coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record approval for third Whitehat E2 attempt
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
tegwick 2026-08-22 23:32:29 +02:00
parent 69c55889c6
commit ea2e7499eb
1 changed files with 17 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/AUDIT-WP-0008-tenancy-posture-alignment.md
View file

@ -482,18 +482,28 @@ engagement must wait for the receipt-to-broker adapter and an actual
multi-driver sequence. Evidence: multi-driver sequence. Evidence:
`docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-02-abort-2026-08-22.md`. `docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-02-abort-2026-08-22.md`.
Third-attempt preparation is now proposed, not yet authorized. Whitehat commit Third-attempt preparation was proposed at Whitehat `96d6781` and platform
`96d6781` adds terminal-unique engagement `WH-ENG-20260822-AUDIT-E2-03`, unique `2a5c002`. Whitehat adds terminal-unique engagement
`WH-ENG-20260822-AUDIT-E2-03`, unique
`-03` identities, tenants, fixtures, runner pod and mounted Secret, plus an `-03` identities, tenants, fixtures, runner pod and mounted Secret, plus an
explicit authorization-id argument and cleanup-bound report finalization. explicit authorization-id argument and cleanup-bound report finalization.
Platform commit `2a5c002` adds the matching canonical WP-0025 contract and a Platform adds the matching canonical WP-0025 contract and a
mode-`0600` raw broker-receipt export. The proposed window is 22:00–22:15Z, mode-`0600` raw broker-receipt export. The proposed window is 22:00–22:15Z,
with projection closing at 22:03Z. Platform's 141 tests and Whitehat's 81 tests with projection closing at 22:03Z. Platform's 141 tests and Whitehat's 81 tests
pass; the runner manifest passes Kubernetes server-side dry-run; both contract pass; the runner manifest passes Kubernetes server-side dry-run; both contract
validators derive the same approved-form digest `55595341…7d12` and resource validators agree.
names. The proposed engagement still fails closed pending explicit operator
approval, subsequent audit-core acknowledgement, and Whitehat's direct broker The operator explicitly approved the exact package at 21:29:21Z and audit-core
receipt. No live `-03` resource exists. acknowledged it after approval at 21:29:22Z. Approved revisions are Whitehat
`5fcb3ec` and platform `d7dae01`; the final contract digest is
`fe6f1ebf…ede01`. Whitehat's direct broker receipt
`90e9dbbe-0c17-427d-8208-c64e24cf3bbb` pins adapter revision `5fcb3ec`, its
artifact digest, passing focused tests, all four schema digests, exact roles and
mount paths, and cleanup support. Live preflight reports the broker gate passed,
OpenBao unsealed, audit-core `1/1` on the approved image, and no temporary
identity, exact KV path, projection resource, runner, or secret value. The
engagement is approved but projection remains fail-closed before 22:00Z and
after 22:03Z.
```task ```task
id: AUDIT-WP-0008-T06 id: AUDIT-WP-0008-T06