# WH-ENG-20260822-AUDIT-E2-02 admission abort

Date: 2026-08-22  
Workplan task: `AUDIT-WP-0008-T05`  
Outcome: aborted before probe execution; zero target packets

## Scope

The attended window was 19:15Z–19:30Z. Custody projection was permitted only
from 19:15Z through 19:18Z. The approved target image was
`sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6`.
The run used engagement-specific `-02` identities, tenants, fixture IDs, KV
paths, and projection resources. No credential value was printed or retained
in this evidence.

## Timeline and value-safe observations

- Before the window, repeated preflight observed audit-core `1/1` Ready on the
  approved image, OpenBao initialized and unsealed, and no temporary identity,
  exact KV path, projection resource, mounted Secret, or runner pod.
- At 19:15:32Z, preflight reported `projection-window-open` with the same clean
  baseline.
- The first projection attempt stopped at its projected-key-name verification.
  SSH had allowed the remote shell to expand the Go-template `$k` variables.
  The procedure's automatic exact cleanup completed. At 19:16:49Z, independent
  preflight again found no temporary identity, KV path, projection resource, or
  runner; audit-core was `1/1` Ready.
- The value-safe key-name check was shell-quoted and projection was retried
  inside the gate. Projection succeeded at 19:17:54Z with exactly two temporary
  identities, mounted keys `token-a` and `token-b`, expiry 19:30Z, and
  audit-core Ready. The ExternalSecret reached Ready and the named mounted
  Secret and ClusterSecretStore existed.
- The approved pod contract was applied at 19:19Z and
  `whitehat/whitehat-e2-audit` became Ready.
- Whitehat target validation passed, the engagement was authorized, and the
  kill switch was clear. `admit-plane` then failed closed with
  `live custody broker is not connected; no credential was requested`.
  The custody procedure had produced a valid value-safe projection receipt,
  but Whitehat has no adapter that consumes that receipt and issues a plane
  lease. The runner was not invoked and sent zero packets.
- The runner pod was deleted at 19:21:07Z. Custody cleanup completed at
  19:21:39Z: two temporary identities removed, both exact engagement KV paths
  deleted, mounted Secret absent, audit-core Ready, and no secret value
  observed.
- The independent post-cleanup preflight found empty temporary-identity,
  exact-path, and projection-resource lists, `projection-cutoff-passed`,
  OpenBao unsealed, and audit-core `1/1` Ready. The runner pod was absent.

## Result and follow-up

This is not E2 evidence and does not complete T05. The run proves the attended
custody projection, expiry, runner creation, abort, and exact cleanup path. It
also proves that manually coordinating those roles is insufficient: the live
test-plane admission control cannot authenticate the custody projection.

Before another engagement is scheduled, implement and test a value-safe
custody receipt contract and Whitehat broker adapter. The adapter must bind the
receipt to the exact engagement, two projected handles, target revision,
projection and expiry times, mounted Secret identity, and current cleanup
authority without returning bearer values. A single driver must then sequence
projection-ready, plane admission, runner invocation, report delivery, runner
deletion, and custody cleanup while preserving the independent role approvals.

The SSH argument-quoting defect is fixed and pushed in `railiance-platform`
commit `d239ed3`; its regression test and all 115 platform tests pass.