docs: clarify native Rust implementation, reference sentinel-agent-modsec

- Add note that this agent uses native Rust regex, not libmodsecurity
- Reference sentinel-agent-modsec for full OWASP CRS compatibility
- Update comparison table to show both agent options
- Add "When to use" guidance for choosing between agents

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: raffaelschneider

README.md

@@ -1,6 +1,8 @@
 # sentinel-agent-waf
 
-Web Application Firewall agent for [Sentinel](https://github.com/raskell-io/sentinel) reverse proxy. Detects and blocks common web attacks.
+A lightweight Web Application Firewall agent for [Sentinel](https://github.com/raskell-io/sentinel) reverse proxy. Detects and blocks common web attacks using **native Rust regex patterns** - no external dependencies on libmodsecurity or other C libraries.
+
+> **Note:** This agent implements a curated subset of detection rules inspired by OWASP CRS rule IDs, but does **not** use libmodsecurity or the full CRS ruleset. For full OWASP CRS compatibility, see [sentinel-agent-modsec](https://github.com/raskell-io/sentinel-agent-modsec) which wraps libmodsecurity.
 
 ## Features
 
@@ -65,6 +67,8 @@ sentinel-waf-agent --socket /var/run/sentinel/waf.sock --paranoia-level 1
 
 ## Detection Rules
 
+Detection rules are implemented as native Rust regex patterns. Rule IDs follow OWASP CRS numbering conventions for familiarity, but the patterns are hand-written and optimized for performance - they are **not** imported from ModSecurity/CRS.
+
 ### SQL Injection (942xxx)
 - UNION-based injection
 - Tautology attacks (`OR 1=1`)
@@ -153,21 +157,32 @@ sentinel-waf-agent --exclude-paths "/health,/metrics,/static"
 
 ## Comparison with ModSecurity
 
-This agent provides a subset of ModSecurity's OWASP CRS functionality:
+This agent provides a lightweight alternative to ModSecurity with a subset of OWASP CRS-style detection:
 
-| Feature | This Agent | ModSecurity |
-|---------|------------|-------------|
+| Feature | sentinel-agent-waf | sentinel-agent-modsec |
+|---------|-------------------|----------------------|
 | SQL Injection | ✓ | ✓ |
 | XSS | ✓ | ✓ |
 | Path Traversal | ✓ | ✓ |
 | Command Injection | ✓ | ✓ |
-| Full CRS Ruleset | Partial | ✓ |
-| Body Inspection | ✓ | ✓ |
+| Full CRS Ruleset | ~20 rules | 800+ rules |
+| SecLang Support | - | ✓ |
 | Custom Rules | - | ✓ |
-| Dependencies | Pure Rust | libmodsecurity |
-| Installation | `cargo install` | Complex |
-
-For full OWASP CRS compatibility, consider using ModSecurity with Sentinel's external processing.
+| Body Inspection | ✓ | ✓ |
+| Dependencies | Pure Rust | libmodsecurity (C) |
+| Installation | `cargo install` | Requires libmodsecurity |
+| Binary Size | ~5MB | ~50MB |
+| Memory Usage | Low | Higher |
+
+**When to use this agent:**
+- You want simple, zero-dependency deployment
+- You need low latency and minimal resource usage
+- Basic attack detection is sufficient for your use case
+
+**When to use [sentinel-agent-modsec](https://github.com/raskell-io/sentinel-agent-modsec):**
+- You need full OWASP CRS compatibility
+- You have existing ModSecurity/SecLang rules to migrate
+- You require comprehensive protection with 800+ detection rules
 
 ## Development
 

ROADMAP.md

@@ -93,12 +93,16 @@ Add WebSocket frame inspection for detecting attacks in WebSocket traffic.
 
 ## Non-Goals
 
-These are explicitly out of scope:
+These are explicitly out of scope for this agent:
 
-- **Full OWASP CRS compatibility** - We implement a useful subset, not the full ruleset
-- **ModSecurity rule language** - We use native Rust regex, not SecLang
+- **Full OWASP CRS compatibility** - We implement a useful subset (~20 rules), not the full 800+ ruleset. For full CRS, see [sentinel-agent-modsec](https://github.com/raskell-io/sentinel-agent-modsec)
+- **ModSecurity rule language (SecLang)** - We use native Rust regex patterns, not SecLang. For SecLang support, see [sentinel-agent-modsec](https://github.com/raskell-io/sentinel-agent-modsec)
 - **Learning mode / ML-based detection** - Keep it simple and deterministic
 
+## Related Projects
+
+- **[sentinel-agent-modsec](https://github.com/raskell-io/sentinel-agent-modsec)** - Full OWASP CRS WAF agent using libmodsecurity bindings. Use this when you need comprehensive protection with 800+ rules or existing SecLang rules.
+
 ---
 
 ## Compatibility