Add attended Whitehat E2 credential projection

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

docs/audit-core-whitehat-e2-credential-projection.md

@@ -0,0 +1,60 @@
+# Audit-core Whitehat E2 credential projection
+
+This is the attended custody procedure for
+`WH-ENG-20260822-AUDIT-E2-01`. It creates two ordinary, tenant-scoped audit-core
+sender identities and projects only `token-a` and `token-b` into the Whitehat
+runner mount. It never returns credential values.
+
+## Safety gates
+
+- `project` is hard-gated to 18:00Z–18:03Z on 2026-08-22. This leaves the
+  remainder of the approved 18:00Z–18:15Z window for the bounded probe and
+  cleanup.
+- Both audit-core identities carry `expires_at: 2026-08-22T18:15:00Z`, checked
+  by the receiver on every authentication.
+- OpenBao stores the two values at separate engagement paths. The ephemeral ESO
+  policy can read only those paths; it cannot read the full sender registry.
+- The generated Kubernetes Secret has exactly `token-a` and `token-b` and is
+  consumed only through the read-only volume declared by Whitehat.
+- Cleanup removes identities by exact name, preserving every unrelated sender.
+  It deletes the two KV paths, ESO role/policy, ClusterSecretStore,
+  ExternalSecret, and mounted Secret, then reloads audit-core if required.
+
+## Attended sequence
+
+Keep the operator terminal attached from projection through cleanup. The
+platform-admin token file must remain outside Git with mode `0600`.
+
+```bash
+python3 scripts/audit-core-whitehat-e2-credentials.py preflight
+
+# Run only after 18:00Z and no later than 18:03Z.
+python3 scripts/audit-core-whitehat-e2-credentials.py project \
+  --confirm WH-ENG-20260822-AUDIT-E2-01:attended
+```
+
+After projection succeeds, Whitehat may apply its approved runner contract and
+execute only the invocation recorded in
+`whitehat-security/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md`.
+Stop immediately on an engagement abort threshold.
+
+Whether the probe succeeds, fails, or aborts, clean up before 18:15Z:
+
+```bash
+python3 scripts/audit-core-whitehat-e2-credentials.py cleanup \
+  --confirm WH-ENG-20260822-AUDIT-E2-01:attended
+```
+
+The command output is a value-safe JSON receipt. Record that receipt, the
+audit-core rollout/readiness result, the Whitehat runner result, and the
+absence of the mounted Secret. Never record a bearer, Secret data, sender
+registry payload, or OpenBao response body.
+
+## Abort path
+
+If `project` fails after changing custody, it invokes the same exact cleanup
+automatically. If the process itself is interrupted, run `cleanup` immediately;
+it is idempotent and is allowed before or after the projection window. If
+audit-core does not return 1/1 Ready after registry cleanup, do not re-add the
+temporary identities—keep the Whitehat Secret absent and escalate the target
+recovery separately.