evidence(AUDIT-WP-0008): establish E2 target pass
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
parent
375f970061
commit
f9d83a95a4
5 changed files with 297 additions and 23 deletions
182
docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-final-report.json
Normal file
182
docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-final-report.json
Normal file
|
|
@ -0,0 +1,182 @@
|
|||
{
|
||||
"assurance_statement": "Pass means only that the attacks attempted in this run did not work; it is not proof that the tenant boundary always holds.",
|
||||
"attacker_model": "E2-authenticated-tenant-a",
|
||||
"attempted_operations": 10,
|
||||
"authorization_id": "operator-session-2026-08-22-e2-03-approval",
|
||||
"cleanup": "WP-0025 receipt-bound cleanup completed at 2026-08-22T22:13:48Z for projection sha256:c22ef5651efde1416f33936e193a3438c09a1284925b36f51fa6328519c7d02e",
|
||||
"credential_revocation": "revoked by railiance-platform custody cleanup for lease custody:32c03d05b32fa6850d65eeba7bd7e2a0",
|
||||
"ended_at": "2026-08-22T22:10:25.073895Z",
|
||||
"engagement_id": "WH-ENG-20260822-AUDIT-E2-03",
|
||||
"evidence_class": "target",
|
||||
"limitations": [],
|
||||
"outcome": "pass",
|
||||
"posture_claim": "implemented E2; currently evidenced E1",
|
||||
"probes": [
|
||||
{
|
||||
"observations": {
|
||||
"absent": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 0,
|
||||
"run_digest": "6f1b8575bc0a114ac8eee4ce04e67bf2c0a727ddd706069453bc69e208960041",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.error:str"
|
||||
],
|
||||
"status": 404
|
||||
},
|
||||
"attacker": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 0,
|
||||
"run_digest": "6f1b8575bc0a114ac8eee4ce04e67bf2c0a727ddd706069453bc69e208960041",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.error:str"
|
||||
],
|
||||
"status": 404
|
||||
},
|
||||
"owner": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 2,
|
||||
"run_digest": "bbed8ca6ed1e1343885ddc0945869af4f430127da9d3523f6b26ed1688f493e6",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.accepted_at:str",
|
||||
"$.action:str",
|
||||
"$.actor:NoneType",
|
||||
"$.details",
|
||||
"$.details.correlation_id:str",
|
||||
"$.details.data",
|
||||
"$.details.data.fixture_id:str",
|
||||
"$.event_id:str",
|
||||
"$.observed_at:str",
|
||||
"$.outcome:str",
|
||||
"$.reason:NoneType",
|
||||
"$.resource:str",
|
||||
"$.schema_version:str",
|
||||
"$.scope:str",
|
||||
"$.source:str",
|
||||
"$.tenant:str"
|
||||
],
|
||||
"status": 200
|
||||
}
|
||||
},
|
||||
"operation": "read",
|
||||
"outcome": "pass",
|
||||
"probe_id": "audit-event-by-id",
|
||||
"reasons": []
|
||||
},
|
||||
{
|
||||
"observations": {
|
||||
"attacker": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 0,
|
||||
"run_digest": "f023e92394bf5d3a1d8127f78eaa038afcf409159ad82637af0aeaa3bde6c276",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.events[]",
|
||||
"$.events[]",
|
||||
"$.events[].accepted_at:str",
|
||||
"$.events[].action:str",
|
||||
"$.events[].actor:NoneType",
|
||||
"$.events[].details",
|
||||
"$.events[].details.correlation_id:str",
|
||||
"$.events[].details.data",
|
||||
"$.events[].details.data.fixture_id:str",
|
||||
"$.events[].event_id:str",
|
||||
"$.events[].observed_at:str",
|
||||
"$.events[].outcome:str",
|
||||
"$.events[].reason:NoneType",
|
||||
"$.events[].resource:str",
|
||||
"$.events[].schema_version:str",
|
||||
"$.events[].scope:str",
|
||||
"$.events[].source:str",
|
||||
"$.events[].tenant:str"
|
||||
],
|
||||
"status": 200
|
||||
},
|
||||
"owner": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 2,
|
||||
"run_digest": "3411e7a6de77dc184926bf94ca492f7fccc3c3dfa3d1041763c35bbaa666e7eb",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.events[]",
|
||||
"$.events[]",
|
||||
"$.events[].accepted_at:str",
|
||||
"$.events[].action:str",
|
||||
"$.events[].actor:NoneType",
|
||||
"$.events[].details",
|
||||
"$.events[].details.correlation_id:str",
|
||||
"$.events[].details.data",
|
||||
"$.events[].details.data.fixture_id:str",
|
||||
"$.events[].event_id:str",
|
||||
"$.events[].observed_at:str",
|
||||
"$.events[].outcome:str",
|
||||
"$.events[].reason:NoneType",
|
||||
"$.events[].resource:str",
|
||||
"$.events[].schema_version:str",
|
||||
"$.events[].scope:str",
|
||||
"$.events[].source:str",
|
||||
"$.events[].tenant:str"
|
||||
],
|
||||
"status": 200
|
||||
}
|
||||
},
|
||||
"operation": "read",
|
||||
"outcome": "pass",
|
||||
"probe_id": "audit-correlation-slice",
|
||||
"reasons": []
|
||||
},
|
||||
{
|
||||
"observations": {
|
||||
"absent": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 0,
|
||||
"run_digest": "6f1b8575bc0a114ac8eee4ce04e67bf2c0a727ddd706069453bc69e208960041",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.error:str"
|
||||
],
|
||||
"status": 404
|
||||
},
|
||||
"attacker": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 0,
|
||||
"run_digest": "01f07af3e3c784c765f1190d0d6607e15cfb972ff2562a3a7566237b3ef1f88e",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.error:str"
|
||||
],
|
||||
"status": 400
|
||||
},
|
||||
"state_after": {
|
||||
"content_type": "application/json",
|
||||
"count": 1,
|
||||
"fixture_match_count": 0,
|
||||
"run_digest": "6f1b8575bc0a114ac8eee4ce04e67bf2c0a727ddd706069453bc69e208960041",
|
||||
"schema": [
|
||||
"$",
|
||||
"$.error:str"
|
||||
],
|
||||
"status": 404
|
||||
}
|
||||
},
|
||||
"operation": "create",
|
||||
"outcome": "pass",
|
||||
"probe_id": "audit-append-as-b",
|
||||
"reasons": []
|
||||
}
|
||||
],
|
||||
"run_id": "WH-ENG-20260822-AUDIT-E2-03-2026-08-22T22:09:30.705690Z",
|
||||
"schema_version": "whitehat-run/v1",
|
||||
"started_at": "2026-08-22T22:09:30.705690Z",
|
||||
"target": "audit-core",
|
||||
"target_revision": "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6"
|
||||
}
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
# WH-ENG-20260822-AUDIT-E2-03 target pass
|
||||
|
||||
Date: 2026-08-22
|
||||
Workplan task: `AUDIT-WP-0008-T05`
|
||||
Evidence class: adversarial target run
|
||||
Outcome: pass, with no reported limitations
|
||||
|
||||
## Claim and limit
|
||||
|
||||
An ordinary identity bound to fixture tenant A attempted to read and create
|
||||
fixture data belonging to tenant B through audit-core's public application
|
||||
routes. All three calibrated probes passed. This is evidence that the attacks
|
||||
attempted in this bounded run did not work; it is not proof that audit-core's
|
||||
tenant boundary always holds.
|
||||
|
||||
The target revision was
|
||||
`sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6`.
|
||||
The run started at `2026-08-22T22:09:30.705690Z`, ended at
|
||||
`2026-08-22T22:10:25.073895Z`, and attempted ten operations with concurrency
|
||||
one. No non-fixture data was collected.
|
||||
|
||||
## Probe observations
|
||||
|
||||
- `audit-event-by-id`: the tenant-B owner received the declared fixture with
|
||||
status 200. The tenant-A attacker received the same status, schema and digest
|
||||
as the deliberately absent-object control: 404, with no fixture match.
|
||||
- `audit-correlation-slice`: the owner result contained both tenant-B fixture
|
||||
markers. The attacker result contained zero tenant-B fixture markers.
|
||||
- `audit-append-as-b`: the tenant-A attempt to append as tenant B was refused
|
||||
with status 400. A subsequent owner read returned the same 404 digest and
|
||||
schema as the absent-object control, demonstrating no created fixture.
|
||||
|
||||
The complete sanitized observations are in
|
||||
`AUDIT-WP-0008-T05-whitehat-e2-03-final-report.json`, SHA-256
|
||||
`2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593`.
|
||||
|
||||
## Custody and cleanup
|
||||
|
||||
Projection receipt
|
||||
`sha256:c22ef5651efde1416f33936e193a3438c09a1284925b36f51fa6328519c7d02e`
|
||||
bound the two projected handles to lease
|
||||
`custody:32c03d05b32fa6850d65eeba7bd7e2a0`, expiring at 22:15Z. The runner was
|
||||
deleted after the probe. Receipt-bound cleanup completed at 22:13:48Z, before
|
||||
expiry, and removed both temporary identities, both exact KV paths, the
|
||||
projection resources and mounted Secret. Independent post-cleanup status found
|
||||
all exact lists empty, the runner absent, and audit-core `1/1` Ready. No secret
|
||||
value was observed or retained.
|
||||
|
||||
Artifact hashes:
|
||||
|
||||
- projection receipt:
|
||||
`eeb8abd84abf5451915f7ab2c45c722fa58b279a4ec8e62187d20d5af135cde4`
|
||||
- cleanup receipt:
|
||||
`74d53852f8a0eaead73d468e9e0e12d617807fa3f00028a7473bc3b765738889`
|
||||
- broker receipt:
|
||||
`85cf0e507d3b84188c1ea39fd9e6f948c2983a08a5aa94b578e952ac832d0433`
|
||||
|
||||
The sanitized final report reached `risk-nexus` as State Hub message
|
||||
`40e3f825-fc70-4091-96d2-9ab01d42184a` with subject
|
||||
`WHITEHAT TARGET PASS: WH-ENG-20260822-AUDIT-E2-03`.
|
||||
|
||||
## Freshness
|
||||
|
||||
The facility baseline is a 24-hour cadence plus run and reporting latency, with
|
||||
event-triggered pre-promotion runs after relevant boundary changes. This
|
||||
artifact is therefore due for review or replacement at
|
||||
`2026-08-23T22:10:25Z`. Repeating that cadence reliably requires an automated
|
||||
multi-driver orchestrator; the attended run proves the sequence but is not a
|
||||
sustainable scheduler.
|
||||
Loading…
Add table
Add a link
Reference in a new issue