coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

evidence(AUDIT-WP-0008): establish E2 target pass
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
tegwick 2026-08-23 00:26:32 +02:00
parent 375f970061
commit f9d83a95a4
5 changed files with 297 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/AUDIT-WP-0008-tenancy-posture-alignment.md
View file

@ -374,7 +374,7 @@ and the operator runbook. Raises E to 2 on both paths; update T01's declaration.
```task
id: AUDIT-WP-0008-T05
status: progress
status: done
priority: medium
state_hub_task_id: "30b56b30-e7eb-4873-aa7c-f4a3bf2fcb24"
```
@ -505,6 +505,28 @@ identity, exact KV path, projection resource, runner, or secret value. The
engagement is approved but projection remains fail-closed before 22:00Z and
after 22:03Z.
The `-03` engagement completed successfully. Receipt-bound projection opened at
22:01:35Z; Whitehat admitted the exact plane lease; and the bounded runner sent
ten operations from 22:09:30Z through 22:10:25Z. All three calibrated probes
passed: a tenant-A identity could not fetch tenant B's event by id, could not
observe tenant B's correlation slice, and could not append an event attributed
to tenant B. The report carries no limitations and explicitly limits the claim
to the attacks attempted in this run.
The runner was deleted and custody cleanup completed at 22:13:48Z, before the
22:15Z expiry. Independent status found both exact KV paths, both temporary
identities, all projection resources and the runner absent, with audit-core
still `1/1` Ready; no secret value was observed or retained. The finalized
sanitized report reached `risk-nexus` as message
`40e3f825-fc70-4091-96d2-9ab01d42184a`. Durable target evidence is recorded in
`docs/evidence/AUDIT-WP-0008-T05-whitehat-e2-03-pass-2026-08-22.md` and its
companion JSON report. Audit-core notified `net-kingdom` in
`b8a7ce2a-cf8e-44ef-ab25-37b0f93337db` that the canonical worked example can
advance from E1 to E2. The facility's 24-hour baseline makes the next review or
replacement due at 2026-08-23T22:10:25Z; sustaining it without minute-precise
operator attendance now belongs in a multi-driver integration/e2e harness, not
in another manual T05 sequence.
```task
id: AUDIT-WP-0008-T06
status: done