Clean up documentation structure and links

README.md

@@ -326,7 +326,7 @@ All release quality gates have been executed and verified on Debian Linux:
 | **Formatting** | `cargo fmt --all -- --check` | **PASS** (0 errors) |
 | **Compilation** | `cargo check --workspace --all-targets` | **PASS** (0 errors) |
 | **Clippy Linting** | `cargo clippy --workspace --all-targets --all-features -- -D warnings` | **PASS** (0 warnings) |
-| **Workspace Test Suite** | `cargo test --workspace --all-targets` | **PASS** (All 88 tests passing) |
+| **Workspace Test Suite** | `cargo test --workspace --all-targets` | **PASS** (All 162 tests passing) |
 | **CLI Test Suite** | `cargo test --test test_cli_commands` | **PASS** (11 tests passing) |
 | **Release Compilation** | `cargo build --release --workspace` | **PASS** (Optimized release binary) |
 | **Production Server Acceptance** | Physical Android WireGuard client connection | **VERIFIED** (Live handshake and RX/TX telemetry confirmed) |
@@ -374,24 +374,24 @@ at your option.
 ## 16. Documentation Master Index
 
 For detailed subsystem documentation, see the [**Documentation Index**](docs/README.md):
-- [NX9 Design Principles](docs/design-principles.md)
+- [NX9 Design Principles](docs/DESIGN-PRINCIPLES.md)
-- [System Architecture](docs/architecture.md)
+- [System Architecture](docs/ARCHITECTURE.md)
-- [Installation Guide](docs/installation.md)
+- [Installation Guide](docs/INSTALLATION.md)
-- [Native WireGuard Engine](docs/native-wireguard.md)
+- [Native WireGuard Engine](docs/NATIVE-WIREGUARD.md)
-- [Native Network Engine](docs/native-network.md)
+- [Native Network Engine](docs/NATIVE-NETWORK.md)
-- [Native nftables Engine](docs/nftables.md)
+- [Native nftables Engine](docs/NFTABLES.md)
-- [Firewall & NAT Model](docs/firewall_nat.md)
+- [Firewall & NAT Model](docs/FIREWALL_NAT.md)
-- [Reconciliation & Convergence](docs/reconciliation.md)
+- [Reconciliation & Convergence](docs/RECONCILIATION.md)
-- [Web User Interface Reference](docs/ui.md)
+- [Web User Interface Reference](docs/UI.md)
-- [REST API & WebSocket Reference](docs/api.md)
+- [REST API & WebSocket Reference](docs/API.md)
-- [CLI Command Reference](docs/cli.md)
+- [CLI Command Reference](docs/CLI.md)
-- [Configuration Reference](docs/configuration.md)
+- [Configuration Reference](docs/CONFIGURATION.md)
-- [Security & Privilege Architecture](docs/security.md)
+- [Security & Privilege Architecture](docs/SECURITY.md)
-- [Backup & Disaster Recovery](docs/backup_restore.md)
+- [Backup & Disaster Recovery](docs/BACKUP_RESTORE.md)
-- [Release Engineering](docs/release.md)
+- [Release Engineering](docs/RELEASE.md)
 - [Testing Specification](docs/TESTING.md)
-- [Development Guide](docs/development.md)
+- [Development Guide](docs/DEVELOPMENT.md)
-- [Docker Deployment](docs/docker.md)
+- [Docker Deployment](docs/DOCKER.md)
 
 ## 17. Web UI Screenshots
 
@@ -457,3 +457,5 @@ the captured evidence have been redacted where applicable.
 
 > **Additional evidence:** `screenshots/admin-instance.png` contains the captured administrative
 > instance documentation and is retained in the repository alongside the UI screenshots.
+- [Development Guide](docs/DEVELOPMENT.md)
+- [Docker Deployment](docs/DOCKER.md)

config.example.toml

@@ -23,7 +23,7 @@ reconciliation_interval_secs = 60
 dir = "/var/lib/nx9-wg/backups"
 
 # Maximum number of automated backup snapshots to retain
-max_count = 10
+max_count = 5
 
 # Optional cron schedule for automated database backups (e.g. "0 2 * * *" for 02:00 UTC)
 # schedule = "0 2 * * *"

docs/README.md

@@ -5,38 +5,38 @@ Welcome to the official documentation for the **NX9 WireGuard (`nx9-wg`)** appli
 ---
 
 ## 1. Getting Started & Philosophy
-- [**NX9 Design Principles**](design-principles.md) — Architectural philosophy, self-hosted sovereignty, zero scripting runtime, and SQLite authority.
+- [**NX9 Design Principles**](DESIGN-PRINCIPLES.md) — Architectural philosophy, self-hosted sovereignty, zero scripting runtime, and SQLite authority.
-- [**Installation & Deployment Guide**](installation.md) — Production installation, systemd service, admin bootstrap, first interface, and peer setup.
+- [**Installation & Deployment Guide**](INSTALLATION.md) — Production installation, systemd service, admin bootstrap, first interface, and peer setup.
-- [**Linux Platform & Kernel Requirements**](linux_requirements.md) — Kernel 5.6+, in-tree WireGuard module, Netlink sockets, `libnftables.so.1`, and capabilities.
+- [**Linux Platform & Kernel Requirements**](LINUX_REQUIREMENTS.md) — Kernel 5.6+, in-tree WireGuard module, Netlink sockets, `libnftables.so.1`, and capabilities.
 
 ---
 
 ## 2. Architecture & Native Linux Execution
-- [**System Architecture & Workspace Structure**](architecture.md) — Six-crate workspace breakdown, layer boundaries, and end-to-end data flows.
+- [**System Architecture & Workspace Structure**](ARCHITECTURE.md) — Six-crate workspace breakdown, layer boundaries, and end-to-end data flows.
-- [**Native WireGuard Netlink Engine**](native-wireguard.md) — Direct RTNETLINK and Generic Netlink (`wireguard`) protocol implementation.
+- [**Native WireGuard Netlink Engine**](NATIVE-WIREGUARD.md) — Direct RTNETLINK and Generic Netlink (`wireguard`) protocol implementation.
-- [**Native Network & Routing Engine**](native-network.md) — RTNETLINK link/address/route lifecycle and direct procfs IP packet forwarding.
+- [**Native Network & Routing Engine**](NATIVE-NETWORK.md) — RTNETLINK link/address/route lifecycle and direct procfs IP packet forwarding.
-- [**Native nftables Engine**](nftables.md) — In-process `libnftables.so.1` FFI transactions and dedicated `table inet nx9_wg` scoping.
+- [**Native nftables Engine**](NFTABLES.md) — In-process `libnftables.so.1` FFI transactions and dedicated `table inet nx9_wg` scoping.
-- [**Firewall & NAT Domain Model**](firewall_nat.md) — Typed rules, protocol groups, port ranges, priorities, and outbound NAT masquerading.
+- [**Firewall & NAT Domain Model**](FIREWALL_NAT.md) — Typed rules, protocol groups, port ranges, priorities, and outbound NAT masquerading.
 
 ---
 
 ## 3. Control Plane, UI & Telemetry
-- [**Reconciliation Engine & Convergence**](reconciliation.md) — Closed-loop drift detection, read-only planning, serialized apply, and convergence lifecycle states.
+- [**Reconciliation Engine & Convergence**](RECONCILIATION.md) — Closed-loop drift detection, read-only planning, serialized apply, and convergence lifecycle states.
-- [**Web User Interface (SPA)**](ui.md) — Zero-dependency embedded HTML5/CSS/JS frontend, theme engine, and all 15 application routes.
+- [**Web User Interface (SPA)**](UI.md) — Zero-dependency embedded HTML5/CSS/JS frontend, theme engine, and all 15 application routes.
-- [**Axum REST API & WebSocket Protocol**](api.md) — Complete endpoint reference, JSON schemas, error handling, and real-time event broadcaster.
+- [**Axum REST API & WebSocket Protocol**](API.md) — Complete endpoint reference, JSON schemas, error handling, and real-time event broadcaster.
-- [**Native CLI Command Reference**](cli.md) — Full reference for all 17 CLI subcommands, multi-format output (`table`/`json`/`yaml`/`csv`), and secret files.
+- [**Native CLI Command Reference**](CLI.md) — Full reference for all 18 CLI subcommands, multi-format output (`table`/`json`/`yaml`/`csv`), and secret files.
 
 ---
 
 ## 4. Security & Disaster Recovery
-- [**Security Model & Privilege Architecture**](security.md) — Single admin model (`CHECK (id=1)`), Argon2id hashing, SHA-256 tokens, permissions matrix, and brute-force protection.
+- [**Security Model & Privilege Architecture**](SECURITY.md) — Single admin model (`CHECK (id=1)`), Argon2id hashing, SHA-256 tokens, permissions matrix, and brute-force protection.
-- [**Backup & Disaster Recovery Guide**](backup_restore.md) — Atomic online SQLite backups (`VACUUM INTO`), SHA-256 manifests, and pre-restore safety snapshots.
+- [**Backup & Disaster Recovery Guide**](BACKUP_RESTORE.md) — Atomic online SQLite backups (`VACUUM INTO`), SHA-256 manifests, and pre-restore safety snapshots.
 
 ---
 
 ## 5. Operations, Development & Release
-- [**Release Engineering & Packaging**](release.md) — Standalone distribution packages (`.tar.gz`/`.tar.xz`), systemd sandboxing, installer, and rollback strategy.
+- [**Release Engineering & Packaging**](RELEASE.md) — Standalone distribution packages (`.tar.gz`/`.tar.xz`), systemd sandboxing, installer, and rollback strategy.
 - [**Comprehensive Testing Specification**](TESTING.md) — Multi-tiered test suites, SAFE mode (`LIVE=0`) vs real-kernel mode (`LIVE=1`), and automated security audits.
-- [**Developer & Contributing Guide**](development.md) — Building, testing, linting, and workspace contribution standards.
+- [**Developer & Contributing Guide**](DEVELOPMENT.md) — Building, testing, linting, and workspace contribution standards.
-- [**Configuration Reference**](configuration.md) — TOML configuration format and `NX9_WG_*` environment variable precedence.
+- [**Configuration Reference**](CONFIGURATION.md) — TOML configuration format and `NX9_WG_*` environment variable precedence.
-- [**Docker & Container Deployment**](docker.md) — Containerized deployment with Linux capability isolation and volume persistence.
+- [**Docker & Container Deployment**](DOCKER.md) — Containerized deployment with Linux capability isolation and volume persistence.

docs/RELEASE.md

@@ -6,7 +6,7 @@ This document describes the release packaging, artifact verification, filesystem
 
 ## 1. Release Packaging Pipeline
 
-Release archives are generated using [`scripts/package-release.sh`](file:///home/sunil/Programs/nx9-wg/scripts/package-release.sh):
+Release archives are generated using [`scripts/package-release.sh`](../scripts/package-release.sh):
 
 ```bash
 bash scripts/package-release.sh

docs/testing.md

@@ -1,46 +0,0 @@
-# Quality Assurance & Testing Strategy
-
-`nx9-wg` enforces a comprehensive, multi-tiered verification strategy designed to guarantee code correctness, memory safety, failure semantics, and secret protection.
-
----
-
-## 1. Test Suite Summary & Quality Gates
-
-| Tier | Test Suite / Check | Scope & Execution Target | Current Status |
-| :--- | :--- | :--- | :---: |
-| **Tier 1** | Code Formatting | `cargo fmt --all -- --check` | **PASS** (Zero diffs) |
-| **Tier 2** | Type & Borrow Check | `cargo check --workspace` | **PASS** (Zero errors) |
-| **Tier 3** | Workspace Unit Tests | `cargo test --workspace` | **PASS** (**91 / 91 passed**) |
-| **Tier 4** | Clippy Linter Check | `cargo clippy --workspace --all-targets --all-features -- -D warnings` | **PASS** (Zero warnings) |
-| **Tier 5** | Release Compilation | `cargo build --release` | **PASS** (Clean build) |
-| **Tier 6** | Comprehensive CLI Suite | `LIVE=0 bash scripts/test-cli-comprehensive.sh` | **PASS** (**203 passed** / 7 skipped) |
-| **Tier 7** | Native Integration Suite | `LIVE=0 bash scripts/test-native-integration.sh` | **PASS** (**19 passed** / 1 skipped) |
-| **Tier 8** | Dedicated Live Kernel Suite | `LIVE=0 bash scripts/test-live-kernel.sh` | **PASS** (**23 passed** / 1 skipped) |
-| **Tier 9** | Subprocess Safety Audit | Automated source scan for `Command::new` | **PASS** (Zero subprocesses) |
-| **Tier 10** | Secret Leakage Audit | Automated scan for plaintext credentials | **PASS** (Zero secrets leaked) |
-| **Tier 11** | Release Package Check | Standalone archive extraction & verification | **PASS** (Independent execution) |
-
----
-
-## 2. SAFE Mode (`LIVE=0`) vs Real-Kernel Mode (`LIVE=1`)
-
-To guarantee safety when developing on unprivileged developer workstations:
-
-### SAFE Mode (`LIVE=0` — Default)
-- Uses real in-memory SQLite stores and dry-run Netlink message builders.
-- Validates CLI parsers, JSON/YAML/CSV output formatters, route equality rules, and read-only reconciliation planning.
-- Automatically skips live kernel mutation steps that require root or `CAP_NET_ADMIN`.
-
-### Real-Kernel Mode (`LIVE=1` — Dedicated Host Only)
-- Requires `root` or `CAP_NET_ADMIN` in a dedicated, disposable Linux VM.
-- Creates real kernel WireGuard interfaces (e.g. `nx9t...`), attaches IPv4/IPv6 addresses, installs routes in the kernel routing table, configures `table inet nx9_wg` in Netfilter, and validates live handshake telemetry.
-
----
-
-## 3. Automated Subprocess & Secret Audits
-
-Every verification run executes strict source-level security audits:
-
-1. **Subprocess Audit**: Confirms zero instances of `std::process::Command`, `tokio::process::Command`, `Command::new`, or shell scripts in production Rust crates.
-2. **Secret Redaction Audit**: Confirms that password hashes, private keys, preshared keys, and token hashes are never printed in human-readable status outputs or logs.
-3. **Environment Audit**: Confirms that all recognized environment variables strictly observe the `NX9_WG_*` namespace.