coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(AUDIT-WP-0008): admit governed E2 probe ingress
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62
This commit is contained in:
tegwick 2026-08-22 09:37:30 +02:00
parent 34f0077a9b
commit 5b5196eea7
4 changed files with 80 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/operator-runbook.md
View file

@ -118,6 +118,21 @@ custody defect: stop and investigate.
## Sender credential rotation
### Governed E2 evidence identities
The `whitehat` test plane has a dedicated ingress policy. It admits only pods
in namespace `whitehat` carrying both `whitehat.security/plane: "true"` and
`whitehat.security/target: audit-core`; bearer authentication and sender scope
still apply to every request. The policy is connectivity, not authorization.
A dated `live-e2` engagement may request exactly two temporary identities. Each
identity is bound to `source=whitehat-security`, one named synthetic tenant,
`may_write=true`, and `may_read=true`. Provision token values only through the
sanctioned sender-registry custody lane and the plane's mount-only credential
projection. Never reuse the production `user-engine` identity. Revoke both
identities and remove their registry entries when the plane lease ends; an
engagement is incomplete until that cleanup is evidenced.
OpenBao path `platform/workloads/audit-core/senders` is the authority for
ExternalSecret `audit-core-senders`. The initial in-cluster registry was
wrap-migrated on 2026-08-14 without printing or staging its values; do not