providerName: "writ_jwt",
+    providerName: "x_security_jwt",
     issuer,
     audiences: [...audiences],
     jwksUri,
@@ -8233,7 +8233,7 @@ function emitJwtAuthnFilter(lines, jwt) {
   lines.push("          from_headers:");
   lines.push(`            - name: ${yamlString(jwt.headerName)}`);
   lines.push('              value_prefix: "Bearer "');
-  lines.push("          forward_payload_header: x-writ-jwt-payload");
+  lines.push("          forward_payload_header: x-x-security-jwt-payload");
   lines.push(`          payload_in_metadata: ${jwt.providerName}`);
   lines.push("          remote_jwks:");
   lines.push("            http_uri:");
@@ -8266,7 +8266,7 @@ function emitLuaFilter(lines, luaSource) {
   lines.push("  - name: envoy.filters.http.lua");
   lines.push("    typed_config:");
   lines.push('      "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua');
-  lines.push("      # Residual Writ Lua \u2014 handles fields with no native filter equivalent");
+  lines.push("      # Residual x-security Lua \u2014 handles fields with no native filter equivalent");
   lines.push("      # (duplicateParamPolicy, headerInjectionGuard, request.signature, \u2026).");
   lines.push("      inline_code: |");
   for (const ln of luaSource.replace(/\n$/, "").split("\n")) {
@@ -8307,7 +8307,7 @@ function emitRbacFilter(lines, rbac, jwtName) {
   lines.push("        policies:");
   for (const entry of rbac) {
     for (const role of entry.roles) {
-      const polName = `writ-rbac-${safeStatId(entry.endpoint)}-${role.replace(/[^a-z0-9]+/gi, "-")}`;
+      const polName = `x-security-rbac-${safeStatId(entry.endpoint)}-${role.replace(/[^a-z0-9]+/gi, "-")}`;
       lines.push(`          ${yamlString(polName)}:`);
       lines.push("            permissions:");
       lines.push("              - url_path:");
@@ -8347,7 +8347,7 @@ function collectRateLimits(spec) {
       maxTokens,
       tokensPerFill: primary.requests,
       fillIntervalSec: sec,
-      statPrefix: `writ_${safeStatId(ep)}_ratelimit`
+      statPrefix: `x_security_${safeStatId(ep)}_ratelimit`
     });
   }
   return out;
@@ -8356,12 +8356,12 @@ function emitLocalRateLimitChain(lines) {
   lines.push("  - name: envoy.filters.http.local_ratelimit");
   lines.push("    typed_config:");
   lines.push('      "@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit');
-  lines.push("      stat_prefix: writ_chain_ratelimit");
+  lines.push("      stat_prefix: x_security_chain_ratelimit");
   lines.push("      filter_enabled:");
-  lines.push("        runtime_key: writ.local_ratelimit_enabled");
+  lines.push("        runtime_key: x-security.local_ratelimit_enabled");
   lines.push("        default_value: { numerator: 100, denominator: HUNDRED }");
   lines.push("      filter_enforced:");
-  lines.push("        runtime_key: writ.local_ratelimit_enforced");
+  lines.push("        runtime_key: x-security.local_ratelimit_enforced");
   lines.push("        default_value: { numerator: 0, denominator: HUNDRED }");
 }
 var DEFAULT_BURST_MULTIPLIER2, DEFAULT_BURST_MINIMUM_HEADROOM2;
@@ -8505,7 +8505,7 @@ function emitRouteEntry(lines, ep, ctx, upstreamCluster) {
       lines.push("              default_value: { numerator: 100, denominator: HUNDRED }");
       lines.push("            response_headers_to_add:");
       lines.push("              - append: false");
-      lines.push("                header: { key: x-writ-ratelimit, value: enforced }");
+      lines.push("                header: { key: x-x-security-ratelimit, value: enforced }");
     }
     if (cors) {
       lines.push("          envoy.filters.http.cors:");
@@ -8557,8 +8557,8 @@ function buildEnvoyYaml(opts) {
     adminPort = 9901
   } = opts;
   const lines = [];
-  lines.push("# Writ \u2192 Envoy \u2014 auto-generated. DO NOT EDIT BY HAND.");
-  lines.push(`# generator: writ-envoy v${VERSION3}`);
+  lines.push("# x-security \u2192 Envoy \u2014 auto-generated. DO NOT EDIT BY HAND.");
+  lines.push(`# generator: x-security-envoy v${VERSION3}`);
   lines.push(`# source: ${spec.info.title} ${spec.info.version}`);
   lines.push("");
   const ruleBased = collectRuleBased(spec);
@@ -8583,7 +8583,7 @@ function buildEnvoyYaml(opts) {
   const globalBodyCap = smallestBodyLimit2(spec.endpoints);
   lines.push("static_resources:");
   lines.push("  listeners:");
-  lines.push("    - name: writ_listener");
+  lines.push("    - name: x_security_listener");
   lines.push("      address:");
   lines.push(`        socket_address: { address: 0.0.0.0, port_value: ${listenerPort} }`);
   lines.push("      filter_chains:");
@@ -8591,12 +8591,12 @@ function buildEnvoyYaml(opts) {
   lines.push("            - name: envoy.filters.network.http_connection_manager");
   lines.push("              typed_config:");
   lines.push('                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager');
-  lines.push("                stat_prefix: writ_hcm");
+  lines.push("                stat_prefix: x_security_hcm");
   emitAccessLog(lines, spec);
   lines.push("                route_config:");
-  lines.push("                  name: writ_routes");
+  lines.push("                  name: x_security_routes");
   lines.push("                  virtual_hosts:");
-  lines.push("                    - name: writ_vhost");
+  lines.push("                    - name: x_security_vhost");
   lines.push('                      domains: ["*"]');
   lines.push("                      routes:");
   const sortedEps = [...spec.endpoints].sort(
@@ -8709,7 +8709,7 @@ function buildEndpointBlock2(opts) {
     body.push(`      -- request.headerInjectionGuard: reject CR/LF/NUL in header values`);
     body.push(`      for k, v in pairs(headers) do`);
     body.push(`        if type(v) == "string" and string.match(v, "[\\r\\n\\0]") then`);
-    body.push(`          request_handle:respond({[":status"] = "400"}, "Writ: invalid header value")`);
+    body.push(`          request_handle:respond({[":status"] = "400"}, "x-security: invalid header value")`);
     body.push(`          return`);
     body.push(`        end`);
     body.push(`      end`);
@@ -8723,7 +8723,7 @@ function buildEndpointBlock2(opts) {
     body.push(`        for kv in string.gmatch(string.sub(q_string, q_pos + 1), "([^&]+)") do`);
     body.push(`          local k = string.match(kv, "^([^=]+)")`);
     body.push(`          if k and seen[k] then`);
-    body.push(`            request_handle:respond({[":status"] = "400"}, "Writ: duplicate query parameter")`);
+    body.push(`            request_handle:respond({[":status"] = "400"}, "x-security: duplicate query parameter")`);
     body.push(`            return`);
     body.push(`          end`);
     body.push(`          if k then seen[k] = true end`);
@@ -8740,7 +8740,7 @@ function buildEndpointBlock2(opts) {
       body.push(`      if string.match(ct, ${luaStr4(pat)}) then ct_ok = true end`);
     }
     body.push(`      if not ct_ok then`);
-    body.push(`        request_handle:respond({[":status"] = "415"}, "Writ: unsupported Content-Type")`);
+    body.push(`        request_handle:respond({[":status"] = "415"}, "x-security: unsupported Content-Type")`);
     body.push(`        return`);
     body.push(`      end`);
   }
@@ -8749,7 +8749,7 @@ function buildEndpointBlock2(opts) {
     body.push(`      -- request.maxBodySize=${bytes} bytes`);
     body.push(`      local cl = tonumber(request_handle:headers():get("content-length") or "0") or 0`);
     body.push(`      if cl > ${bytes} then`);
-    body.push(`        request_handle:respond({[":status"] = "413"}, "Writ: request body exceeds endpoint limit")`);
+    body.push(`        request_handle:respond({[":status"] = "413"}, "x-security: request body exceeds endpoint limit")`);
     body.push(`        return`);
     body.push(`      end`);
   }
@@ -8757,20 +8757,20 @@ function buildEndpointBlock2(opts) {
     body.push(`      -- request.signature (${policy.request.signature.algorithm}): TODO \u2014 needs body filter callback`);
   }
   body.push(`    end`);
-  const startMarker = `    -- writ:${endpoint.method}:${endpoint.path}:START`;
-  const endMarker = `    -- writ:END`;
+  const startMarker = `    -- xSecurity:${endpoint.method}:${endpoint.path}:START`;
+  const endMarker = `    -- xSecurity:END`;
   return [startMarker, ...body, endMarker].join("\n");
 }
 function buildLuaModule(specTitle, specVersion, blocks, methodMap) {
   const lines = [];
-  lines.push(`-- Writ \u2192 Envoy residual Lua filter \u2014 auto-generated. DO NOT EDIT BY HAND.`);
-  lines.push(`-- generator: writ-envoy v${VERSION4}`);
+  lines.push(`-- x-security \u2192 Envoy residual Lua filter \u2014 auto-generated. DO NOT EDIT BY HAND.`);
+  lines.push(`-- generator: x-security-envoy v${VERSION4}`);
   lines.push(`-- source: ${specTitle} ${specVersion}`);
   lines.push(`-- This module handles ONLY fields with no native Envoy filter equivalent.`);
   lines.push(`-- JWT auth, RBAC, rate-limit, and CORS are enforced by their native filters`);
   lines.push(`-- earlier in the chain (jwt_authn, rbac, local_ratelimit, cors).`);
   lines.push("");
-  lines.push(`-- writ:method-allowlist:START`);
+  lines.push(`-- xSecurity:method-allowlist:START`);
   lines.push(`local method_allowlist = {`);
   const sorted = [...methodMap].sort((a5, b5) => a5.path.localeCompare(b5.path));
   for (const e5 of sorted) {
@@ -8778,7 +8778,7 @@ function buildLuaModule(specTitle, specVersion, blocks, methodMap) {
     lines.push(`  { pattern = ${luaStr4(e5.pattern)}, methods = { ${methods.map(luaStr4).join(", ")} } },`);
   }
   lines.push(`}`);
-  lines.push(`-- writ:method-allowlist:END`);
+  lines.push(`-- xSecurity:method-allowlist:END`);
   lines.push("");
   lines.push(`function envoy_on_request(request_handle)`);
   lines.push(`  local headers = request_handle:headers()`);
@@ -8797,7 +8797,7 @@ function buildLuaModule(specTitle, specVersion, blocks, methodMap) {
   lines.push(`        if m == method then method_ok = true; break end`);
   lines.push(`      end`);
   lines.push(`      if not method_ok then`);
-  lines.push(`        request_handle:respond({[":status"] = "405"}, "Writ: method not allowed")`);
+  lines.push(`        request_handle:respond({[":status"] = "405"}, "x-security: method not allowed")`);
   lines.push(`        return`);
   lines.push(`      end`);
   lines.push(`      break`);
@@ -8875,7 +8875,7 @@ var init_envoy = __esm({
     init_extauthz();
     init_ext_proc();
     ENVOY_PATH = "envoy.yaml";
-    LUA_PATH = "writ.lua";
+    LUA_PATH = "x-security.lua";
     OPA_POLICY_PATH = "opa/policy.rego";
     RESPONSE_SCHEMA_PATH = "ext_proc/response-schema.json";
     envoyLastWarnings = [];
@@ -9007,7 +9007,7 @@ var init_envoy = __esm({
             // ext_proc scaffolding: envoy.filters.http.ext_proc + processing
             // cluster + ext_proc/response-schema.json (typed per-field constraints,
             // stripUnknownFields). The body IS delivered to a processor that does a
-            // real JSON.parse — NO regex over raw bytes. But Writ does not
+            // real JSON.parse — NO regex over raw bytes. But x-security does not
             // ship the processor (the opa_grpc sidecar is ext_authz-only; ext_proc
             // is an unmerged upstream PR on a different port). Enforcement depends
             // on an operator-supplied gRPC ExternalProcessor, so the honest status
@@ -9022,7 +9022,7 @@ var init_envoy = __esm({
             // carry a per-route `forbidArrayRoot` flag the operator processor reads).
             // Envoy ships no native response-body shape inspector and a Lua regex for
             // a leading '[' over raw bytes is the Rule D-1 masked-quality shortcut.
-            // Writ does NOT ship the processor → override-only, never full.
+            // x-security does NOT ship the processor → override-only, never full.
             "response.forbidArrayRoot": "override-only",
             "response.headers.csp": "full",
             // wave-22: per-route response_headers_to_add
@@ -9037,7 +9037,7 @@ var init_envoy = __esm({
             // cannot evaluate per-operation/per-resolver authorization. The only
             // honest path is the same ext_proc handoff as response.schema — stream
             // the GraphQL POST body to an operator-supplied GraphQL-aware processor
-            // that parses the query and enforces authz. Writ ships NO such
+            // that parses the query and enforces authz. x-security ships NO such
             // processor, so this is override-only, NEVER full. (Schema pins this
             // override-only on every target.) No scaffolding is emitted this wave —
             // the matrix is honest so --strict-fidelity/--feasible flag the gap.
@@ -58691,7 +58691,7 @@ async function runGenerate(specPath, opts) {
   if (opts.strictFidelity) {
     assertFidelity(spec, generator.capabilities(), { targetName: target });
   }
-  const outDir = opts.out ?? path.join(process.cwd(), "writ-out", target);
+  const outDir = opts.out ?? path.join(process.cwd(), "x-security-out", target);
   const artifactPaths = [];
   if (!opts.dryRun) {
     await mkdir(outDir, { recursive: true });
@@ -59024,7 +59024,7 @@ function fieldForSlot(slot) {
 }
 function extractRateLimitThreshold(block) {
   for (const l3 of block.lines) {
-    const m3 = /SecRule\s+(?:IP|USER|GLOBAL|TX):(?:RATE_|writ_rl_|rl_)([A-Za-z0-9_]+?)(?:_burst)?\s+"@gt\s+(\d+)"/.exec(l3);
+    const m3 = /SecRule\s+(?:IP|USER|GLOBAL|TX):(?:RATE_|x_security_rl_|rl_)([A-Za-z0-9_]+?)(?:_burst)?\s+"@gt\s+(\d+)"/.exec(l3);
     if (m3 && m3[2] && !l3.includes("_burst")) return Number(m3[2]);
   }
   return null;
@@ -59122,7 +59122,7 @@ function diffEndpoint(ep, expectedBlocks, actualBlocks) {
       severity: "LOW",
       expected: "absent",
       actual: actBlock.ruleId,
-      message: `Unknown Writ rule slot ${slot} (id=${actBlock.ruleId}) on deployed config`
+      message: `Unknown x-security rule slot ${slot} (id=${actBlock.ruleId}) on deployed config`
     });
   }
   return issues;
@@ -59223,7 +59223,8 @@ function rateToPerSecond(v) {
   return unit === "h" ? n2 / 3600 : unit === "m" ? n2 / 60 : n2;
 }
 function severityForKey(key, expected, actual) {
-  if ((key === "USE_AUTH_BASIC" || key === "USE_MODSECURITY" || key === "WRIT_AUTH_TYPE" || key === "WRIT_JWKS_URI" || key === "USE_CLIENT_SSL" || key === "WRIT_AUTH_HEADER" || key === "MODSECURITY_RULES_FILE") && (actual === void 0 || actual === "no" || actual === "")) {
+  if ((key === "USE_AUTH_BASIC" || key === "USE_MODSECURITY" || // Accept legacy WRIT_* keys on pre-rebrand deployments (back-compat).
+  key === "X_SECURITY_AUTH_TYPE" || key === "WRIT_AUTH_TYPE" || key === "X_SECURITY_JWKS_URI" || key === "WRIT_JWKS_URI" || key === "USE_CLIENT_SSL" || key === "X_SECURITY_AUTH_HEADER" || key === "WRIT_AUTH_HEADER" || key === "MODSECURITY_RULES_FILE") && (actual === void 0 || actual === "no" || actual === "")) {
     return "CRITICAL";
   }
   if (/^LIMIT_REQ_RATE_\d+$/.test(key)) {
@@ -59460,7 +59461,7 @@ function diffRateLimitPractice(expected, actual) {
   if (!actual) {
     issues.push({
       endpoint: "*",
-      field: "practices.writ-rate-limit",
+      field: "practices.x-security-rate-limit",
       severity: "CRITICAL",
       expected: "present",
       actual: "missing",
@@ -59517,8 +59518,8 @@ async function detectOpenAppSecDrift(spec, opts) {
   const expectedArtifacts = await Promise.resolve(openappsecGenerator.generate(spec));
   const expectedDoc = asDoc(yaml4.load(expectedArtifacts[0]?.content ?? ""));
   const issues = [];
-  const expSV = expectedDoc["writ-extended"]?.["schema-validation"] ?? [];
-  const actSV = actualDoc["writ-extended"]?.["schema-validation"] ?? [];
+  const expSV = expectedDoc["x-security-extended"]?.["schema-validation"] ?? [];
+  const actSV = actualDoc["x-security-extended"]?.["schema-validation"] ?? [];
   const actByKey = new Map(actSV.map((s) => [svKey(s), s]));
   for (const e5 of expSV) {
     const key = svKey(e5);
@@ -59548,8 +59549,8 @@ async function detectOpenAppSecDrift(spec, opts) {
   }
   const expPractices = expectedDoc.practices ?? [];
   const actPractices = actualDoc.practices ?? [];
-  const expRL = expPractices.find((p2) => p2.name === "writ-rate-limit");
-  const actRL = actPractices.find((p2) => p2.name === "writ-rate-limit");
+  const expRL = expPractices.find((p2) => p2.name === "x-security-rate-limit");
+  const actRL = actPractices.find((p2) => p2.name === "x-security-rate-limit");
   issues.push(...diffRateLimitPractice(expRL, actRL));
   return {
     kind: "drift",
@@ -59574,7 +59575,7 @@ function normalizeRuleLine(line) {
 function destOf(rule) {
   const cidr = /-d\s+(\S+)/.exec(rule);
   if (cidr && cidr[1]) return cidr[1];
-  const fqdn = /@@WRIT_RESOLVE:([^@]+)@@/.exec(rule);
+  const fqdn = /@@(?:X_SECURITY|WRIT)_RESOLVE:([^@]+)@@/.exec(rule);
   if (fqdn && fqdn[1]) return `fqdn:${fqdn[1]}`;
   return "";
 }
@@ -59584,7 +59585,7 @@ function extractTagged(content) {
   for (let i5 = 0; i5 < lines.length; i5++) {
     const l3 = lines[i5];
     if (!l3) continue;
-    if (!l3.startsWith("# writ:")) continue;
+    if (!l3.startsWith("# x-security:")) continue;
     let j5 = i5 + 1;
     while (j5 < lines.length) {
       const next = lines[j5];
@@ -59593,7 +59594,7 @@ function extractTagged(content) {
     }
     const ruleLine = lines[j5];
     if (!ruleLine) continue;
-    const body = l3.slice("# writ:".length).trim();
+    const body = l3.slice("# x-security:".length).trim();
     const sepIdx = body.indexOf(" -- ");
     const tag2 = sepIdx >= 0 ? body.slice(0, sepIdx).trim() : body;
     out.push({
@@ -59667,7 +59668,7 @@ function diffRuleset(family, expected, actual) {
         severity: "LOW",
         expected: void 0,
         actual: a5.rule,
-        message: `Unknown Writ-tagged firewall (${family}) rule: ${a5.comment}`
+        message: `Unknown XSecurity-tagged firewall (${family}) rule: ${a5.comment}`
       });
     }
   }
@@ -59834,7 +59835,7 @@ function extractRateLimitStatPrefixes(rawYaml) {
       }
       if (node && typeof node === "object") {
         const obj = node;
-        if (typeof obj.stat_prefix === "string" && obj.stat_prefix !== "writ_chain_ratelimit" && obj.stat_prefix !== "writ_hcm") {
+        if (typeof obj.stat_prefix === "string" && obj.stat_prefix !== "x_security_chain_ratelimit" && obj.stat_prefix !== "x_security_hcm") {
           if (/_ratelimit$/.test(obj.stat_prefix)) out.add(obj.stat_prefix);
         }
         for (const v of Object.values(obj)) walk(v);
@@ -59934,7 +59935,7 @@ async function readSources(opts) {
         envoyYaml2 = "";
       }
       try {
-        lua = await readFile8(path3.join(opts.filePath, "writ.lua"), "utf8");
+        lua = await readFile8(path3.join(opts.filePath, "x-security.lua"), "utf8");
       } catch {
         lua = null;
       }
@@ -59950,7 +59951,7 @@ async function detectEnvoyDrift(spec, opts) {
   const actualLua = actualLuaFile ?? extractInlineLua(actualYaml) ?? "";
   const expectedArtifacts = await Promise.resolve(envoyGenerator.generate(spec));
   const expectedYaml = expectedArtifacts.find((a5) => a5.path === "envoy.yaml")?.content ?? "";
-  const expectedLua = expectedArtifacts.find((a5) => a5.path === "writ.lua")?.content ?? "";
+  const expectedLua = expectedArtifacts.find((a5) => a5.path === "x-security.lua")?.content ?? "";
   const expectedBlocks = extractEndpointBlocks(expectedLua);
   const actualBlocks = extractEndpointBlocks(actualLua);
   const issues = [];
@@ -60004,7 +60005,7 @@ async function detectEnvoyDrift(spec, opts) {
     const authz = ep.policy.authorization;
     if (!authz || authz.type !== "rbac" || !authz.roles?.length) continue;
     for (const role of authz.roles) {
-      const fragment = `"writ-rbac-`;
+      const fragment = `"x-security-rbac-`;
       const roleFragment = role.replace(/[^a-z0-9]+/gi, "-");
       if (!deployedHasRbacPolicy(actualYaml, fragment) || !actualYaml.includes(`-${roleFragment}":`)) {
         issues.push({
@@ -60026,7 +60027,7 @@ async function detectEnvoyDrift(spec, opts) {
       severity: "LOW",
       expected: "absent",
       actual: "present",
-      message: `Unknown Writ-tagged endpoint block in deployed Lua: ${block.method} ${block.pathTemplate}`
+      message: `Unknown x-security-tagged endpoint block in deployed Lua: ${block.method} ${block.pathTemplate}`
     });
   }
   return {
@@ -60042,8 +60043,8 @@ var init_envoy2 = __esm({
     "use strict";
     init_envoy();
     init_kong_shared();
-    START_RE = /^\s*--\s*writ:([A-Z]+):(.+):START\s*$/;
-    END_RE = /^\s*--\s*writ:END\s*$/;
+    START_RE = /^\s*--\s*xSecurity:([A-Z]+):(.+):START\s*$/;
+    END_RE = /^\s*--\s*xSecurity:END\s*$/;
   }
 });
 
@@ -60242,7 +60243,7 @@ function buildLog(toolName, rules, results) {
         tool: {
           driver: {
             name: toolName,
-            informationUri: "https://github.com/writ/writ",
+            informationUri: "https://github.com/ZeeshanSultan/x-security",
             rules
           }
         },
@@ -60279,7 +60280,7 @@ function driftToSarif(r5, specPath) {
       properties: { severity: i5.severity }
     };
   });
-  return buildLog("writ-drift", Array.from(ruleSet.values()), results);
+  return buildLog("x-security-drift", Array.from(ruleSet.values()), results);
 }
 function owaspToSarif(r5, specPath) {
   const rules = [
@@ -60301,7 +60302,7 @@ function owaspToSarif(r5, specPath) {
       }
     ]
   }));
-  return buildLog("writ-owasp", rules, results);
+  return buildLog("x-security-owasp", rules, results);
 }
 var init_sarif = __esm({
   "src/reporters/sarif.ts"() {
@@ -60473,9 +60474,9 @@ function buildComposePlan(opts) {
   const upstreamPort = opts.upstreamPort ?? 18080;
   const gatewayPort = opts.gatewayPort ?? 18e3;
   const suffix = randomSuffix();
-  const network = `writ-${opts.target}-net-${suffix}`;
-  const upstreamName = `writ-${opts.target}-upstream-${suffix}`;
-  const gatewayName = `writ-${opts.target}-gateway-${suffix}`;
+  const network = `x-security-${opts.target}-net-${suffix}`;
+  const upstreamName = `x-security-${opts.target}-upstream-${suffix}`;
+  const gatewayName = `x-security-${opts.target}-gateway-${suffix}`;
   const image = GATEWAY_IMAGE[opts.target];
   let gatewayEnv = "";
   if (opts.target === "kong") {
@@ -61103,9 +61104,9 @@ function fileHasWritHeader(container, path30) {
   });
   if (r5.error || r5.status !== 0) return false;
   const head = r5.stdout || "";
-  return WRIT_HEADER_MARKERS.some((m3) => head.includes(m3));
+  return X_SECURITY_HEADER_MARKERS.some((m3) => head.includes(m3));
 }
-function writRulesAreIncluded(nginxDump, container) {
+function xSecurityRulesAreIncluded(nginxDump, container) {
   if (!nginxDump) return true;
   const lines = nginxDump.split("\n");
   const includes = [];
@@ -61113,12 +61114,12 @@ function writRulesAreIncluded(nginxDump, container) {
     const m3 = line.match(/^\s*Include\s+(\S+)/i);
     if (m3 && m3[1]) includes.push(m3[1]);
   }
-  if (includes.some((i5) => /writ/i.test(i5))) return true;
+  if (includes.some((i5) => /x-security|writ/i.test(i5))) return true;
   if (!container) return false;
   const globs = includes.filter((i5) => /[*?[]/.test(i5));
   for (const glob of globs) {
     const matched = listGlobInContainer(container, glob);
-    if (matched.some((p2) => /writ/i.test(p2))) return true;
+    if (matched.some((p2) => /x-security|writ/i.test(p2))) return true;
     for (const p2 of matched) {
       if (fileHasWritHeader(container, p2)) return true;
     }
@@ -61186,7 +61187,7 @@ function scanEmittedRules(directives) {
   }
   return out;
 }
-var SECTION_BANNER, RULE_ID_RE2, SEC_RULE_LINE, RULES_ERROR_RE, GENERIC_PARSE_ERR_RE, RULES_LOADED_SUMMARY, WRIT_HEADER_MARKERS, modsecNginxReader;
+var SECTION_BANNER, RULE_ID_RE2, SEC_RULE_LINE, RULES_ERROR_RE, GENERIC_PARSE_ERR_RE, RULES_LOADED_SUMMARY, X_SECURITY_HEADER_MARKERS, modsecNginxReader;
 var init_modsec_nginx = __esm({
   "src/verify/readers/modsec-nginx.ts"() {
     "use strict";
@@ -61197,9 +61198,9 @@ var init_modsec_nginx = __esm({
     RULES_ERROR_RE = /ModSecurity:\s*(?:Rules error\.?\s*)?File:\s*([^.]+?)\.\s*Line:\s*(\d+)\.\s*Column:\s*(\d+)\.\s*(.*)$/;
     GENERIC_PARSE_ERR_RE = /ModSecurity:\s*(Something wrong with [^.\n]+|SecDefaultActions[^.\n]+)/;
     RULES_LOADED_SUMMARY = /rules loaded inline\/local\/remote:\s*(\d+)\/(\d+)\/(\d+)/i;
-    WRIT_HEADER_MARKERS = [
-      "Writ \u2192 Coraza",
-      "generator: writ-coraza"
+    X_SECURITY_HEADER_MARKERS = [
+      "x-security \u2192 Coraza",
+      "generator: x-security-coraza"
     ];
     modsecNginxReader = {
       async readEmittedArtifacts(spec) {
@@ -61216,12 +61217,12 @@ var init_modsec_nginx = __esm({
         const out = [];
         const nginxDump = await readNginxConfigDump(gateway);
         const container = gateway.startsWith("docker:") ? gateway.slice("docker:".length) : void 0;
-        const included = writRulesAreIncluded(nginxDump, container);
+        const included = xSecurityRulesAreIncluded(nginxDump, container);
         if (nginxDump && !included) {
           out.push({
             id: "__not-included__",
             kind: "coraza-rule",
-            rejectionReason: "Writ rules file is not Include'd by the running nginx config (nginx -T) \u2014 every emitted rule is unloaded"
+            rejectionReason: "x-security rules file is not Include'd by the running nginx config (nginx -T) \u2014 every emitted rule is unloaded"
           });
         }
         for (const line of raw.split("\n")) {
@@ -61266,7 +61267,7 @@ var init_modsec_nginx = __esm({
           diagnostics.push(`could not find "rules loaded inline/local/remote" startup line \u2014 coverage inferred from parse-error lines only`);
         }
         if (notIncluded) {
-          diagnostics.push(notIncluded.rejectionReason ?? "Writ rules file not included by gateway config");
+          diagnostics.push(notIncluded.rejectionReason ?? "x-security rules file not included by gateway config");
         }
         const rejectionsByLine = /* @__PURE__ */ new Map();
         const genericRejections = [];
@@ -61283,7 +61284,7 @@ var init_modsec_nginx = __esm({
         }
         const rows = [];
         const everythingRejected = !!notIncluded || summaryKnown && totalLoadedFromSummary === 0;
-        const genericReason = notIncluded?.rejectionReason ?? genericRejections[0]?.rejectionReason ?? (everythingRejected ? "no Writ rules loaded (file likely not included by nginx, or parse aborted at engine-globals)" : "");
+        const genericReason = notIncluded?.rejectionReason ?? genericRejections[0]?.rejectionReason ?? (everythingRejected ? "no x-security rules loaded (file likely not included by nginx, or parse aborted at engine-globals)" : "");
         for (const [endpoint, arts] of byEndpoint) {
           const rejected = [];
           let loadedCount = 0;
@@ -61983,8 +61984,8 @@ function parseEmittedSnippet(yamlText) {
   collectRbacPolicyNames(doc, rbacPolicies);
   const ratelimitStatPrefixes = /* @__PURE__ */ new Set();
   collectStatPrefixes(doc, ratelimitStatPrefixes);
-  ratelimitStatPrefixes.delete("writ_chain_ratelimit");
-  ratelimitStatPrefixes.delete("writ_hcm");
+  ratelimitStatPrefixes.delete("x_security_chain_ratelimit");
+  ratelimitStatPrefixes.delete("x_security_hcm");
   const corsRoutes = [];
   const routes = pickRoutes(doc);
   if (routes) {
@@ -62137,7 +62138,7 @@ var init_envoy3 = __esm({
   "src/verify/readers/envoy.ts"() {
     "use strict";
     init_registry();
-    SENTINEL_RE = /--\s*writ:([A-Z]+):([^\s:]+):START/g;
+    SENTINEL_RE = /--\s*xSecurity:([A-Z]+):([^\s:]+):START/g;
     envoyReader = {
       async readEmittedArtifacts(spec) {
         const gen = await loadGenerator("envoy");
@@ -62166,8 +62167,8 @@ var init_envoy3 = __esm({
         for (const p2 of rbacPolicies) out.push({ id: p2, kind: "envoy-rbac-policy" });
         const statPrefixes = /* @__PURE__ */ new Set();
         collectStatPrefixes(configDump, statPrefixes);
-        statPrefixes.delete("writ_chain_ratelimit");
-        statPrefixes.delete("writ_hcm");
+        statPrefixes.delete("x_security_chain_ratelimit");
+        statPrefixes.delete("x_security_hcm");
         for (const s of statPrefixes) out.push({ id: s, kind: "envoy-ratelimit-route" });
         const corsRouteLabels = /* @__PURE__ */ new Set();
         walkCorsRoutes(configDump, corsRouteLabels);
@@ -62203,7 +62204,7 @@ var init_envoy3 = __esm({
         rows.sort((a5, b5) => a5.endpoint.localeCompare(b5.endpoint));
         if (loaded.length === 0) {
           diagnostics.push(
-            "envoy /config_dump returned no Writ artifacts \u2014 the bootstrap may not have loaded"
+            "envoy /config_dump returned no x-security artifacts \u2014 the bootstrap may not have loaded"
           );
         } else {
           const haveJwt = loaded.some((l3) => l3.kind === "envoy-http-filter" && l3.id === "envoy.filters.http.jwt_authn");
@@ -62312,7 +62313,7 @@ var init_bunkerweb3 = __esm({
     init_registry();
     RULE_ID_RE5 = /\bid:(\d{4,7})\b/g;
     SOURCE_ENDPOINTS_RE = /^#\s*Source endpoints?:\s*(.+)$/i;
-    SECTION_HEADER_RE = /^#\s*Writ-generated [^\n]*$/i;
+    SECTION_HEADER_RE = /^#\s*x-security-generated [^\n]*$/i;
     bunkerwebReader = {
       async readEmittedArtifacts(spec) {
         const gen = await loadGenerator("bunkerweb");
@@ -62341,7 +62342,7 @@ var init_bunkerweb3 = __esm({
           out.push({
             id: "__empty-dump__",
             kind: "coraza-rule",
-            rejectionReason: "nginx -T returned no Writ rule ids \u2014 the scheduler may not have synced configs/modsec into the bunkerweb container yet"
+            rejectionReason: "nginx -T returned no x-security rule ids \u2014 the scheduler may not have synced configs/modsec into the bunkerweb container yet"
           });
         }
         if (split2.scheduler) {
@@ -62451,7 +62452,7 @@ function parseOpenappsecPolicy(policyYaml) {
     }
   }
   const schemaEntries = [];
-  const ext = doc["writ-extended"];
+  const ext = doc["x-security-extended"];
   const sv = ext?.["schema-validation"];
   if (Array.isArray(sv)) {
     for (const s of sv) {
@@ -62503,7 +62504,7 @@ function countWritVerdicts(container) {
       container,
       "sh",
       "-c",
-      'test -f /var/log/nano_agent/decision.log && grep -c "writ" /var/log/nano_agent/decision.log || echo MISSING'
+      'test -f /var/log/nano_agent/decision.log && grep -c "x-security" /var/log/nano_agent/decision.log || echo MISSING'
     ],
     { encoding: "utf8", maxBuffer: 1 * 1024 * 1024 }
   );
@@ -62548,12 +62549,12 @@ var init_openappsec3 = __esm({
           out.push({
             id: "__no-policy-loaded__",
             kind: "envoy-endpoint-policy",
-            rejectionReason: "/etc/cp/conf/ on the openappsec agent contains no policy/yaml files \u2014 agent did not load any Writ policy"
+            rejectionReason: "/etc/cp/conf/ on the openappsec agent contains no policy/yaml files \u2014 agent did not load any x-security policy"
           });
           return out;
         }
         const presence = /* @__PURE__ */ new Set();
-        const reToken = /\b(writ[-A-Za-z0-9_]+|(?:get|post|put|delete|patch|head|options)-[A-Za-z0-9_-]+)\b/gi;
+        const reToken = /\b((?:x-security|writ)[-A-Za-z0-9_]+|(?:get|post|put|delete|patch|head|options)-[A-Za-z0-9_-]+)\b/gi;
         let m3;
         while ((m3 = reToken.exec(confBlob)) !== null) presence.add(m3[1]);
         for (const tok of presence) out.push({ id: tok, kind: "envoy-endpoint-policy" });
@@ -62575,7 +62576,7 @@ var init_openappsec3 = __esm({
         if (verdicts && verdicts.rejectionReason) {
           const n2 = Number(verdicts.rejectionReason.replace(/^verdicts:/, ""));
           if (Number.isFinite(n2)) {
-            diagnostics.push(`/var/log/nano_agent/decision.log contains ${n2} Writ-attributed verdict line(s)`);
+            diagnostics.push(`/var/log/nano_agent/decision.log contains ${n2} x-security-attributed verdict line(s)`);
           }
         }
         const loadedIds = new Set(
@@ -62615,7 +62616,7 @@ var init_openappsec3 = __esm({
 function renderTable2(r5) {
   const lines = [];
   const targetLabel = r5.engine ? `${r5.target}/${r5.engine}` : r5.target;
-  lines.push(`Writ verify \u2014 target=${targetLabel} \u2014 gateway=${r5.gateway}`);
+  lines.push(`x-security verify \u2014 target=${targetLabel} \u2014 gateway=${r5.gateway}`);
   lines.push("");
   if (r5.diagnostics.length > 0) {
     for (const d5 of r5.diagnostics) lines.push(`! ${d5}`);
@@ -62691,8 +62692,8 @@ function renderSarif(r5) {
       {
         tool: {
           driver: {
-            name: "writ-verify",
-            informationUri: "https://github.com/writ/writ",
+            name: "x-security-verify",
+            informationUri: "https://github.com/ZeeshanSultan/x-security",
             rules: [
               {
                 id: "writ.verify.load-failure",
@@ -62867,7 +62868,7 @@ async function runTest(specPath, opts) {
   }
   spec.servers = [{ url: upstreamForSpec }];
   const artifacts = await gen.generate(spec);
-  const tmpDir = path5.join(os.tmpdir(), `writ-${target}-${Date.now()}-${process.pid}`);
+  const tmpDir = path5.join(os.tmpdir(), `x-security-${target}-${Date.now()}-${process.pid}`);
   await mkdir2(tmpDir, { recursive: true });
   for (const a5 of artifacts) {
     const full = path5.join(tmpDir, a5.path);
@@ -63254,7 +63255,7 @@ var init_feasibility = __esm({
         { capKey: "request.allowedHosts", present: (p2) => nonEmpty(p2.request?.allowedHosts) },
         { capKey: "mtls", present: (p2) => nonEmpty(p2.mtls) }
       ],
-      // SSEC-INJECTION = Writ-native injection category (W19). Mitigated by
+      // SSEC-INJECTION = x-security-native injection category (W19). Mitigated by
       // per-arg sink hardening: request.schema.<field>.injectionGuard. The probe
       // resolves against the `request.schema.injectionGuard` capability key, which
       // kong + envoy currently advertise `unsupported` (no libinjection/@detectSQLi
@@ -63265,7 +63266,7 @@ var init_feasibility = __esm({
       "SSEC-INJECTION": [
         { capKey: "request.schema.injectionGuard", present: hasInjectionGuard }
       ],
-      // SSEC-PROMPT = Writ-native LLM prompt-injection category (v0.7). A
+      // SSEC-PROMPT = x-security-native LLM prompt-injection category (v0.7). A
       // distinct threat class from SSEC-INJECTION (one synthetic id per class), so
       // it gets its own probe keyed on injectionGuard.includes('ai-prompt'). It
       // resolves against the SAME `request.schema.injectionGuard` capability key —
@@ -63274,7 +63275,7 @@ var init_feasibility = __esm({
       "SSEC-PROMPT": [
         { capKey: "request.schema.injectionGuard", present: hasAiPromptGuard }
       ],
-      // SSEC-AUDIT = Writ-native audit-logging category (v0.7). Mitigated by
+      // SSEC-AUDIT = x-security-native audit-logging category (v0.7). Mitigated by
       // the declarative `logging` policy (events/sink/sinkRef/piiRedaction). The
       // probe resolves against the flat `logging` capability key; until a generator
       // advertises it the verdict honestly resolves to none/partial rather than an
@@ -63282,7 +63283,7 @@ var init_feasibility = __esm({
       "SSEC-AUDIT": [
         { capKey: "logging", present: (p2) => nonEmpty(p2.logging) }
       ],
-      // SSEC-STORAGE = Writ-native at-rest storage posture (v0.8). ADVISORY
+      // SSEC-STORAGE = x-security-native at-rest storage posture (v0.8). ADVISORY
       // ONLY. request.dataAtRest declares the protection the *app* must apply to
       // named body fields; the gateway never sees the DB write, so this compiles to
       // NOTHING enforcing. The capability is hard-pinned override-only/unsupported
@@ -63902,7 +63903,7 @@ var init_propose_annotation = __esm({
       required: ["method", "path"]
     };
     proposeAnnotationTool = {
-      name: "writ/propose-annotation",
+      name: "x-security/propose-annotation",
       description: "Propose an x-security block for a route signature. Pure heuristic; no network calls. Returns YAML the agent can paste under the operation in its OpenAPI spec.",
       inputSchema,
       handler: (raw) => {
@@ -63987,8 +63988,8 @@ var init_lint_annotation = __esm({
       required: ["annotation"]
     };
     lintAnnotationTool = {
-      name: "writ/lint-annotation",
-      description: "Validate an x-security block against the Writ schema and return a LOW/MEDIUM/HIGH confidence verdict plus structural warnings.",
+      name: "x-security/lint-annotation",
+      description: "Validate an x-security block against the x-security schema and return a LOW/MEDIUM/HIGH confidence verdict plus structural warnings.",
       inputSchema: inputSchema2,
       handler: (raw) => {
         const input = raw ?? {};
@@ -64018,8 +64019,8 @@ var init_lint_annotation = __esm({
 // ../cursor-mcp/dist/tools/check-endpoint.js
 import { request as request6 } from "undici";
 async function checkEndpoint(input, fetcher = defaultFetcher) {
-  const apiKey = input.apiKey ?? process.env.WRIT_API_KEY;
-  const apiUrl = process.env.WRIT_API_URL ?? DEFAULT_API_URL;
+  const apiKey = input.apiKey ?? process.env.X_SECURITY_API_KEY ?? process.env.WRIT_API_KEY;
+  const apiUrl = process.env.X_SECURITY_API_URL ?? process.env.WRIT_API_URL ?? DEFAULT_API_URL;
   if (!apiKey) {
     return {
       configured: false,
@@ -64068,8 +64069,8 @@ var init_check_endpoint = __esm({
       return { statusCode: res.statusCode, body };
     };
     checkEndpointTool = {
-      name: "writ/check-endpoint",
-      description: "Look up an endpoint in the Writ scan history. Returns existing analysis (annotations, OWASP coverage, prior findings) if WRIT_API_KEY is configured.",
+      name: "x-security/check-endpoint",
+      description: "Look up an endpoint in the x-security scan history. Returns existing analysis (annotations, OWASP coverage, prior findings) if WRIT_API_KEY is configured.",
       inputSchema: inputSchema3,
       handler: async (raw) => {
         const input = raw ?? {};
@@ -64260,7 +64261,7 @@ var init_dist5 = __esm({
     init_server();
     init_transport();
     dist_default = main;
-    isDirectRun = import.meta.url === `file://${process.argv[1] ?? ""}` || process.argv[1]?.endsWith("cursor-mcp/dist/index.js") === true || process.argv[1]?.endsWith("writ-cursor-mcp") === true;
+    isDirectRun = import.meta.url === `file://${process.argv[1] ?? ""}` || process.argv[1]?.endsWith("cursor-mcp/dist/index.js") === true || process.argv[1]?.endsWith("x-security-cursor-mcp") === true;
     if (isDirectRun) {
       main().catch((e5) => {
         process.stderr.write(`cursor-mcp: fatal: ${e5.message}
@@ -64333,7 +64334,7 @@ async function runVerifyBundle(tarballPath, opts = {}) {
   } else {
     pubKeyPem = BUNDLE_VERIFY_PUBLIC_KEY;
   }
-  const tmpdir5 = fs.mkdtempSync(path6.join(os2.tmpdir(), "writ-verify-"));
+  const tmpdir5 = fs.mkdtempSync(path6.join(os2.tmpdir(), "x-security-verify-"));
   try {
     await extractTarball(tarballPath, tmpdir5);
     const manifestPath = path6.join(tmpdir5, MANIFEST);
@@ -64640,11 +64641,33 @@ function endpointToFileId(method, routePath) {
   const safePath = routePath.replace(/^\//, "").replace(/\//g, "__").replace(/[^A-Za-z0-9_:.\-{}#]/g, "_");
   return `${method.toUpperCase()}__${safePath || "root"}`;
 }
-function writDir(repoDir) {
+function xSecurityDir(repoDir) {
+  return path7.join(repoDir, ".x-security");
+}
+function legacyWritDir(repoDir) {
   return path7.join(repoDir, ".writ");
 }
+async function resolveArtifactDir(repoDir) {
+  const canonical = xSecurityDir(repoDir);
+  try {
+    await fs2.access(canonical);
+    return canonical;
+  } catch {
+  }
+  const legacy = legacyWritDir(repoDir);
+  try {
+    await fs2.access(legacy);
+    console.warn("[x-security] reading legacy .writ/ artifact dir; run a compile to migrate to .x-security/");
+    return legacy;
+  } catch {
+  }
+  return canonical;
+}
 function policiesDir(repoDir) {
-  return path7.join(writDir(repoDir), POLICIES_DIR);
+  return path7.join(xSecurityDir(repoDir), POLICIES_DIR);
+}
+async function resolvePoliciesDir(repoDir) {
+  return path7.join(await resolveArtifactDir(repoDir), POLICIES_DIR);
 }
 async function persistPolicy(repoDir, route, policy, cites) {
   const dir = policiesDir(repoDir);
@@ -70276,7 +70299,7 @@ var init_emit = __esm({
   "../detect-core/dist/agentic/emit.js"() {
     "use strict";
     init_dist3();
-    AUTH_JWKS_VAR = "${WRIT_AUTH_JWKS_URI}";
+    AUTH_JWKS_VAR = "${X_SECURITY_AUTH_JWKS_URI}";
     AUTHZ_LOCATION_SEGMENT = {
       path: "request.params",
       query: "request.query",
@@ -72847,7 +72870,7 @@ async function citeMatches(repoDir, cite) {
   return snap !== null;
 }
 async function runAudit(repoDir) {
-  const dir = policiesDir(repoDir);
+  const dir = await resolvePoliciesDir(repoDir);
   let entries;
   try {
     entries = (await fs18.readdir(dir)).filter((f5) => f5.endsWith(".yaml") || f5.endsWith(".yml"));
@@ -72956,7 +72979,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import yaml15 from "js-yaml";
 function resolveApiUrl(env) {
-  const override = env.WRIT_API_URL?.trim();
+  const override = (env.X_SECURITY_API_URL ?? env.WRIT_API_URL)?.trim();
   if (!override) return DEFAULT_API_URL2;
   let parsed;
   try {
@@ -72975,16 +72998,16 @@ function resolveApiUrl(env) {
   const allowed = LOCAL_HOSTS.has(host) || HOST_ALLOWLIST_SUFFIXES.some((s) => host === s.slice(1) || host.endsWith(s));
   if (!allowed) {
     throw new PushError(
-      `Refusing to send the API token to "${host}". WRIT_API_URL must be the Writ SaaS (host ending in ${HOST_ALLOWLIST_SUFFIXES.join(" or ")}, or localhost for dev). This guard prevents token exfiltration to an attacker-controlled host.`
+      `Refusing to send the API token to "${host}". WRIT_API_URL must be the x-security SaaS (host ending in ${HOST_ALLOWLIST_SUFFIXES.join(" or ")}, or localhost for dev). This guard prevents token exfiltration to an attacker-controlled host.`
     );
   }
   return override.replace(/\/+$/, "");
 }
 function resolveToken(env) {
-  const token = env.WRIT_API_TOKEN?.trim();
+  const token = (env.X_SECURITY_API_TOKEN ?? env.WRIT_API_TOKEN)?.trim();
   if (!token) {
     throw new PushError(
-      "WRIT_API_TOKEN is not set. Export your Writ API key (WRIT_API_TOKEN=...) \u2014 push reads it from the environment only, never from a flag."
+      "WRIT_API_TOKEN is not set. Export your x-security API key (WRIT_API_TOKEN=...) \u2014 push reads it from the environment only, never from a flag."
     );
   }
   return token;
@@ -73026,7 +73049,7 @@ async function resolveRepoIdentity(repoDir) {
   return { repoUrl: normalizeRemoteUrl(remote), commitSha };
 }
 async function loadPolicies(repoDir) {
-  const dir = policiesDir(repoDir);
+  const dir = await resolvePoliciesDir(repoDir);
   let files;
   try {
     files = (await fs19.readdir(dir)).filter((f5) => f5.endsWith(".yaml") || f5.endsWith(".yml"));
@@ -73061,7 +73084,7 @@ async function loadPolicies(repoDir) {
 }
 async function loadReport(repoDir) {
   try {
-    return await fs19.readFile(path25.join(writDir(repoDir), REPORT_FILE), "utf8");
+    return await fs19.readFile(path25.join(await resolveArtifactDir(repoDir), REPORT_FILE), "utf8");
   } catch {
     return void 0;
   }
@@ -73391,7 +73414,7 @@ var init_compile3 = __esm({
 function renderReport3(audit, routes) {
   const pct = (audit.coverage * 100).toFixed(1);
   const lines = [];
-  lines.push("# Writ report");
+  lines.push("# x-security report");
   lines.push("");
   lines.push(`- Routes with a compiled policy: **${audit.routes}**`);
   lines.push(`- Enforced controls: **${audit.controls}**`);
@@ -73444,16 +73467,16 @@ var init_ci_gate = __esm({
       'echo "$OUT"',
       `CITE_BACKED="$(printf '%s' "$OUT" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(String(JSON.parse(s).citeBacked)))')"`,
       'if [ "$CITE_BACKED" != "true" ]; then',
-      '  echo "::error::Writ gate failed \u2014 an emitted control no longer cites your code." >&2',
+      '  echo "::error::x-security gate failed \u2014 an emitted control no longer cites your code." >&2',
       "  exit 1",
       "fi",
       ""
     ].join("\n");
     GITHUB_WORKFLOW = [
-      "name: Writ gate",
+      "name: x-security gate",
       "on: [pull_request, push]",
       "jobs:",
-      "  writ-audit:",
+      "  x-security-audit:",
       "    runs-on: ubuntu-latest",
       "    steps:",
       "      - uses: actions/checkout@v4",
@@ -73466,7 +73489,7 @@ var init_ci_gate = __esm({
     ].join("\n");
     GITLAB_SNIPPET = [
       "# Append to .gitlab-ci.yml",
-      "writ-audit:",
+      "x-security-audit:",
       "  image: node:20",
       "  script:",
       "    - bash .writ/ci/audit-gate.sh",
@@ -73483,7 +73506,7 @@ import { promises as fs20 } from "node:fs";
 import path26 from "node:path";
 import yaml16 from "js-yaml";
 async function loadPolicies2(repoDir) {
-  const dir = policiesDir(repoDir);
+  const dir = await resolvePoliciesDir(repoDir);
   let files;
   try {
     files = (await fs20.readdir(dir)).filter((f5) => f5.endsWith(".yaml") || f5.endsWith(".yml"));
@@ -73517,7 +73540,7 @@ function toSpecIR(policies) {
   return {
     openapi: "3.1.0",
     dialect: "3.1",
-    info: { title: "Writ BYO-agent policies", version: "0.0.0" },
+    info: { title: "x-security BYO-agent policies", version: "0.0.0" },
     servers: [],
     endpoints,
     unprotectedEndpoints: []
@@ -73527,7 +73550,7 @@ async function emitWaf(repoDir, policies) {
   const gen = await loadGenerator("bunkerweb");
   if (!gen) throw new Error("bunkerweb generator unavailable");
   const artifacts = await gen.generate(toSpecIR(policies));
-  const outDir = path26.join(writDir(repoDir), WAF_DIR);
+  const outDir = path26.join(xSecurityDir(repoDir), WAF_DIR);
   await fs20.mkdir(outDir, { recursive: true });
   const written = [];
   for (const a5 of artifacts) {
@@ -73539,13 +73562,13 @@ async function emitWaf(repoDir, policies) {
   return written;
 }
 async function emitReport(repoDir, audit, policies) {
-  await fs20.mkdir(writDir(repoDir), { recursive: true });
-  const dest = path26.join(writDir(repoDir), REPORT_FILE);
+  await fs20.mkdir(xSecurityDir(repoDir), { recursive: true });
+  const dest = path26.join(xSecurityDir(repoDir), REPORT_FILE);
   await fs20.writeFile(dest, renderReport3(audit, policies.map((p2) => ({ method: p2.method, path: p2.routePath }))), "utf8");
   return [dest];
 }
 async function emitCi(repoDir) {
-  const outDir = path26.join(writDir(repoDir), CI_DIR);
+  const outDir = path26.join(xSecurityDir(repoDir), CI_DIR);
   await fs20.mkdir(outDir, { recursive: true });
   const gate = renderCiGate();
   const written = [];
@@ -74873,7 +74896,7 @@ async function resolveSpecArg(arg, stdin = process.stdin) {
   if (!content) {
     throw new Error("expected a spec document on stdin, got empty input");
   }
-  const dir = fs22.mkdtempSync(path29.join(os4.tmpdir(), "writ-stdin-"));
+  const dir = fs22.mkdtempSync(path29.join(os4.tmpdir(), "x-security-stdin-"));
   tempSpecDirs.add(dir);
   if (!exitHandlerRegistered) {
     exitHandlerRegistered = true;
@@ -75001,7 +75024,7 @@ var init_lazy = __esm({
     init_dist4();
     program = new Command2();
     program.name(basename2(process.argv[1] ?? "lazy").replace(/\.(mjs|cjs|js)$/, "")).description("Compile, validate, test, and report on x-security policies in OpenAPI specs.").option("--quiet", "Suppress warnings/advisories on stderr (results still print)").option("--verbose", "Print extra progress detail to stderr").version(resolveVersion()).showHelpAfterError("(add --help for usage)");
-    program.command("generate <spec>").description("Compile an annotated OpenAPI spec into target-specific gateway config. <spec> may be - to read from stdin.").requiredOption("--target <name>", "Target: kong|coraza|bunkerweb|openappsec|firewall").option("--out <dir>", "Output directory (default: ./writ-out/<target>)").option("--dry-run", "Print planned artifacts without writing to disk").option("--no-strict", "Allow unresolved variables (default: strict)").option("--vault", "Resolve $vault.* refs via HashiCorp Vault (uses VAULT_ADDR + VAULT_TOKEN or AppRole)").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager (uses default credential chain + AWS_REGION)").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).option("--no-with-consumers", "Kong only: emit spec-only output (omit consumers + per-plugin credentials). Consumers are emitted by default so OSS Kong gateways actually authenticate; pass this for the spec-only baseline.").option("--kong-deployment <mode>", "Kong only: standalone|behind-proxy|with-coraza|with-istio. with-coraza rewrites all service URLs to http://coraza:8080.", "standalone").option("--kong-edition <edition>", "Kong only: oss|enterprise. enterprise emits openid-connect (real JWKS+RS256) instead of HS256 jwt_secrets downgrade.", "oss").option("--kong-dbless", "Kong only: deployment runs in DB-less mode (KONG_DATABASE=off). Per-identity rate-limits fall back to policy=local with a structured warning instead of policy=cluster.", false).option("--kong-policy <mode>", "Kong only: rate-limit policy. local|cluster. Default local (safe for OSS DB-less). Pass cluster only when Kong is running in database mode (postgres/cassandra); cluster is a boot error in DB-less Kong.", "local").option("--coraza-engine <name>", "Coraza only: modsec-nginx|modsec-apache|coraza-go|coraza-spoa (default modsec-nginx).", "modsec-nginx").option("--coraza-peers <list>", 'Coraza only (coraza-spoa|coraza-go): HAProxy peer-replication for stick-tables. Format: "name1:host1:port1,name2:host2:port2". When set, emitted haproxy-stick-tables.cfg includes a `peers writ` section so counters replicate across instances.').option("--strict-fidelity", "Exit 4 (S3) if any spec field cannot be enforced by the chosen target+engine. Independent of --strict.").addHelpText("after", generateExamples).action(async (spec, opts) => {
+    program.command("generate <spec>").description("Compile an annotated OpenAPI spec into target-specific gateway config. <spec> may be - to read from stdin.").requiredOption("--target <name>", "Target: kong|coraza|bunkerweb|openappsec|firewall").option("--out <dir>", "Output directory (default: ./x-security-out/<target>)").option("--dry-run", "Print planned artifacts without writing to disk").option("--no-strict", "Allow unresolved variables (default: strict)").option("--vault", "Resolve $vault.* refs via HashiCorp Vault (uses VAULT_ADDR + VAULT_TOKEN or AppRole)").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager (uses default credential chain + AWS_REGION)").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).option("--no-with-consumers", "Kong only: emit spec-only output (omit consumers + per-plugin credentials). Consumers are emitted by default so OSS Kong gateways actually authenticate; pass this for the spec-only baseline.").option("--kong-deployment <mode>", "Kong only: standalone|behind-proxy|with-coraza|with-istio. with-coraza rewrites all service URLs to http://coraza:8080.", "standalone").option("--kong-edition <edition>", "Kong only: oss|enterprise. enterprise emits openid-connect (real JWKS+RS256) instead of HS256 jwt_secrets downgrade.", "oss").option("--kong-dbless", "Kong only: deployment runs in DB-less mode (KONG_DATABASE=off). Per-identity rate-limits fall back to policy=local with a structured warning instead of policy=cluster.", false).option("--kong-policy <mode>", "Kong only: rate-limit policy. local|cluster. Default local (safe for OSS DB-less). Pass cluster only when Kong is running in database mode (postgres/cassandra); cluster is a boot error in DB-less Kong.", "local").option("--coraza-engine <name>", "Coraza only: modsec-nginx|modsec-apache|coraza-go|coraza-spoa (default modsec-nginx).", "modsec-nginx").option("--coraza-peers <list>", 'Coraza only (coraza-spoa|coraza-go): HAProxy peer-replication for stick-tables. Format: "name1:host1:port1,name2:host2:port2". When set, emitted haproxy-stick-tables.cfg includes a `peers x-security` section so counters replicate across instances.').option("--strict-fidelity", "Exit 4 (S3) if any spec field cannot be enforced by the chosen target+engine. Independent of --strict.").addHelpText("after", generateExamples).action(async (spec, opts) => {
       try {
         const diag = makeDiagnostics(verbosity());
         const fromStdin = spec === "-";
@@ -75371,14 +75394,14 @@ import { dump as yamlDump } from "js-yaml";
 function luaStr2(s) {
   return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r") + '"';
 }
-var SS_RESPONSE_STRIP_UNKNOWN_TAG = "writ-response-strip-unknown";
+var SS_RESPONSE_STRIP_UNKNOWN_TAG = "x-security-response-strip-unknown";
 function buildResponseStripUnknownPlugins(resp, ctx = {}) {
   if (!resp || resp.stripUnknownFields !== true) return [];
   const schemaKeys = resp.schema ? Object.keys(resp.schema) : [];
   if (schemaKeys.length === 0) return [];
   const luaAllowTable = "{" + schemaKeys.map((k5) => `[${luaStr2(k5)}]=true`).join(", ") + "}";
   const lua = [
-    `-- Writ W26 response strip-unknown-fields for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W26 response strip-unknown-fields for endpoint=${ctx.endpoint ?? "?"}`,
     `local cjson = require("cjson.safe")`,
     `local ss_allow = ${luaAllowTable}`,
     `local raw = kong.response.get_raw_body()`,
@@ -75403,7 +75426,7 @@ function buildResponseStripUnknownPlugins(resp, ctx = {}) {
     tags: [SS_RESPONSE_STRIP_UNKNOWN_TAG]
   }];
 }
-var SS_RESPONSE_STRIP_TRACES_TAG = "writ-response-strip-traces";
+var SS_RESPONSE_STRIP_TRACES_TAG = "x-security-response-strip-traces";
 var STACK_TRACE_LUA_PATTERNS = [
   "\n%s*at%s+[%w%._$<>]+%([^%)]*%)",
   // Java/JS:  "  at com.foo.Bar.baz(File.java:42)"
@@ -75422,7 +75445,7 @@ function buildResponseStripTracesPlugins(resp, ctx = {}) {
   if (!resp?.errorScrubbing?.stripStackTraces) return [];
   const subs = STACK_TRACE_LUA_PATTERNS.map((p2) => `  body = body:gsub(${luaStr2(p2)}, "")`).join("\n");
   const lua = [
-    `-- Writ W26 response strip-stack-traces for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W26 response strip-stack-traces for endpoint=${ctx.endpoint ?? "?"}`,
     `local status = kong.response.get_status()`,
     `if status >= 400 then`,
     `  local body = kong.response.get_raw_body()`,
@@ -75442,11 +75465,11 @@ function buildResponseStripTracesPlugins(resp, ctx = {}) {
     tags: [SS_RESPONSE_STRIP_TRACES_TAG]
   }];
 }
-var SS_RESPONSE_GENERIC_ERROR_TAG = "writ-response-generic-error";
+var SS_RESPONSE_GENERIC_ERROR_TAG = "x-security-response-generic-error";
 function buildResponseGenericErrorPlugins(resp, ctx = {}) {
   if (!resp?.errorScrubbing?.genericMessages) return [];
   const lua = [
-    `-- Writ W26 response generic-error-message for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W26 response generic-error-message for endpoint=${ctx.endpoint ?? "?"}`,
     `local status = kong.response.get_status()`,
     `if status >= 500 then`,
     `  kong.log.warn("[${SS_RESPONSE_GENERIC_ERROR_TAG}] rewrote 5xx body to generic message")`,
@@ -75460,13 +75483,13 @@ function buildResponseGenericErrorPlugins(resp, ctx = {}) {
     tags: [SS_RESPONSE_GENERIC_ERROR_TAG]
   }];
 }
-var SS_RESPONSE_CONTENT_TYPE_TAG = "writ-response-contenttype";
+var SS_RESPONSE_CONTENT_TYPE_TAG = "x-security-response-contenttype";
 function buildResponseContentTypeAssertPlugins(resp, ctx = {}) {
   const allowed = resp?.contentType;
   if (!allowed || allowed.length === 0) return [];
   const luaSet = allowed.map((t) => `["${t.toLowerCase().replace(/["\\]/g, "")}"]=true`).join(", ");
   const headerFilter = [
-    `-- Writ response Content-Type assertion endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity response Content-Type assertion endpoint=${ctx.endpoint ?? "?"}`,
     `local allowed = { ${luaSet} }`,
     `local status = kong.response.get_status()`,
     `if status >= 200 and status < 300 then`,
@@ -75494,7 +75517,7 @@ function buildResponseContentTypeAssertPlugins(resp, ctx = {}) {
     tags: [SS_RESPONSE_CONTENT_TYPE_TAG]
   }];
 }
-var SS_RESPONSE_SCHEMA_TAG = "writ-response-schema";
+var SS_RESPONSE_SCHEMA_TAG = "x-security-response-schema";
 var FORMAT_LUA = {
   // RFC-ish email: local@domain.tld, no spaces, one @, a dotted domain.
   email: `return type(v)=="string" and v:match("^[^@%s]+@[^@%s]+%.[^@%s]+$") ~= nil`,
@@ -75619,7 +75642,7 @@ function buildResponseMaxLengthPlugins(resp, ctx = {}) {
   if (rules.length === 0) return [];
   const validators = rules.flatMap((r5) => fieldValidatorLua(r5));
   const lua = [
-    `-- Writ W26 response typed-schema validation for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W26 response typed-schema validation for endpoint=${ctx.endpoint ?? "?"}`,
     `-- Validates the cjson-DECODED value (canonical: immune to pretty-printing,`,
     `-- escaped quotes, key order, numeric formatting). Never matches raw body bytes.`,
     `local cjson = require("cjson.safe")`,
@@ -75645,7 +75668,7 @@ function buildResponseMaxLengthPlugins(resp, ctx = {}) {
     tags: [SS_RESPONSE_SCHEMA_TAG]
   }];
 }
-var SS_RATE_LIMIT_FINGERPRINT_TAG = "writ-rate-limit-fingerprint";
+var SS_RATE_LIMIT_FINGERPRINT_TAG = "x-security-rate-limit-fingerprint";
 function rateLimitsUseFingerprint(rl) {
   if (!rl) return false;
   const arr = Array.isArray(rl) ? rl : [rl];
@@ -75663,9 +75686,9 @@ function rateLimitsUseFingerprint(rl) {
 function buildRateLimitFingerprintPlugins(rl, ctx = {}) {
   if (!rateLimitsUseFingerprint(rl)) return [];
   const lua = [
-    `-- Writ W26 rate-limit fingerprint pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W26 rate-limit fingerprint pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `-- Composite key = client_ip + sha1(user-agent). Stored on ctx.shared and`,
-    `-- mirrored to X-Writ-Fingerprint so rate-limiting limit_by=header picks it up.`,
+    `-- mirrored to X-XSecurity-Fingerprint so rate-limiting limit_by=header picks it up.`,
     `local sha1 = require("resty.sha1"):new()`,
     `local ip = kong.client.get_forwarded_ip() or kong.client.get_ip() or "0.0.0.0"`,
     `local ua = kong.request.get_header("user-agent") or ""`,
@@ -75677,8 +75700,8 @@ function buildRateLimitFingerprintPlugins(rl, ctx = {}) {
     `  for i = 1, #digest do hex = hex .. string.format("%02x", string.byte(digest, i)) end`,
     `  fp = ip .. ":" .. hex:sub(1, 16)`,
     `end`,
-    `kong.ctx.shared.writ_fp = fp`,
-    `kong.service.request.set_header("X-Writ-Fingerprint", fp)`,
+    `kong.ctx.shared.x_security_fp = fp`,
+    `kong.service.request.set_header("X-XSecurity-Fingerprint", fp)`,
     `kong.log.warn("[${SS_RATE_LIMIT_FINGERPRINT_TAG}] fp=" .. fp)`
   ].join("\n");
   return [{
@@ -75687,7 +75710,7 @@ function buildRateLimitFingerprintPlugins(rl, ctx = {}) {
     tags: [SS_RATE_LIMIT_FINGERPRINT_TAG]
   }];
 }
-var SS_BOT_DETECTED_TAG = "writ-bot-detected";
+var SS_BOT_DETECTED_TAG = "x-security-bot-detected";
 var BOT_UA_LUA_PATTERNS = [
   "[Cc]url/",
   "[Pp]ython%-requests/",
@@ -75711,14 +75734,14 @@ function buildBotProtectionPlugins(bot, ctx = {}) {
   const checks = BOT_UA_LUA_PATTERNS.map((p2, i5) => `  if ua:match(${luaStr2(p2)}) then return ${i5 + 1} end`).join("\n");
   const blockLua = enforce ? [
     `    return kong.response.exit(403, {`,
-    `      message = "Writ: bot detected",`,
+    `      message = "XSecurity: bot detected",`,
     `      tag = "${SS_BOT_DETECTED_TAG}",`,
     `      provider = "${provider}",`,
     `      rule = hit`,
     `    })`
   ].join("\n") : `    -- observe mode: log but pass through`;
   const lua = [
-    `-- Writ W26 botProtection pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity W26 botProtection pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `-- provider=${provider} mode=${bot.mode}`,
     `local ua = kong.request.get_header("user-agent") or ""`,
     `local hit = (function()`,
@@ -75735,7 +75758,7 @@ function buildBotProtectionPlugins(bot, ctx = {}) {
       `if not challenge:match("ss_bot_challenge=") then`,
       `  kong.log.warn("[${SS_BOT_DETECTED_TAG}] missing js-challenge cookie")`,
       `  return kong.response.exit(403, {`,
-      `    message = "Writ: bot challenge required",`,
+      `    message = "XSecurity: bot challenge required",`,
       `    tag = "${SS_BOT_DETECTED_TAG}",`,
       `    provider = "${provider}"`,
       `  })`,
@@ -75759,7 +75782,7 @@ function durationSeconds(window2) {
   if (!m3) return 60;
   return Number(m3[1]) * (WINDOW_TO_SECONDS2[m3[2].toLowerCase()] ?? 60);
 }
-var SS_AUDIT_TAG = "writ-audit-log";
+var SS_AUDIT_TAG = "x-security-audit-log";
 var LOGGING_SINK_PLUGIN = {
   stdout: "file-log",
   file: "file-log",
@@ -75867,7 +75890,7 @@ function buildLoggingPlugins(policy, ctx = {}) {
     tags: [SS_AUDIT_TAG]
   }];
 }
-var SS_PASSWORD_POLICY_TAG = "writ-password-policy-422";
+var SS_PASSWORD_POLICY_TAG = "x-security-password-policy-422";
 function buildPasswordPolicyPlugins(auth, ctx = {}) {
   const pp = auth?.passwordPolicy;
   if (!pp) return [];
@@ -75915,7 +75938,7 @@ function buildPasswordPolicyPlugins(auth, ctx = {}) {
     );
   }
   const lua = [
-    `-- Writ v0.7 password-policy pre-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity v0.7 password-policy pre-function for endpoint=${ctx.endpoint ?? "?"}`,
     `local body = kong.request.get_body()`,
     `if type(body) == "table" and type(body.password) == "string" then`,
     `  local pw = body.password`,
@@ -75926,7 +75949,7 @@ function buildPasswordPolicyPlugins(auth, ctx = {}) {
     `  if violation ~= nil then`,
     `    kong.log.warn("[${SS_PASSWORD_POLICY_TAG}] password rejected: " .. violation)`,
     `    return kong.response.exit(422, {`,
-    `      message = "Writ: password does not meet policy",`,
+    `      message = "XSecurity: password does not meet policy",`,
     `      tag = "${SS_PASSWORD_POLICY_TAG}",`,
     `      violation = violation`,
     `    })`,
@@ -75939,11 +75962,11 @@ function buildPasswordPolicyPlugins(auth, ctx = {}) {
     tags: [SS_PASSWORD_POLICY_TAG]
   }];
 }
-var SS_FORBID_ARRAY_ROOT_TAG = "writ-forbid-array-root-502";
+var SS_FORBID_ARRAY_ROOT_TAG = "x-security-forbid-array-root-502";
 function buildForbidArrayRootPlugins(resp, ctx = {}) {
   if (!resp || resp.forbidArrayRoot !== true) return [];
   const lua = [
-    `-- Writ v0.7 forbidArrayRoot post-function for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- XSecurity v0.7 forbidArrayRoot post-function for endpoint=${ctx.endpoint ?? "?"}`,
     `local cjson = require("cjson.safe")`,
     `local raw = kong.response.get_raw_body()`,
     `if raw and #raw > 0 then`,
@@ -75959,7 +75982,7 @@ function buildForbidArrayRootPlugins(resp, ctx = {}) {
     `      kong.log.warn("[${SS_FORBID_ARRAY_ROOT_TAG}] bare top-level array response blocked (JSON hijacking)")`,
     `      kong.response.set_status(502)`,
     `      kong.response.set_header("Content-Type", "application/json")`,
-    `      kong.response.set_raw_body('{"message":"Writ: bare top-level array response forbidden","tag":"${SS_FORBID_ARRAY_ROOT_TAG}"}')`,
+    `      kong.response.set_raw_body('{"message":"XSecurity: bare top-level array response forbidden","tag":"${SS_FORBID_ARRAY_ROOT_TAG}"}')`,
     `    end`,
     `  end`,
     `end`
@@ -75970,8 +75993,8 @@ function buildForbidArrayRootPlugins(resp, ctx = {}) {
     tags: [SS_FORBID_ARRAY_ROOT_TAG]
   }];
 }
-var SS_IDEMPOTENCY_TAG = "writ-idempotency-replay-409";
-var SS_IDEMPOTENCY_CACHE_DICT = "writ_idempotency_cache";
+var SS_IDEMPOTENCY_TAG = "x-security-idempotency-replay-409";
+var SS_IDEMPOTENCY_CACHE_DICT = "x_security_idempotency_cache";
 var SS_IDEMPOTENCY_CACHE_DICT_SIZE = "10m";
 function buildIdempotencyKeyPlugins(request9, ctx = {}) {
   const idem = request9?.idempotencyKey;
@@ -75987,8 +76010,8 @@ function buildIdempotencyKeyPlugins(request9, ctx = {}) {
     });
   }
   const lua = [
-    `-- Writ v0.7 idempotencyKey pre-function (PARTIAL) for endpoint=${ctx.endpoint ?? "?"}`,
-    `-- Best-effort replay suppression only \u2014 NOT atomic idempotency. See _writ_warnings.`,
+    `-- XSecurity v0.7 idempotencyKey pre-function (PARTIAL) for endpoint=${ctx.endpoint ?? "?"}`,
+    `-- Best-effort replay suppression only \u2014 NOT atomic idempotency. See _x_security_warnings.`,
     `local key = kong.request.get_header(${luaStr3(idem.header)})`,
     `if key ~= nil and key ~= "" then`,
     `  local cache = ngx.shared.${SS_IDEMPOTENCY_CACHE_DICT}`,
@@ -75997,7 +76020,7 @@ function buildIdempotencyKeyPlugins(request9, ctx = {}) {
     `    if seen then`,
     `      kong.log.warn("[${SS_IDEMPOTENCY_TAG}] replayed idempotency key '" .. tostring(key) .. "' within ttl")`,
     `      return kong.response.exit(409, {`,
-    `        message = "Writ: idempotency key replay rejected",`,
+    `        message = "XSecurity: idempotency key replay rejected",`,
     `        tag = "${SS_IDEMPOTENCY_TAG}"`,
     `      })`,
     `    end`,
@@ -76012,7 +76035,7 @@ function buildIdempotencyKeyPlugins(request9, ctx = {}) {
     tags: [SS_IDEMPOTENCY_TAG]
   }];
 }
-var SS_ACCOUNT_LOCKOUT_TAG = "writ-account-lockout";
+var SS_ACCOUNT_LOCKOUT_TAG = "x-security-account-lockout";
 function lockoutBucket(seconds) {
   if (seconds <= 1) return "second";
   if (seconds <= 60) return "minute";
@@ -76116,31 +76139,31 @@ function buildConsumers(spec, options = {}) {
     const username = consumerName(role);
     bundle.consumers.push({
       username,
-      tags: [`writ_role=${role}`]
+      tags: [`x_security_role=${role}`]
     });
     bundle.acls.push({ consumer: username, group: role });
     if (hasApiKey) {
       bundle.keyauth_credentials.push({
         consumer: username,
-        key: `${role}_test_key_${shortHash(`${spec.info?.title ?? "writ"}|${role}`)}`
+        key: `${role}_test_key_${shortHash(`${spec.info?.title ?? "x-security"}|${role}`)}`
       });
     }
     if (hasJwt) {
-      const key = jwtIssuer ?? `writ-${shortHash((spec.info?.title ?? "writ") || "spec", 6)}`;
+      const key = jwtIssuer ?? `x-security-${shortHash((spec.info?.title ?? "x-security") || "spec", 6)}`;
       bundle.jwt_secrets.push({
         consumer: username,
         // Per-consumer key MUST be unique across the spec (Kong primary key
         // on `key`), so we suffix the role.
         key: `${key}#${role}`,
         algorithm: "HS256",
-        secret: `${role}_jwt_secret_${shortHash(`${spec.info?.title ?? "writ"}|${role}|jwt`, 16)}`
+        secret: `${role}_jwt_secret_${shortHash(`${spec.info?.title ?? "x-security"}|${role}|jwt`, 16)}`
       });
     }
     if (hasHmac) {
       bundle.hmacauth_credentials.push({
         consumer: username,
         username: role,
-        secret: `${role}_hmac_secret_${shortHash(`${spec.info?.title ?? "writ"}|${role}|hmac`, 16)}`
+        secret: `${role}_hmac_secret_${shortHash(`${spec.info?.title ?? "x-security"}|${role}|hmac`, 16)}`
       });
     }
   }
@@ -76174,8 +76197,8 @@ function buildConsumers(spec, options = {}) {
 }
 
 // src/generators/kong/index.ts
-var WRIT_KONG_NAMESPACE = "a4f7e8c2-1b3d-4e5f-9a8b-7c6d5e4f3a2b";
-function uuidv5(name, namespace = WRIT_KONG_NAMESPACE) {
+var X_SECURITY_KONG_NAMESPACE = "a4f7e8c2-1b3d-4e5f-9a8b-7c6d5e4f3a2b";
+function uuidv5(name, namespace = X_SECURITY_KONG_NAMESPACE) {
   const nsBytes = Buffer.from(namespace.replace(/-/g, ""), "hex");
   const hash = createHash2("sha1").update(nsBytes).update(name).digest();
   const bytes = Buffer.from(hash.subarray(0, 16));
@@ -76240,7 +76263,7 @@ function buildEndpointPlugins(ep, ctx) {
       warn: ctx.warn
     }),
     // v0.7 authentication.accountLockout — per-credential rate-limit throttle
-    // (PARTIAL — not a true failed-attempt lockout; see _writ_warnings).
+    // (PARTIAL — not a true failed-attempt lockout; see _x_security_warnings).
     ...buildAccountLockoutPlugins(p2.authentication, {
       ...ep.operationId ? { endpoint: ep.operationId } : {},
       warn: ctx.warn
@@ -76267,7 +76290,7 @@ function buildEndpointPlugins(ep, ctx) {
       warn: ctx.warn
     }),
     // W26: rate-limit fingerprint composite key (ip+ua hash) — runs before
-    // request-side checks so the X-Writ-Fingerprint header is set
+    // request-side checks so the X-XSecurity-Fingerprint header is set
     // before any plugin (or upstream) might consume it.
     ...buildRateLimitFingerprintPlugins(p2.rateLimit, {
       ...ep.operationId ? { endpoint: ep.operationId } : {}
@@ -76295,7 +76318,7 @@ function buildEndpointPlugins(ep, ctx) {
       warn: ctx.warn
     }),
     // v0.7 request.idempotencyKey — best-effort shared_dict replay suppression
-    // (PARTIAL — not atomic idempotency; see _writ_warnings).
+    // (PARTIAL — not atomic idempotency; see _x_security_warnings).
     ...buildIdempotencyKeyPlugins(p2.request, {
       ...ep.operationId ? { endpoint: ep.operationId } : {},
       warn: ctx.warn
@@ -76478,9 +76501,9 @@ function createKongGenerator(opts = {}) {
           "request.schema": "partial",
           // request-validator is enterprise-only for body_schema; OSS users see degraded enforcement (mass-assign + sqli pre-functions partially cover)
           "request.schema.injectionGuard": "unsupported",
-          // HONEST: Kong OSS has no libinjection/@detectSQLi; a pre-function regex would be a fragile fake (Rule D-1). Abstain + _writ_warnings divergence note; front with coraza/bunkerweb which carry SSEC-INJECTION.
+          // HONEST: Kong OSS has no libinjection/@detectSQLi; a pre-function regex would be a fragile fake (Rule D-1). Abstain + _x_security_warnings divergence note; front with coraza/bunkerweb which carry SSEC-INJECTION.
           "request.denyUnknownFields": "full",
-          // K-3: pre-function rejects unknown top-level body fields with writ-mass-assign-403
+          // K-3: pre-function rejects unknown top-level body fields with x-security-mass-assign-403
           "request.allowedFields": "full",
           // K-3: pre-function allowlist enforcement
           "request.signature": "partial",
@@ -76533,11 +76556,11 @@ function createKongGenerator(opts = {}) {
           "response.forbidArrayRoot": "full",
           // v0.7 API3: body_filter post-function cjson-decodes the body and rewrites a bare top-level array response to 502. Decoded-value check (not raw regex) → full.
           "request.idempotencyKey": "partial",
-          // v0.7 API6: HONEST — Kong OSS has no native idempotency. pre-function shared_dict dedupe is best-effort (per-instance, non-atomic check-and-set); suppresses sequential replays but races on concurrent first-requests. _writ_warnings divergence note. Never full.
+          // v0.7 API6: HONEST — Kong OSS has no native idempotency. pre-function shared_dict dedupe is best-effort (per-instance, non-atomic check-and-set); suppresses sequential replays but races on concurrent first-requests. _x_security_warnings divergence note. Never full.
           "authentication.accountLockout": "partial",
-          // v0.7: HONEST — no native per-credential lockout. rate-limiting limit_by=header throttles per-credential attempts (blunts brute-force) but is NOT a fixed-duration lockout and counts all attempts (gateway can't see the auth verdict). Body-field identifiers degrade to unsupported+warning. _writ_warnings note. Never full.
+          // v0.7: HONEST — no native per-credential lockout. rate-limiting limit_by=header throttles per-credential attempts (blunts brute-force) but is NOT a fixed-duration lockout and counts all attempts (gateway can't see the auth verdict). Body-field identifiers degrade to unsupported+warning. _x_security_warnings note. Never full.
           "deprecated": "full",
-          // K-5: pre-function returns 410 with writ-deprecated-endpoint-block
+          // K-5: pre-function returns 410 with x-security-deprecated-endpoint-block
           "sunsetDate": "full",
           // K-5: 410 + RFC 8594 Deprecation: true & Sunset: <date> response headers
           "replacementEndpoint": "partial",
@@ -76551,9 +76574,9 @@ function createKongGenerator(opts = {}) {
 }
 function renderWarningsHeader(warnings, deployment, edition) {
   const lines = [];
-  lines.push(`# Writ Kong generator \u2014 deployment=${deployment} edition=${edition}`);
+  lines.push(`# XSecurity Kong generator \u2014 deployment=${deployment} edition=${edition}`);
   if (!warnings.length) {
-    lines.push("# _writ_warnings: []  (no spec\u2192runtime divergences detected)");
+    lines.push("# _x_security_warnings: []  (no spec\u2192runtime divergences detected)");
     lines.push("");
     return lines.join("\n");
   }
@@ -76562,7 +76585,7 @@ function renderWarningsHeader(warnings, deployment, edition) {
     const ep = w.endpoint ? ` (endpoint=${w.endpoint})` : "";
     lines.push(`# WARNING: ${w.field}${ep}: declared="${w.declared}" emitted="${w.emitted}" \u2014 ${w.reason}`);
   }
-  lines.push("# _writ_warnings:");
+  lines.push("# _x_security_warnings:");
   for (const w of warnings) {
     lines.push(`#   - field: ${yamlScalar(w.field)}`);
     if (w.endpoint) lines.push(`#     endpoint: ${yamlScalar(w.endpoint)}`);