SPEC: requirements and reasons only, reference material in docs/

docs/settings.md is now the one settings reference; the spec keeps the
conventions, the off list and each group's requirements and reasons, and
links to it for the per-setting entries. The endpoint list, the ban
notes, the state file contents, the rule file format and the alert
object likewise live in docs/ and are linked from the spec. The package
list from the README's Design section joins "Architecture". The nine
docs files are byte-identical to those on the README branch. Package
comments that named "Alert webhook schema", "Request log" and "Metrics
endpoint" for their field lists now name the docs files.

Model: fable-5-1

docs/core-rule-set.md

@@ -0,0 +1,31 @@
+# The Core Rule Set
+
+The OWASP Core Rule Set 4.25.0 runs on each request after the rule files, unless
+`SWWAF_WAF_MODE` is `off`. It reads the method, the URL with its query, and the
+headers. Once `SWWAF_WAF_BODY_LIMIT` is set, it also reads a body that is form
+data, multipart, JSON or XML. No answer is inspected. The settings are under
+"Attack detection" in [`settings.md`](settings.md). The same section of
+[`SPEC.md`](../SPEC.md) says why bodies are not read by default, and gives the
+six changes `smallwebwaf` makes to the Core Rule Set, with the reason for each.
+
+Each rule that matches adds to the request's score. A score at or over
+`SWWAF_WAF_ANOMALY_THRESHOLD` is a match. A match is refused with `403` while
+`SWWAF_WAF_MODE` is `block`, and let through while it is `detect`. Either way
+the log line gives the rule ids and the score, and a `waf_block` alert is sent.
+A request with more than 1000 query parameters or body fields adds 5 to its
+score, since Coraza reads only the first 1000. The Core Rule Set inspects only a
+request that every earlier check let through. It skips a path under
+`SWWAF_WAF_EXEMPT_PATHS` and a client in `SWWAF_ALLOW_NETS`. An engine error on
+a request forwards the request, and is logged and counted.
+
+Body inspection suits apps whose forms carry no code. In front of a code forge
+it refuses issue and comment text, wiki pages and files saved in the web editor
+that hold shell commands or code. The log line names the rule ids, which
+`SWWAF_WAF_DISABLED_RULES` can switch off. A body the Core Rule Set cannot parse
+adds 5 to the score. So does a multipart body cut by the limit in the middle of
+a part's header. The client has until `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out to
+send the part that is read. Any other body, such as a git push, reaches the app
+uninspected.
+
+[`gitea.md`](gitea.md) records what the Core Rule Set still refuses in front of
+gitea, with and without body inspection.