Update README.md to document out/linux_server and out/win_server deployment packages

.gitea/workflows/ci.yml

@@ -24,11 +24,11 @@ jobs:
             apt-get install -y python3 python3-pip python3-venv curl
           fi
           python3 -m pip install --upgrade pip --break-system-packages || python3 -m pip install --upgrade pip || true
-          pip3 install -r requirements.txt --break-system-packages || pip3 install -r requirements.txt
+          pip3 install -r compilation/requirements.txt --break-system-packages || pip3 install -r compilation/requirements.txt
 
       - name: Verify Python Syntax
         run: |
-          python3 -m py_compile Server.py Win_Client.py Linux_Client.py package_dist.py upload_release.py test_pipeline.py tests/*.py
+          python3 -m py_compile src/Server.py src/Win_Client.py src/Linux_Client.py compilation/package_dist.py compilation/upload_release.py tests/test_pipeline.py tests/*.py
 
       - name: Run Component Unit Tests
         run: |
@@ -40,10 +40,10 @@ jobs:
           rm -f server_config.json client_config.json logar_state.db client_state.json
 
           # 1. Initialize server config and export client configuration
-          python3 Server.py --create-client-config --server-host 127.0.0.1 --server-port 9443 --client-out client_config.json
+          python3 src/Server.py --create-client-config --server-host 127.0.0.1 --server-port 9443 --client-out client_config.json
 
           # 2. Launch LOGAR server in the background
-          python3 Server.py &
+          python3 src/Server.py &
           SERVER_PID=$!
           echo "[*] Server launched in background with PID $SERVER_PID"
 
@@ -65,7 +65,7 @@ jobs:
           fi
 
           # 4. Execute end-to-end integration test
-          python3 test_pipeline.py
+          python3 tests/test_pipeline.py
 
           # 5. Cleanly terminate background server
           kill $SERVER_PID || true

.gitea/workflows/release-linux.yml

@@ -26,11 +26,11 @@ jobs:
             apt-get install -y python3 python3-pip python3-venv binutils zip
           fi
           python3 -m pip install --upgrade pip --break-system-packages || python3 -m pip install --upgrade pip || true
-          pip3 install pyinstaller -r requirements.txt --break-system-packages || pip3 install pyinstaller -r requirements.txt
+          pip3 install pyinstaller -r compilation/requirements.txt --break-system-packages || pip3 install pyinstaller -r compilation/requirements.txt
 
       - name: Compile Standalone Linux Binaries
         run: |
-          python3 package_dist.py --target linux
+          python3 compilation/package_dist.py --target linux
 
       - name: Publish Linux Release Assets
         env:
@@ -39,4 +39,4 @@ jobs:
           GITEA_REPOSITORY: ${{ github.repository }}
           GITEA_REF_NAME: ${{ inputs.tag || github.ref_name }}
         run: |
-          python3 upload_release.py --skip-build
+          python3 compilation/upload_release.py --skip-build

.gitea/workflows/release-windows.yml

@@ -35,7 +35,7 @@ jobs:
             }
           }
           & $py -m pip install --upgrade pip
-          & $py -m pip install pyinstaller -r requirements.txt
+          & $py -m pip install pyinstaller -r compilation/requirements.txt
 
       - name: Compile Standalone Windows Binaries
         shell: powershell
@@ -46,7 +46,7 @@ jobs:
               $py = "py -3.12"
             }
           }
-          & $py package_dist.py --target windows
+          & $py compilation/package_dist.py --target windows
 
       - name: Publish Windows Release Assets
         shell: powershell
@@ -62,4 +62,4 @@ jobs:
               $py = "py -3.12"
             }
           }
-          & $py upload_release.py --skip-build
+          & $py compilation/upload_release.py --skip-build

README.md

@@ -88,7 +88,7 @@ graph TB
   - A cryptographically random authentication secret token (`auth_token`).
 - **Client Configuration Exporter**:
   ```bash
-  python Server.py --create-client-config --server-host 127.0.0.1 --server-port 9443 --client-out client_config.json
+  python src/Server.py --create-client-config --server-host 127.0.0.1 --server-port 9443 --client-out client_config.json
   ```
   Produces an anonymous client config containing only the server socket coordinates, authentication token, and the encryption-only public key & fingerprint.
 - **Socket Protocol Framing**:
@@ -177,27 +177,37 @@ LOGAR/
 │       ├── ci.yml                  # Continuous Integration automated test suite (runs on every push)
 │       ├── release-linux.yml       # Linux release workflow (compiles Server.bin, Linux_Client.bin, checksums)
 │       └── release-windows.yml     # Windows release workflow (compiles Server.exe, Win_Client.exe, checksums)
-├── .gitignore                      # Ignore venv, caches, DBs, and private keys
-├── requirements.txt                # Unified dependencies
-├── README.md                       # Comprehensive documentation
-├── Server.py                       # Central TCP server and Hermes API
-├── Win_Client.py                   # Windows edge forwarder
-├── Linux_Client.py                 # Linux edge forwarder
-├── server_config.sample.json       # Central server sample configuration
-├── package_dist.py                 # Multi-platform standalone binary packaging script
-├── upload_release.py               # Direct Gitea REST API release asset publisher
-├── test_pipeline.py                # End-to-end integration test
-├── tests/                          # Unified unit test suites
+├── compilation/                    # Build, packaging, and release automation tools
+│   ├── package_dist.py             # Multi-platform standalone binary packaging script
+│   ├── requirements.txt            # Unified project dependencies
+│   └── upload_release.py           # Direct Gitea REST API release asset publisher
+├── src/                            # Core application source modules
+│   ├── __init__.py
+│   ├── Server.py                   # Central TCP server and Hermes API
+│   ├── Win_Client.py               # Windows edge forwarder
+│   └── Linux_Client.py             # Linux edge forwarder
+├── tests/                          # Automated test suites
+│   ├── test_linux_client.py        # Linux client unit tests
+│   ├── test_pipeline.py            # End-to-end integration test
 │   ├── test_server.py              # Server unit tests
-│   ├── test_win_client.py          # Windows client unit tests
-│   └── test_linux_client.py        # Linux client unit tests
-└── out/                            # Edge forwarder deployment packages
-    ├── win_client/
-    │   ├── client_config.sample.json # Reference client configuration
-    │   └── README.md               # Windows service installation & configuration guide
-    └── linux_client/
-        ├── client_config.sample.json # Reference client configuration
-        └── README.md               # Linux service installation & configuration guide
+│   └── test_win_client.py          # Windows client unit tests
+├── .gitignore                      # Ignore venv, caches, DBs, and private keys
+├── README.md                       # Comprehensive documentation
+├── RELEASE_NOTES.md                # Release history and changelog
+├── server_config.sample.json       # Central server sample configuration
+└── out/                            # Standalone deployment documentation & sample configs
+    ├── linux_server/
+    │   ├── README.md               # Linux systemd service installation & hub guide
+    │   └── server_config.sample.json # Reference server configuration
+    ├── win_server/
+    │   ├── README.md               # Windows service (NSSM/Task Scheduler) installation guide
+    │   └── server_config.sample.json # Reference server configuration
+    ├── linux_client/
+    │   ├── README.md               # Linux service & timer installation guide
+    │   └── client_config.sample.json # Reference client configuration
+    └── win_client/
+        ├── README.md               # Windows service installation & configuration guide
+        └── client_config.sample.json # Reference client configuration
 ```
 
 ---
@@ -208,15 +218,15 @@ LOGAR/
 
 1. **Install dependencies**:
    ```bash
-   pip install -r requirements.txt
+   pip install -r compilation/requirements.txt
    ```
 2. **Start the server** (generates `server_config.json` and keypair on first run):
    ```bash
-   python Server.py
+   python src/Server.py
    ```
 3. **Export a client configuration**:
    ```bash
-   python Server.py --create-client-config --server-host <SERVER_IP> --server-port 9443 --client-out client_config.json
+   python src/Server.py --create-client-config --server-host <SERVER_IP> --server-port 9443 --client-out client_config.json
    ```
 
 ### 2. Windows Client Deployment
@@ -287,23 +297,23 @@ The pipeline test exercises invalid token rejection, encrypted socket streaming,
 
 1. **Start the server** in Shell 1 (creates `server_config.json` on first run):
    ```bash
-   python Server.py
+   python src/Server.py
    ```
 2. **Export client configuration** in Shell 2 (required for testing):
    ```bash
-   python Server.py --create-client-config --server-host 127.0.0.1 --server-port 9443 --client-out client_config.json
+   python src/Server.py --create-client-config --server-host 127.0.0.1 --server-port 9443 --client-out client_config.json
    ```
 3. **Execute the integration test** in Shell 2:
    ```bash
-   python test_pipeline.py
+   python tests/test_pipeline.py
    ```
 
 ## Continuous Integration via Gitea Actions
 
 Continuous integration is automated via [`.gitea/workflows/ci.yml`](.gitea/workflows/ci.yml) and triggers automatically on **every push** and pull request:
-1. **Syntax Compilation**: Validates all Python scripts (`Server.py`, `Win_Client.py`, `Linux_Client.py`, `package_dist.py`, `upload_release.py`, `test_pipeline.py`, and test suites).
+1. **Syntax Compilation**: Validates all Python scripts (`src/Server.py`, `src/Win_Client.py`, `src/Linux_Client.py`, `compilation/package_dist.py`, `compilation/upload_release.py`, `tests/test_pipeline.py`, and test suites).
 2. **Component Unit Tests**: Discovers and runs all unit tests in `tests/` (`test_server.py`, `test_win_client.py`, `test_linux_client.py`).
-3. **End-to-End Pipeline Verification**: Automatically spins up the LOGAR server hub, generates test configs, runs `test_pipeline.py` (testing socket authentication, 4-run rule persistence, Hermes API report, and client integrations), and shuts down the test instance.
+3. **End-to-End Pipeline Verification**: Automatically spins up the LOGAR server hub, generates test configs, runs `tests/test_pipeline.py` (testing socket authentication, 4-run rule persistence, Hermes API report, and client integrations), and shuts down the test instance.
 
 ---
 
@@ -360,13 +370,13 @@ git push origin v1.0.1
 You can also compile and package binaries locally anytime:
 ```bash
 # Windows
-py -3.12 package_dist.py --target windows
+py -3.12 compilation/package_dist.py --target windows
 
 # Linux
-python3 package_dist.py --target linux
+python3 compilation/package_dist.py --target linux
 ```
 To upload local builds directly to Gitea:
 ```powershell
-python upload_release.py --tag v1.0.1 --token <YOUR_GITEA_TOKEN>
+python compilation/upload_release.py --tag v1.0.1 --token <YOUR_GITEA_TOKEN>
 ```
 *(Environment variables `GITEA_TOKEN`, `GITEA_SERVER_URL`, `GITEA_REPOSITORY`, and `GITEA_REF_NAME` are also supported automatically).*

compilation/package_dist.py

@@ -7,9 +7,10 @@ import platform
 import subprocess
 import argparse
 
-ROOT_DIR = os.path.abspath(os.path.dirname(__file__))
-DIST_DIR = os.path.abspath("dist")
-BUILD_TEMP = os.path.abspath("build_temp")
+ROOT_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+SRC_DIR = os.path.join(ROOT_DIR, "src")
+DIST_DIR = os.path.join(ROOT_DIR, "dist")
+BUILD_TEMP = os.path.join(ROOT_DIR, "build_temp")
 
 def clean_and_prep():
     if os.path.exists(DIST_DIR):
@@ -55,7 +56,7 @@ def build_linux_zipapp_fallback():
     # Linux Client zipapp
     app_dir = os.path.join(BUILD_TEMP, "linux_app")
     os.makedirs(app_dir, exist_ok=True)
-    shutil.copy(os.path.join(ROOT_DIR, "Linux_Client.py"), os.path.join(app_dir, "Linux_Client.py"))
+    shutil.copy(os.path.join(SRC_DIR, "Linux_Client.py"), os.path.join(app_dir, "Linux_Client.py"))
     client_out = os.path.join(DIST_DIR, "Linux_Client.bin")
     zipapp.create_archive(
         source=app_dir,
@@ -66,7 +67,7 @@ def build_linux_zipapp_fallback():
     # Server zipapp
     srv_dir = os.path.join(BUILD_TEMP, "linux_srv")
     os.makedirs(srv_dir, exist_ok=True)
-    shutil.copy(os.path.join(ROOT_DIR, "Server.py"), os.path.join(srv_dir, "Server.py"))
+    shutil.copy(os.path.join(SRC_DIR, "Server.py"), os.path.join(srv_dir, "Server.py"))
     server_out = os.path.join(DIST_DIR, "Server.bin")
     zipapp.create_archive(
         source=srv_dir,
@@ -77,10 +78,10 @@ def build_linux_zipapp_fallback():
 
 def build_windows():
     print("[*] Compiling Windows standalone executables...")
-    win_client_script = os.path.join(ROOT_DIR, "Win_Client.py")
+    win_client_script = os.path.join(SRC_DIR, "Win_Client.py")
     build_pyinstaller_binary(win_client_script, "Win_Client")
 
-    server_script = os.path.join(ROOT_DIR, "Server.py")
+    server_script = os.path.join(SRC_DIR, "Server.py")
     build_pyinstaller_binary(server_script, "Server")
 
     client_bin = os.path.join(DIST_DIR, "Win_Client.exe")
@@ -111,10 +112,10 @@ def build_linux():
     is_linux_host = platform.system() == "Linux"
 
     if is_linux_host:
-        linux_client_script = os.path.join(ROOT_DIR, "Linux_Client.py")
+        linux_client_script = os.path.join(SRC_DIR, "Linux_Client.py")
         build_pyinstaller_binary(linux_client_script, "Linux_Client.bin")
 
-        server_script = os.path.join(ROOT_DIR, "Server.py")
+        server_script = os.path.join(SRC_DIR, "Server.py")
         build_pyinstaller_binary(server_script, "Server.bin")
 
         # Normalize extensions in case PyInstaller dropped .bin

compilation/upload_release.py

@@ -4,7 +4,8 @@ import json
 import argparse
 import urllib.request
 import urllib.parse
-import mimetypes
+ROOT_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+sys.path.insert(0, os.path.dirname(__file__))
 import package_dist
 
 import time
@@ -162,8 +163,8 @@ def main():
     if not notes and args.notes_file and os.path.exists(args.notes_file):
         with open(args.notes_file, "r", encoding="utf-8") as nf:
             notes = nf.read()
-    elif not notes and os.path.exists("RELEASE_NOTES.md"):
-        with open("RELEASE_NOTES.md", "r", encoding="utf-8") as nf:
+    elif not notes and os.path.exists(os.path.join(ROOT_DIR, "RELEASE_NOTES.md")):
+        with open(os.path.join(ROOT_DIR, "RELEASE_NOTES.md"), "r", encoding="utf-8") as nf:
             notes = nf.read()
     elif not notes:
         notes = (
@@ -184,9 +185,9 @@ def main():
         print("[*] Assembling compiled binaries...")
         package_dist.main()
 
-    dist_dir = os.path.abspath("dist")
+    dist_dir = os.path.join(ROOT_DIR, "dist")
     if not os.path.exists(dist_dir) or not os.listdir(dist_dir):
-        print("[!] No binaries found in dist/. Run package_dist.py first.")
+        print(f"[!] No binaries found in {dist_dir}. Run package_dist.py first.")
         sys.exit(1)
 
     print(f"[*] Connecting to Gitea: {args.url} (repo: {args.repo})...")

out/linux_client/README.md

@@ -22,7 +22,7 @@ Standalone compiled binary distribution for Linux edge servers running systemd.
 Run the following command on your central LOGAR server to export a client bundle tailored for your environment:
 
 ```bash
-python Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
+python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
 ```
 
 - Replace `<SERVER_IP_OR_DNS>` with the reachable IP address or FQDN of your central LOGAR server hub.

out/linux_server/README.md

@@ -0,0 +1,208 @@
+# LOGAR Linux Server Hub
+
+Standalone compiled executable binary distribution for Linux server environments (`Server.bin`).
+
+---
+
+## Overview
+
+`Server.bin` is a self-contained, pre-compiled Linux ELF executable that operates as the central coordination and log analysis hub of the LOGAR telemetry architecture.
+
+### Key Architecture & Capabilities
+- **Pre-compiled & Dependency-Free**: Ships as a standalone native Linux ELF binary (`Server.bin`). No Python runtime, pip dependencies, or GnuPG binaries are required on the host system.
+- **Authenticated TCP Ingestion Socket (Port 9443)**: Accepts framed OpenPGP encrypted log batches streamed by edge forwarders (`Linux_Client.bin` and `Win_Client.exe`).
+- **4-Run Temporal Persistence Rule**: Ingested candidate error signatures are evaluated against an episodic threshold. An anomaly must occur across at least 4 distinct client transmission cycles within a sliding 12-hour evaluation window before promotion from transient noise to a `VERIFIED` anomaly.
+- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report` for external scrapers, SIEM collectors, and alerting dashboards.
+- **Pure-Python OpenPGP Cryptography**: Zero dependency on external `gpg` binaries. Automatically generates RSA-2048 encryption keys and SHA-256 fingerprints on first launch.
+- **State Database**: Tracks anomaly lifecycles, run counters, and machine telemetry in a local SQLite state database (`logar_state.db`).
+
+---
+
+## 1. Initializing & Generating Server Configuration
+
+### Step 1: Automatic First-Run Generation
+When launched without an existing `server_config.json`, `Server.bin` automatically generates:
+1. A fresh OpenPGP RSA-2048 encryption keypair (`private_key` and `public_key`).
+2. A SHA-256 public encryption fingerprint (`server_fingerprint`).
+3. A cryptographically random secret authentication token (`auth_token`).
+4. Default network socket coordinates (TCP 9443, Hermes API 8443).
+
+Run `Server.bin` once to initialize:
+```bash
+./Server.bin
+```
+Output:
+```
+[!] Config 'server_config.json' not found. Initializing first-run configuration...
+[+] Successfully generated new server config and OpenPGP keypair.
+[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
+[+] Saved to: server_config.json
+```
+
+### Step 2: Configuration Fields Reference
+The generated `server_config.json` contains:
+
+```json
+{
+  "server_name": "LOGAR-Linux-Hub",
+  "tcp_host": "0.0.0.0",
+  "tcp_port": 9443,
+  "hermes_host": "0.0.0.0",
+  "hermes_port": 8443,
+  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
+  "db_path": "logar_state.db",
+  "evaluation_window_hours": 12,
+  "min_persistence_runs": 4,
+  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
+  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
+  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
+}
+```
+
+| Parameter | Default | Description |
+| :--- | :--- | :--- |
+| `server_name` | `"LOGAR-Linux-Hub"` | Human-readable identifier for this hub instance |
+| `tcp_host` | `"0.0.0.0"` | Network interface to bind for edge client TCP ingestion |
+| `tcp_port` | `9443` | TCP port for incoming edge log batches |
+| `hermes_host` | `"0.0.0.0"` | Network interface to bind for Hermes HTTP API |
+| `hermes_port` | `8443` | HTTP port for the Hermes reporting endpoint |
+| `auth_token` | *(auto-generated)* | Pre-shared secret required in edge client envelopes |
+| `db_path` | `"logar_state.db"` | Path to persistent SQLite issue database |
+| `evaluation_window_hours` | `12` | Sliding temporal window for 4-run rule persistence |
+| `min_persistence_runs` | `4` | Number of distinct runs required to promote to `VERIFIED` |
+
+---
+
+## 2. Generating Client Configuration Bundles
+
+Edge forwarders (`Linux_Client.bin` and `Win_Client.exe`) require a minimal, anonymous configuration bundle containing socket coordinates, the authentication token, and the server's public key (without sensitive server names or private keys).
+
+Run the following command on the server:
+```bash
+./Server.bin --create-client-config --server-host <SERVER_PUBLIC_OR_INTERNAL_IP> --server-port 9443 --client-out client_config.json
+```
+
+- Replace `<SERVER_PUBLIC_OR_INTERNAL_IP>` with the reachable IP or FQDN of your LOGAR server.
+- The output `client_config.json` can be distributed directly to Linux and Windows edge forwarder nodes.
+
+---
+
+## 3. Running Interactively
+
+```bash
+./Server.bin --config /path/to/server_config.json
+```
+
+### Command-Line Arguments
+| Argument | Description |
+| :--- | :--- |
+| `--config` | Path to server configuration JSON file (default: `server_config.json`) |
+| `--create-client-config` | Exports an anonymous client configuration bundle and exits |
+| `--server-host` | Hostname/IP to embed in the exported client configuration |
+| `--server-port` | Port to embed in the exported client configuration (default: `9443`) |
+| `--client-out` | Destination path for exported client configuration (default: `client_config.json`) |
+
+---
+
+## 4. Installing as a Systemd Service (Recommended)
+
+Running `Server.bin` as a native systemd background service ensures continuous execution, automatic restart upon reboot or crash, and centralized log management via `journalctl`.
+
+### Step 1: Create Deployment Directory and User
+```bash
+# Create dedicated system group and user
+sudo useradd --system --no-create-home --shell /usr/sbin/nologin logar
+
+# Prepare deployment folder
+sudo mkdir -p /opt/logar-server
+sudo cp Server.bin server_config.json /opt/logar-server/
+sudo chmod +x /opt/logar-server/Server.bin
+sudo chown -R logar:logar /opt/logar-server
+```
+
+### Step 2: Create Systemd Service File
+Create `/etc/systemd/system/logar-server.service`:
+
+```ini
+[Unit]
+Description=LOGAR Central Server Hub Service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=logar
+Group=logar
+WorkingDirectory=/opt/logar-server
+ExecStart=/opt/logar-server/Server.bin --config /opt/logar-server/server_config.json
+Restart=always
+RestartSec=5
+LimitNOFILE=65536
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
+```
+
+### Step 3: Enable and Start Service
+```bash
+sudo systemctl daemon-reload
+sudo systemctl enable --now logar-server.service
+```
+
+### Step 4: Verify Status and Inspect Logs
+```bash
+# Check service status
+sudo systemctl status logar-server.service
+
+# Stream live server logs
+sudo journalctl -u logar-server.service -f
+```
+
+---
+
+## 5. Hermes Reporting API & Integration
+
+The server embeds a high-performance HTTP service on port `8443` providing real-time intelligence on promoted anomalies:
+
+### Fetching Promoted Anomalies
+```bash
+curl -s http://127.0.0.1:8443/api/hermes/report | jq .
+```
+
+### Response Schema:
+```json
+[
+  {
+    "fingerprint": "prod-web-01.corp.internal:Out_Of_Memory",
+    "server": "prod-web-01.corp.internal",
+    "signature": "Out_Of_Memory",
+    "consecutive_runs": 4,
+    "first_seen": "2026-09-04T08:00:00Z",
+    "last_seen": "2026-09-04T14:30:00Z",
+    "status": "VERIFIED",
+    "verified": true,
+    "os_type": "linux",
+    "sample_message": "kernel: Out of memory: Kill process 1824"
+  }
+]
+```
+
+---
+
+## 6. Firewall Configuration
+
+Ensure the following inbound ports are open on your host firewall:
+
+```bash
+# UFW (Ubuntu / Debian)
+sudo ufw allow 9443/tcp comment "LOGAR TCP Log Ingestion"
+sudo ufw allow 8443/tcp comment "LOGAR Hermes Reporting API"
+sudo ufw reload
+
+# Firewalld (RHEL / CentOS / Rocky / Alma)
+sudo firewall-cmd --permanent --add-port=9443/tcp
+sudo firewall-cmd --permanent --add-port=8443/tcp
+sudo firewall-cmd --reload
+```

out/linux_server/server_config.sample.json

@@ -0,0 +1,14 @@
+{
+  "server_name": "LOGAR-Linux-Hub",
+  "tcp_host": "0.0.0.0",
+  "tcp_port": 9443,
+  "hermes_host": "0.0.0.0",
+  "hermes_port": 8443,
+  "auth_token": "replace_with_secure_random_hex_token",
+  "db_path": "logar_state.db",
+  "evaluation_window_hours": 12,
+  "min_persistence_runs": 4,
+  "server_fingerprint": "AUTO_GENERATED_ON_FIRST_RUN",
+  "public_key": "AUTO_GENERATED_ON_FIRST_RUN",
+  "private_key": "AUTO_GENERATED_ON_FIRST_RUN"
+}

out/win_client/README.md

@@ -22,7 +22,7 @@ Standalone compiled executable distribution for Windows Server and workstation e
 Run the following command on your central LOGAR server to export a client bundle tailored for your environment:
 
 ```bash
-python Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
+python src/Server.py --create-client-config --server-host <SERVER_IP_OR_DNS> --server-port 9443 --client-out client_config.json
 ```
 
 - Replace `<SERVER_IP_OR_DNS>` with the reachable IP address or FQDN of your central LOGAR server hub.

out/win_server/README.md

@@ -0,0 +1,237 @@
+# LOGAR Windows Server Hub
+
+Standalone compiled executable distribution for Windows Server environments (`Server.exe`).
+
+---
+
+## Overview
+
+`Server.exe` is a self-contained, pre-compiled native Windows PE executable that serves as the central log aggregation, temporal persistence analyzer, and reporting hub of the LOGAR infrastructure.
+
+### Key Architecture & Capabilities
+- **Pre-compiled & Dependency-Free**: Ships as a standalone Windows executable (`Server.exe`). No Python installation, pip packages, or GnuPG binaries are required on Windows Server.
+- **Authenticated TCP Ingestion Socket (Port 9443)**: Ingests framed OpenPGP encrypted log batches streamed from edge forwarder nodes (`Win_Client.exe` and `Linux_Client.bin`).
+- **4-Run Temporal Persistence Rule**: Filters transient noise by requiring an issue signature to recur across at least 4 episodic transmission cycles within a rolling 12-hour evaluation window before promotion to `VERIFIED`.
+- **Embedded Hermes Reporting API (Port 8443)**: Integrated REST API exposing `/api/hermes/report` for external dashboards, monitoring agents, and scrapers.
+- **Pure-Python OpenPGP Cryptography**: Automatically generates RSA-2048 encryption keys and a SHA-256 fingerprint on first launch without external dependencies.
+- **State Database**: Stores issue lifecycle records, run counters, and machine telemetry in a local SQLite database (`logar_state.db`).
+
+---
+
+## 1. Initializing & Generating Server Configuration
+
+### Step 1: Automatic First-Run Generation
+When launched without an existing `server_config.json`, `Server.exe` automatically initializes:
+1. An OpenPGP RSA-2048 encryption keypair (`private_key` and `public_key`).
+2. A SHA-256 public encryption fingerprint (`server_fingerprint`).
+3. A cryptographically random secret authentication token (`auth_token`).
+4. Default network socket coordinates (TCP 9443, Hermes API 8443).
+
+Open PowerShell and run:
+```powershell
+.\Server.exe
+```
+Output:
+```
+[!] Config 'server_config.json' not found. Initializing first-run configuration...
+[+] Successfully generated new server config and OpenPGP keypair.
+[+] Server Encryption Fingerprint: 375388960531264EA0648EC0D2C4E4ABC6F22AC2
+[+] Saved to: server_config.json
+```
+
+### Step 2: Configuration Fields Reference
+The generated `server_config.json` contains:
+
+```json
+{
+  "server_name": "LOGAR-Windows-Hub",
+  "tcp_host": "0.0.0.0",
+  "tcp_port": 9443,
+  "hermes_host": "0.0.0.0",
+  "hermes_port": 8443,
+  "auth_token": "a1b2c3d4e5f67890abcdef1234567890...",
+  "db_path": "logar_state.db",
+  "evaluation_window_hours": 12,
+  "min_persistence_runs": 4,
+  "server_fingerprint": "375388960531264EA0648EC0D2C4E4ABC6F22AC2",
+  "public_key": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n...",
+  "private_key": "-----BEGIN PGP PRIVATE KEY BLOCK-----\n..."
+}
+```
+
+| Parameter | Default | Description |
+| :--- | :--- | :--- |
+| `server_name` | `"LOGAR-Windows-Hub"` | Identifier for this hub instance |
+| `tcp_host` | `"0.0.0.0"` | Network interface to bind for incoming client socket traffic |
+| `tcp_port` | `9443` | TCP port for incoming edge log batches |
+| `hermes_host` | `"0.0.0.0"` | Network interface to bind for Hermes HTTP API |
+| `hermes_port` | `8443` | HTTP port for the Hermes reporting endpoint |
+| `auth_token` | *(auto-generated)* | Pre-shared authentication secret required in client envelopes |
+| `db_path` | `"logar_state.db"` | Path to persistent SQLite issue database |
+| `evaluation_window_hours` | `12` | Rolling evaluation window in hours for 4-run rule |
+| `min_persistence_runs` | `4` | Consecutive runs required to promote an issue to `VERIFIED` |
+
+---
+
+## 2. Generating Client Configuration Bundles
+
+Edge forwarders (`Win_Client.exe` and `Linux_Client.bin`) require an anonymous client configuration bundle that includes the server socket target, authentication token, and encryption public key, without exposing sensitive server names or private keys.
+
+Run the following command on the server:
+```powershell
+.\Server.exe --create-client-config --server-host <SERVER_IP_OR_FQDN> --server-port 9443 --client-out client_config.json
+```
+
+- Replace `<SERVER_IP_OR_FQDN>` with the reachable IP or DNS name of your LOGAR server.
+- Distribute `client_config.json` to client forwarder nodes along with `Win_Client.exe` or `Linux_Client.bin`.
+
+---
+
+## 3. Running Interactively
+
+```powershell
+.\Server.exe --config C:\LOGAR-Server\server_config.json
+```
+
+### Command-Line Arguments
+| Argument | Description |
+| :--- | :--- |
+| `--config` | Path to server configuration JSON file (default: `server_config.json`) |
+| `--create-client-config` | Exports an anonymous client configuration bundle and exits |
+| `--server-host` | Hostname/IP to embed in the exported client configuration |
+| `--server-port` | Port to embed in the exported client configuration (default: `9443`) |
+| `--client-out` | Destination path for exported client configuration (default: `client_config.json`) |
+
+---
+
+## 4. Installing as a Continuous Windows Service
+
+Because `Server.exe` acts as a continuous server hub (listening for TCP connections and HTTP API queries), it should run persistently in the background.
+
+### Method A: Native Windows Service via NSSM (Recommended)
+[NSSM (Non-Sucking Service Manager)](https://nssm.cc/) is the industry standard for wrapping standalone executables into formal Windows services managed by `services.msc`.
+
+1. Place `Server.exe` and `server_config.json` in `C:\LOGAR-Server\`.
+2. Open **Elevated PowerShell (Run as Administrator)**:
+   ```powershell
+   # Create deployment folder
+   New-Item -ItemType Directory -Path "C:\LOGAR-Server" -Force
+   Copy-Item "Server.exe", "server_config.json" -Destination "C:\LOGAR-Server\"
+
+   # Install Windows Service via NSSM
+   nssm.exe install LOGAR_Server "C:\LOGAR-Server\Server.exe" "--config C:\LOGAR-Server\server_config.json"
+   nssm.exe set LOGAR_Server AppDirectory "C:\LOGAR-Server"
+   nssm.exe set LOGAR_Server Description "LOGAR Central Aggregation Hub Service"
+   nssm.exe set LOGAR_Server Start SERVICE_AUTO_START
+   nssm.exe set LOGAR_Server AppStdout "C:\LOGAR-Server\server_out.log"
+   nssm.exe set LOGAR_Server AppStderr "C:\LOGAR-Server\server_err.log"
+
+   # Start the service
+   nssm.exe start LOGAR_Server
+   ```
+3. Verify status in PowerShell:
+   ```powershell
+   Get-Service -Name "LOGAR_Server"
+   ```
+
+### Method B: Windows Task Scheduler (Startup Daemon)
+If third-party service wrappers are restricted by organizational policy, configure a Task Scheduler job triggered at boot under the `SYSTEM` account:
+
+```powershell
+# Action: Launch Server.exe
+$Action = New-ScheduledTaskAction -Execute "C:\LOGAR-Server\Server.exe" `
+                                  -Argument "--config C:\LOGAR-Server\server_config.json" `
+                                  -WorkingDirectory "C:\LOGAR-Server"
+
+# Trigger: At system startup
+$Trigger = New-ScheduledTaskTrigger -AtStartup
+
+# Settings: Restart on failure, no execution time limit
+$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries `
+                                       -DontStopIfGoingOnBatteries `
+                                       -StartWhenAvailable `
+                                       -RestartCount 3 `
+                                       -RestartInterval (New-TimeSpan -Minutes 1) `
+                                       -ExecutionTimeLimit ([TimeSpan]::Zero)
+
+# Register task under SYSTEM with highest privileges
+Register-ScheduledTask -TaskName "LOGAR_Server_Daemon" `
+                       -Action $Action `
+                       -Trigger $Trigger `
+                       -Settings $Settings `
+                       -User "NT AUTHORITY\SYSTEM" `
+                       -RunLevel Highest `
+                       -Description "LOGAR Central Hub Daemon"
+
+# Start the task immediately
+Start-ScheduledTask -TaskName "LOGAR_Server_Daemon"
+Get-ScheduledTask -TaskName "LOGAR_Server_Daemon"
+```
+
+---
+
+## 5. Hermes Reporting API & Health Checks
+
+Test the embedded Hermes REST endpoint locally using PowerShell:
+
+```powershell
+$report = Invoke-RestMethod -Uri "http://127.0.0.1:8443/api/hermes/report" -Method GET
+$report | Format-Table fingerprint, status, consecutive_runs, first_seen, last_seen
+```
+
+### Response Format:
+```json
+[
+  {
+    "fingerprint": "win-dc-01.corp.internal:DiskCorruptionDetected",
+    "server": "win-dc-01.corp.internal",
+    "signature": "DiskCorruptionDetected",
+    "consecutive_runs": 4,
+    "first_seen": "2026-09-04T08:15:00Z",
+    "last_seen": "2026-09-04T15:00:00Z",
+    "status": "VERIFIED",
+    "verified": true,
+    "os_type": "windows",
+    "sample_message": "An error was detected on device \\Device\\Harddisk0\\DR0 during a paging operation."
+  }
+]
+```
+
+---
+
+## 6. Windows Defender Firewall Configuration
+
+Open the necessary inbound firewall ports to allow incoming edge forwarder socket streams and HTTP API queries:
+
+```powershell
+# Allow TCP 9443 for edge log forwarding
+New-NetFirewallRule -DisplayName "LOGAR TCP Log Ingestion" `
+                    -Direction Inbound `
+                    -LocalPort 9443 `
+                    -Protocol TCP `
+                    -Action Allow
+
+# Allow TCP 8443 for Hermes Reporting REST API
+New-NetFirewallRule -DisplayName "LOGAR Hermes Reporting API" `
+                    -Direction Inbound `
+                    -LocalPort 8443 `
+                    -Protocol TCP `
+                    -Action Allow
+```
+
+---
+
+## 7. Uninstallation & Removal
+
+To remove the server service:
+```powershell
+# If installed via NSSM:
+nssm.exe stop LOGAR_Server
+nssm.exe remove LOGAR_Server confirm
+
+# If installed via Task Scheduler:
+Unregister-ScheduledTask -TaskName "LOGAR_Server_Daemon" -Confirm:$false
+
+# Clean files
+Remove-Item -Recurse -Force "C:\LOGAR-Server"
+```

out/win_server/server_config.sample.json

@@ -0,0 +1,14 @@
+{
+  "server_name": "LOGAR-Windows-Hub",
+  "tcp_host": "0.0.0.0",
+  "tcp_port": 9443,
+  "hermes_host": "0.0.0.0",
+  "hermes_port": 8443,
+  "auth_token": "replace_with_secure_random_hex_token",
+  "db_path": "logar_state.db",
+  "evaluation_window_hours": 12,
+  "min_persistence_runs": 4,
+  "server_fingerprint": "AUTO_GENERATED_ON_FIRST_RUN",
+  "public_key": "AUTO_GENERATED_ON_FIRST_RUN",
+  "private_key": "AUTO_GENERATED_ON_FIRST_RUN"
+}

tests/test_linux_client.py

@@ -8,6 +8,7 @@ import warnings
 warnings.filterwarnings("ignore")
 
 sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..")))
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "src")))
 
 import Linux_Client
 import pgpy

tests/test_pipeline.py

@@ -9,6 +9,12 @@ import urllib.request
 import warnings
 from datetime import datetime, timezone, timedelta
 
+# Ensure repository root and src/ directory are in sys.path
+ROOT_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+SRC_DIR = os.path.join(ROOT_DIR, "src")
+sys.path.insert(0, ROOT_DIR)
+sys.path.insert(0, SRC_DIR)
+
 warnings.filterwarnings("ignore")
 import pgpy
 
@@ -20,13 +26,16 @@ HERMES_PORT = 8443
 
 def run_tests():
     print("=== [1] Verifying server_config.json & client_config.json ===")
-    assert os.path.exists("server_config.json"), "server_config.json must exist"
-    assert os.path.exists("client_config.json"), "client_config.json must exist"
+    server_cfg_path = "server_config.json" if os.path.exists("server_config.json") else os.path.join(ROOT_DIR, "server_config.json")
+    client_cfg_path = "client_config.json" if os.path.exists("client_config.json") else os.path.join(ROOT_DIR, "client_config.json")
+
+    assert os.path.exists(server_cfg_path), f"{server_cfg_path} must exist"
+    assert os.path.exists(client_cfg_path), f"{client_cfg_path} must exist"
     
-    with open("client_config.json", "r", encoding="utf-8") as f:
+    with open(client_cfg_path, "r", encoding="utf-8") as f:
         client_conf = json.load(f)
     
-    with open("server_config.json", "r", encoding="utf-8") as f:
+    with open(server_cfg_path, "r", encoding="utf-8") as f:
         server_conf = json.load(f)
 
     assert "server_name" not in client_conf, "client_config.json must NOT contain server_name"

tests/test_server.py

@@ -11,8 +11,9 @@ from datetime import datetime, timezone, timedelta
 
 warnings.filterwarnings("ignore")
 
-# Ensure parent directory is in path to import Server
+# Ensure parent directory and src directory are in path to import Server
 sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..")))
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "src")))
 
 import Server
 import pgpy

tests/test_win_client.py

@@ -8,6 +8,7 @@ import warnings
 warnings.filterwarnings("ignore")
 
 sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..")))
+sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "src")))
 
 import Win_Client
 import pgpy