docs(docs): update CLAUDE.md with session learnings \n\n Version: release/0.2.120 \n\n expand repo map with 30 dirs and gitignore notes; add README convention as coding standard rule 11; add blueprint template_folder pattern to extending section; add new directory row to extension table; add 15f DEPLOY.sh section; update 16 read-these-next \n\n LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n LazyOwn/ https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: vie 15 may 2026 19:22:28 -04 \n\n Hora: 1778887348

Author: grisuno

CHANGELOG.md

@@ -2,6 +2,13 @@
 # Changelog
 
 
+### Documentación
+
+### Otros
+
+  *   * docs(docs): update CLAUDE.md with session learnings \n\n Version: release/0.2.120 \n\n expand repo map with 30 dirs and gitignore notes; add README convention as coding standard rule 11; add blueprint template_folder pattern to extending section; add new directory row to extension table; add 15f DEPLOY.sh section; update 16 read-these-next \n\n   LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n  LazyOwn/   https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: vie 15 may 2026 19:22:28 -04 \n\n Hora: 1778887348
+
+
 ### Documentación
 
 ### Otros

CLAUDE.md

@@ -86,19 +86,65 @@ change that affects `skills/lazyown_mcp.py` or modules imported at startup.
 | `lazyc2.py` | Flask + Socket.IO C2 server, 84 routes, decoy site, phishing blueprint, dashboard, terminal, listener, /pty xterm. |
 | `utils.py` | Shared helpers (`Config`, `load_payload`, `getprompt`, `print_msg`, `run_command`, `xor_encrypt_decrypt`, `generate_certificates`, ANSI constants, etc.). |
 | `payload.json` | The **only** runtime configuration file. Keys are read by every component. Persists across runs. |
-| `templates/` | 54 Jinja2 templates: `index.html`, `terminal.html`, `surface.html`, `connect.html`, `decoy.html`, `phishing/`, `landing_pages/`, `emails/`, etc. |
-| `static/` | CSS/JS assets, dashboard, body_report.json (PDF report fields), icons. |
-| `modules/` | Python modules invoked via `run <name>` or imported by lazyc2 (LLM clients, dashboards, parsers, exploits). |
-| `skills/` | MCP server + autonomous AI stack (mcp, hive_mind, swan, daemon, policy, parquet_db). |
-| `sessions/` | Authoritative campaign state — never delete without confirmation. |
-| `parquets/` | Knowledge bases: GTFOBins, LOLBas, MITRE ATT&CK, Atomic Red Team, session_knowledge. |
-| `plugins/` | Lua plugins (lupa runtime). |
-| `lazyaddons/` | Declarative YAML tool integrations. |
-| `tools/` | pwntomate `.tool` files auto-applied to nmap-discovered services. |
-| `external/` | Vendored upstreams (atomic-red-team, etc.). |
-| `lazyscripts/` | `.ls` scripts — small recipes loaded with `run_script`. |
+| `templates/` | 55+ Jinja2 templates. Root templates extend `base.html`. Subdirs: `phishing/`, `landing_pages/`, `emails/`. |
+| `static/` | CSS/JS assets (`xterm.js`, `particles.js`), icons for network graph, `body_report.json` (PDF report fields). |
+| `modules/` | 50+ Python modules: LLM clients, `collab_bp`, `dashboard_bp`, world model, obs parser, playbook engine, etc. |
+| `modules/integrations/` | Third-party bridges: MISP export, Nuclei scanner, Searchsploit wrapper. |
+| `modules/backdoor/` | C reverse-shell backdoor source + Makefile. |
+| `modules/rootkit/` | Linux kernel module rootkit research code. |
+| `modules/win_rootkit/` | Windows ring-3 rootkit (C/C++/C#) for cross-compiled testing. |
+| `skills/` | MCP server (95 tools) + autonomous AI stack: daemon, hive_mind, swan, policy, parquet_db. |
+| `sessions/` | Authoritative campaign state — **gitignored**, never delete without confirmation. `git add -f` required for any file here. |
+| `parquets/` | Columnar knowledge bases: GTFOBins, LOLBas, MITRE ATT&CK techniques (6 `.parquet` files). |
+| `plugins/` | Lua plugins (lupa/LuaJIT runtime). Each `.lua` + companion `.yaml` metadata. |
+| `lazyaddons/` | 76 declarative YAML tool integrations. Auto-discovered at startup. |
+| `tools/` | 69 pwntomate `.tool` files auto-triggered on nmap-discovered services. |
+| `external/` | Vendored upstreams (atomic-red-team, etc.). Excluded from git. |
+| `lazyscripts/` | 11 `.ls` recipe scripts loaded with `run_script`. |
+| `playbooks/` | YAML APT simulation playbooks (7 threat actors) consumed by `apt_playbook`. |
+| `lazyadversaries/` | YAML threat actor profiles used by the autonomous daemon's adversary selector. |
+| `cli/` | Shell-layer extensions: wizard, graph advisor, reactive hints, dashboard TUI, fuzzy picker, palette, aliases. Zero imports from `lazyown.py`. |
+| `cli/commands/` | cmd2 `CommandSet` subpackage. Auto-discovered by `cli/registry.py`. |
+| `core/` | Canonical `Config` class, crypto primitives, validators, `typing.Protocol` interfaces. No framework imports. |
+| `scripts/` | Build/maintenance scripts: `build_command_index.py`, `patch_playbook_atomic_ids.py`, `update_apt_atomic_ids.py`. |
+| `tests/` | 23 test files, ~450 tests total. No mocking of C2 or daemon. |
+| `lazyown-docker/` | Dockerfile, docker-compose, sandbox mode support. |
+| `lazygui/` | Desktop GUI application (separate from the Textual TUI in `cli/`). |
+| `modules_ext/` | External subprojects: `lazyown_infinitestorage/`, `rustrevmaker/`. **Gitignored** — `git add -f` required. |
+| `docs/` | Static site for GitHub Pages. Auto-generated by `DEPLOY.sh` from Markdown sources — do not edit HTML directly. |
+| `lazyc2/` | Security validators (`validate_route_path`, `validate_template_name`, `is_safe_template_path`) imported by `lazyc2.py`. |
+| `vpn/` | VPN config files (`.ovpn`, `.conf`). **Gitignored** — `git add -f` required. Never commit VPN credentials. |
+| `banners/` | Banner image assets for the CLI banner display. |
+| `source/` | Source artwork and design assets. |
 | `QUICKSTART.md` | Canonical 5-minute onboarding guide (clone → wizard → recon → C2 → beacon → collab). **Do not auto-generate**; update manually when the operator flow changes. |
 
+### Directory README convention
+
+**Every directory in this repository has a `README.md`.** When adding a new
+directory, create its README immediately. A directory without a README will be
+flagged in code review.
+
+README content rules (same as §10 for code):
+- English only, no emojis, human language.
+- File/subdirectory table explaining the role of each item.
+- "How it works" section for non-obvious mechanics.
+- "Adding X" section for any directory that is an extension point.
+- No generated content — write prose that a human would find useful six months
+  from now without any context from this conversation.
+
+### Gitignored directories
+
+These directories are in `.gitignore` and require `git add -f <path>` to stage
+any file inside them:
+
+- `sessions/` — engagement state (credentials, scan output, beacons)
+- `vpn/` — VPN configuration files
+- `modules_ext/` — external module subprojects
+- `external/` — vendored upstreams
+
+Use `git add -f` consciously. Never use it for credential files, TLS keys,
+or `payload.json`.
+
 ---
 
 ## 3. The `payload.json` contract — single source of configuration
@@ -464,6 +510,8 @@ These rules are enforced by review. Code that violates them is rejected.
    payload.json ↔ MCP ↔ sessions/ artefact) or it isn't merged.
 10. **No backwards-compatibility shims** for code that hasn't shipped to
     operators yet. Just change it.
+11. **Every new directory gets a README.** See §2 "Directory README convention"
+    for content rules. No exceptions.
 
 ---
 
@@ -534,14 +582,28 @@ between sessions. Use `lazyown_soul(action="write", content=...)` to update it.
 | Auto-run on a discovered service | `tools/<name>.tool` (pwntomate) |
 | New CLI command | `do_<name>` in `lazyown.py` |
 | New web UI page or beacon endpoint | `lazyc2.py` route + Jinja2 template |
+| New Flask blueprint | `modules/<name>_bp.py` — register in `lazyc2.py`; pass config via `app.config["LAZYOWN_CONFIG"]` |
 | New MCP tool | `skills/lazyown_mcp.py` |
 | New autonomous selector | subclass `BaseSelector` in `skills/autonomous_daemon.py` |
 | New AI agent persona | `skills/lazyown_groq_agents.py` registry |
 | New knowledge base | new parquet under `parquets/` + `lazyown_parquet_query` mode |
+| New directory | create the directory + `README.md` immediately (§10 rule 11) |
 
 Adding `do_*` for something that already works as a YAML addon is a smell —
 the YAML system exists precisely so you don't have to touch Python.
 
+### Blueprint `template_folder` pattern
+
+Blueprints that live in `modules/` and need Jinja2 templates must set:
+
+```python
+bp = Blueprint("name", __name__, template_folder="../templates")
+```
+
+This makes `render_template("foo.html")` resolve against the root `templates/`
+directory rather than looking for a non-existent `modules/templates/`. Do not
+duplicate templates into `modules/templates/` — there is one template store.
+
 ---
 
 ## 14. Things this framework deliberately does NOT do
@@ -842,6 +904,7 @@ CLI command structure.
 
 ## 15e. Onboarding — `QUICKSTART.md` + `wizard`
 
+
 ### `QUICKSTART.md`
 
 Canonical operator onboarding document. **Manually maintained** — update it
@@ -868,16 +931,55 @@ The shell calls `wizard` automatically on first launch when `rhost` is unset.
 
 ---
 
+## 15f. Release pipeline — `DEPLOY.sh`
+
+The deploy script is `DEPLOY.sh` at the repo root (not `./DEPLOY`). It:
+1. Rebuilds `README.md` from `UTILS.md`, `COMMANDS.md`, and `CHANGELOG.md`.
+2. Regenerates `docs/index.html`.
+3. Prompts for commit type, typedesc, subject, and body.
+4. Increments the version in `version.json`.
+5. Creates a signed git commit and tag (`release/0.x.y`).
+6. Pushes to `origin/main` and creates a GitHub release.
+
+### Running non-interactively
+
+```bash
+printf "1\nfeat\nsubject line\nbody text\n" | bash DEPLOY.sh --no-test
+```
+
+The four inputs are: commit type number (1–9), typedesc (e.g. `feat`),
+subject (one-line summary), body (detail paragraph).
+
+Commit type → version bump:
+
+| Type | Bump |
+|------|------|
+| feat, feature, fix, hotfix | patch (0.x.Y) |
+| refactor, docs, test, style | none (version unchanged) |
+| release | major (X.0.0) |
+| patch | minor (0.X.0) |
+
+`--no-test` skips the test suite. Use only when tests were already run
+separately and you are confident they pass.
+
+### What DEPLOY.sh does NOT do
+
+- It does not run `python -m pytest`. Run tests manually before deploying.
+- It does not validate `CLAUDE.md` content. Keep this file accurate by hand.
+- The `CHANGELOG.md` is truncated to 120 000 chars for the GitHub release
+  body. Full history is always in the file itself.
+
+---
+
 ## 16. Read these next
 
 - `QUICKSTART.md` — **start here for a new operator session** — 5-minute clone-to-shell guide.
-- `README.md` — public-facing feature list (long, marketing-flavoured).
-- `COMMANDS.md` — exhaustive list of every CLI command.
+- `README.md` — public-facing feature list (long, marketing-flavoured). Auto-regenerated by `DEPLOY.sh`.
+- `COMMANDS.md` — exhaustive list of every CLI command. Auto-generated.
 - `UTILS.md` — auto-generated reference for `utils.py`.
-- `CHANGELOG.md` — release history, useful for context on any flag you don't
-  recognise.
-- `skills/lazyown.md` — full MCP playbook (mandatory reading before any MCP
-  session).
-- `skills/README.md` — skills layer architecture.
+- `CHANGELOG.md` — release history, useful for context on any flag you don't recognise.
+- `skills/lazyown.md` — full MCP playbook (mandatory reading before any MCP session).
+- `skills/README.md` — skills layer architecture and all 95 MCP tools.
+- `<dir>/README.md` — every directory has one; read it before editing files in that directory.
 
-When in doubt: read `payload.json`, read `sessions/`, then write code.
+When in doubt: read `payload.json`, read `sessions/`, read the directory's `README.md`, then write code.

README.md

@@ -12971,6 +12971,13 @@ No description available.
 # Changelog
 
 
+### Documentación
+
+### Otros
+
+  *   * docs(docs): add README to every project directory \n\n Version: release/0.2.119 \n\n create 21 new READMEs and update 3 existing ones; covers cli, core, modules, templates, sessions, tools, parquets, tests, static, lazyscripts, playbooks, lazyadversaries, scripts, lazyown-docker, lazygui, vpn, docs, lazyc2, modules_ext, modules/backdoor, modules/integrations, modules/rootkit, modules/win_rootkit, cli/commands; remove emojis from lazyaddons and plugins READMEs; update skills README with 95 tool count and collab note \n\n   LazyOwn on HackTheBox: https://app.hackthebox.com/teams/overview/6429 \n\n  LazyOwn/   https://grisuno.github.io/LazyOwn/ \n\n \n\n Fecha: vie 15 may 2026 19:02:47 -04 \n\n Hora: 1778886167
+
+
 ### Documentación
 
 ### Otros