coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add attended Whitehat E2 credential projection
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
codex 2026-08-22 12:59:38 +02:00
parent ab7dee5382
commit 864cc20b96
7 changed files with 672 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md
View file

@ -72,6 +72,17 @@ both identities must expire no later than 18:15Z and cleanup/reload must be
attended. No unattended scheduler or background credential job is authorized
by this record.
**Procedure implementation (2026-08-22):**
`scripts/audit-core-whitehat-e2-credentials.py` now provides fail-closed
`preflight`, `project`, and idempotent `cleanup` commands. The projection uses
two exact per-engagement OpenBao paths, an ephemeral least-privilege Kubernetes
auth role, a Whitehat-only ClusterSecretStore, and an ExternalSecret that emits
exactly `token-a` and `token-b`. Project is hard-gated to 18:00Z–18:03Z;
cleanup remains callable after interruption and removes only the named
temporary identities and exact engagement resources. Four unit tests, a live
value-safe preflight, policy formatting, and Kubernetes server-side dry-run
passed. Live projection and cleanup remain waiting for the attended window.
## T02 — Define the runtime database lease recovery exercise
```task