Publish GH-WP-0001-T06 conformance contracts
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
This commit is contained in:
parent
a4066aadb5
commit
8cb7250230
8 changed files with 716 additions and 1 deletions
132
docs/contracts/conformance-reporting.md
Normal file
132
docs/contracts/conformance-reporting.md
Normal file
|
|
@ -0,0 +1,132 @@
|
|||
# Conformance reporting contract
|
||||
|
||||
**Owner:** gate-house
|
||||
**Executor:** whitehat-security
|
||||
**Posture observer:** kings-guard
|
||||
**Finding triage:** risk-nexus
|
||||
**Status:** normative for GH-WP-0001-T06
|
||||
**Version:** conformance-reporting.v1
|
||||
**Date:** 2026-09-01
|
||||
|
||||
## 1. Purpose
|
||||
|
||||
This contract establishes how execution of a Gate House assurance
|
||||
specification returns to doctrine review. It preserves four distinct judgments:
|
||||
|
||||
```text
|
||||
Gate House specifies the invariant and executable target
|
||||
whitehat-security attacks and reports whether the observed control held
|
||||
risk-nexus owns finding severity, disclosure, and owner routing
|
||||
Gate House decides whether the result requires doctrine change
|
||||
```
|
||||
|
||||
Gate House does not grade its own specification by reinterpreting a whitehat
|
||||
result, assign severity, close an implementation defect, or block delivery.
|
||||
|
||||
## 2. Report envelope
|
||||
|
||||
Whitehat-security continues to use `whitehat-run/v1` as its native report. For
|
||||
Gate House conformance return, the report or a value-safe projection must also
|
||||
make these fields expressible:
|
||||
|
||||
```yaml
|
||||
schema_version: conformance-reporting.v1
|
||||
report_id: <stable id>
|
||||
specification:
|
||||
id: asm-assurance-targets.v1
|
||||
test_id: T-03
|
||||
target:
|
||||
component: <repo or protected system>
|
||||
revision: <immutable revision>
|
||||
environment: <fixture/build/production>
|
||||
claim:
|
||||
invariant_ids: [A-14, INV-05]
|
||||
engagement_id: <whitehat engagement>
|
||||
authorization_id: <recorded authorization>
|
||||
run_id: <whitehat run>
|
||||
outcome: pass | finding | inconclusive | aborted
|
||||
known_bad_calibration_ref: <evidence ref>
|
||||
evidence_refs: []
|
||||
emission_guarantee_refs: []
|
||||
limitations: []
|
||||
assurance_statement: <bounded statement>
|
||||
returned_at: <RFC 3339 UTC>
|
||||
```
|
||||
|
||||
The projection contains no credential value, secret, unrelated response body,
|
||||
severity, disclosure decision, or exploit detail unsafe for the recipient.
|
||||
|
||||
## 3. Outcome rules
|
||||
|
||||
- Every outcome returns, including `pass`, because target revision and run date
|
||||
define the freshness of limited assurance.
|
||||
- `inconclusive` and `aborted` do not count as conformance.
|
||||
- A known-bad calibration that has never failed makes the target
|
||||
`inconclusive`, even if the real target probe reports no effect.
|
||||
- A changed target revision invalidates any claim that the earlier result is
|
||||
current unless the executor records why the change is immaterial.
|
||||
- Absence of a report is `not_run`, not `pass`.
|
||||
- A passing report states only that the recorded attacks did not cross the
|
||||
boundary under the recorded conditions.
|
||||
|
||||
## 4. Return transport
|
||||
|
||||
The durable coordination envelope is a State Hub inbox message to
|
||||
`gate-house`:
|
||||
|
||||
```text
|
||||
Subject: [GH-CONFORMANCE] <test-id> <outcome> <target>@<revision>
|
||||
Body: report id, safe report/evidence references, specification version,
|
||||
run and authorization ids, limitations, and requested Gate House action
|
||||
```
|
||||
|
||||
Large or sensitive evidence remains under whitehat-security/risk-nexus custody;
|
||||
the message carries stable references and a value-safe summary. The emitting
|
||||
repository records the report in its own work structure before sending the
|
||||
message.
|
||||
|
||||
## 5. Finding routes
|
||||
|
||||
| Result | Required route |
|
||||
| --- | --- |
|
||||
| Implementation control failed | whitehat-security → risk-nexus → implementation owner; Gate House receives the safe conformance report. |
|
||||
| Doctrine is ambiguous, contradictory, unsafe, or impossible to test | whitehat-security or kings-guard → Gate House intake/message, citing test and evidence. |
|
||||
| Target or execution harness gap | whitehat-security owns or promotes the gap in its repository; Gate House records the test as pending. |
|
||||
| Posture, stream-silence, or live-observation gap | kings-guard owns or promotes the observation gap and returns the safe finding to Gate House. |
|
||||
| Severity/disclosure question | risk-nexus only. |
|
||||
|
||||
One observation may take both the implementation and doctrine routes. The two
|
||||
records cross-reference one another; Gate House does not absorb the owner's
|
||||
remediation task.
|
||||
|
||||
## 6. Gate House review record
|
||||
|
||||
For each returned report, Gate House records:
|
||||
|
||||
- report, target, revision, test, and invariant identifiers;
|
||||
- whitehat outcome without changing it;
|
||||
- doctrine disposition: `no_change`, `clarify`, `revise`, `new_target`, or
|
||||
`withdraw_claim`;
|
||||
- any Gate House intake, decision, contract revision, or workplan produced;
|
||||
- implementation/risk-nexus reference where a control failed;
|
||||
- next review trigger: target revision, cadence date, or finding closure.
|
||||
|
||||
A conformance review is complete when the result has an explicit doctrine
|
||||
disposition and every residual has a live owner. Closing a Gate House review
|
||||
does not close the underlying security finding.
|
||||
|
||||
## 7. Cadence and aggregation
|
||||
|
||||
Cadence belongs to whitehat-security because the run interval is part of the
|
||||
attacker model and exposure window. Gate House may request a minimum review
|
||||
condition, but it must not label stale evidence current.
|
||||
|
||||
Gate House may publish an aggregate conformance view only if it preserves:
|
||||
|
||||
- target and revision specificity;
|
||||
- last executed and next due times;
|
||||
- outcome and limitations;
|
||||
- tests that are pending, inapplicable, inconclusive, or not run;
|
||||
- the audit completeness bound.
|
||||
|
||||
An aggregate must not turn missing reports into green cells.
|
||||
121
docs/contracts/posture-findings-return.md
Normal file
121
docs/contracts/posture-findings-return.md
Normal file
|
|
@ -0,0 +1,121 @@
|
|||
# Posture and findings return-path contract
|
||||
|
||||
**Doctrine owner:** gate-house
|
||||
**Posture publisher:** kings-guard
|
||||
**Decision point:** access-engine
|
||||
**Assurance executor:** whitehat-security
|
||||
**Finding triage:** risk-nexus
|
||||
**Status:** normative for GH-WP-0001-T06
|
||||
**Version:** posture-findings-return.v1
|
||||
**Date:** 2026-09-01
|
||||
**Agreement basis:** kings-guard `KG-DEC-2026-001` and `KG-WP-0003`
|
||||
|
||||
## 1. Agreed boundary
|
||||
|
||||
The existing agreement is:
|
||||
|
||||
```text
|
||||
kings-guard publishes non-deterministic posture
|
||||
Gate House defines posture's authority meaning and restrictive asymmetry
|
||||
access-engine deterministically renders a decision
|
||||
the responsible Engine or ops-warden performs an authorized response
|
||||
```
|
||||
|
||||
Posture may reduce authority, require stronger authorization, or request
|
||||
containment. It never creates or widens authority. A containment proposal is
|
||||
not an authorization and kings-guard never bypasses an Engine to act on
|
||||
Tooling.
|
||||
|
||||
## 2. Posture envelope
|
||||
|
||||
A posture input offered for authority use must make these facts expressible:
|
||||
|
||||
```yaml
|
||||
posture_id: <stable id>
|
||||
subject:
|
||||
kind: actor | runtime | resource | tenant | environment
|
||||
id: <canonical id>
|
||||
assessment: HEALTHY | DEGRADED | SUSPICIOUS | CONTAIN | BLOCKED
|
||||
source: kings-guard
|
||||
observed_at: <RFC 3339 UTC>
|
||||
expires_at: <RFC 3339 UTC>
|
||||
evidence_refs: []
|
||||
stream_completeness:
|
||||
status: complete | degraded | unknown
|
||||
reason: <value-safe explanation>
|
||||
rationale: <value-safe explanation>
|
||||
```
|
||||
|
||||
This is a logical contract, not a kings-guard wire schema. Confidence or record
|
||||
richness may accompany it, but cannot override unknown or degraded stream
|
||||
completeness and cannot grant authority.
|
||||
|
||||
Access-engine records the posture identifier, freshness, and policy version
|
||||
that interpreted it. Unknown, missing, expired, or incomplete posture follows a
|
||||
declared restrictive stance; it does not fall back to extra authority.
|
||||
|
||||
## 3. Observation and proposal linkage
|
||||
|
||||
A kings-guard finding or containment proposal carries:
|
||||
|
||||
- originating observation identifier;
|
||||
- emitted signal/posture identifier;
|
||||
- affected subject and target;
|
||||
- evidence-stream completeness state;
|
||||
- requested restrictive direction;
|
||||
- no credential, secret value, or direct actuation instruction.
|
||||
|
||||
The eventual access-engine decision and authorized response retain those
|
||||
origin references. This makes a containment decision reconstructable without
|
||||
turning the proposal into authority.
|
||||
|
||||
## 4. Findings return
|
||||
|
||||
King's Guard returns these classes to Gate House:
|
||||
|
||||
- an invariant does not match observed behavior;
|
||||
- an implementation supplies posture in a form that cannot be interpreted
|
||||
without widening or ambiguity;
|
||||
- a load-bearing evidence stream is silent, divergent, stale, or incomplete;
|
||||
- a required live observation lane does not exist;
|
||||
- a doctrine claim is recomputable and therefore misclassified as posture;
|
||||
- a conformance result exposes a missing or untestable doctrine rule.
|
||||
|
||||
The durable transport is a State Hub inbox message:
|
||||
|
||||
```text
|
||||
Subject: [GH-POSTURE] <finding-class> <subject>@<revision-or-time>
|
||||
Body: posture/signal/observation ids, safe evidence references, completeness,
|
||||
affected invariant, current restriction, and requested doctrine action
|
||||
```
|
||||
|
||||
## 5. Gate House disposition
|
||||
|
||||
Gate House classifies the returned item without regrading security severity:
|
||||
|
||||
| Finding shape | Gate House action |
|
||||
| --- | --- |
|
||||
| Doctrine correct; implementation failed | Cross-reference risk-nexus/owner record; no foreign task is created here. |
|
||||
| Doctrine ambiguous or contradictory | Create or promote a Gate House intake, decision, contract revision, or workplan. |
|
||||
| Posture lane or observation mechanism missing | Return to kings-guard as its owning gap; mark affected conformance claim pending. |
|
||||
| Deterministic/recomputable property called posture | Move the criterion toward its owning Engine; do not create a second grader. |
|
||||
| Assurance specification incomplete | Revise the Gate House target and return the new version to whitehat-security. |
|
||||
|
||||
Every disposition replies with the resulting Gate House record identifiers or
|
||||
`no_change` plus rationale. Silence is not a disposition.
|
||||
|
||||
## 6. Loop closure
|
||||
|
||||
The loop is considered staffed, not necessarily green, when:
|
||||
|
||||
1. whitehat-security has an executable target and reports every outcome;
|
||||
2. kings-guard can observe at least one live lane and reports stream
|
||||
completeness separately from record richness;
|
||||
3. access-engine can bind posture to the decision it influenced;
|
||||
4. Gate House records doctrine disposition and returns identifiers;
|
||||
5. implementation remediation remains with the owning repository via
|
||||
risk-nexus.
|
||||
|
||||
`KG-WP-0003-T06` and T07 are the kings-guard work that makes origin linkage and
|
||||
live observation real. Until those tasks report completion, the corresponding
|
||||
lanes are declared gaps rather than assumed capabilities.
|
||||
Loading…
Add table
Add a link
Reference in a new issue