# Audit-core Whitehat E2 credential projection

This is the attended custody procedure for
`WH-ENG-20260822-AUDIT-E2-01`. It creates two ordinary, tenant-scoped audit-core
sender identities and projects only `token-a` and `token-b` into the Whitehat
runner mount. It never returns credential values.

## Safety gates

- `project` is hard-gated to 18:00Z–18:03Z on 2026-08-22. This leaves the
  remainder of the approved 18:00Z–18:15Z window for the bounded probe and
  cleanup.
- Both audit-core identities carry `expires_at: 2026-08-22T18:15:00Z`, checked
  by the receiver on every authentication.
- OpenBao stores the two values at separate engagement paths. The ephemeral ESO
  policy can read only those paths; it cannot read the full sender registry.
- The generated Kubernetes Secret has exactly `token-a` and `token-b` and is
  consumed only through the read-only volume declared by Whitehat.
- Cleanup removes identities by exact name, preserving every unrelated sender.
  It deletes the two KV paths, ESO role/policy, ClusterSecretStore,
  ExternalSecret, and mounted Secret, then reloads audit-core if required.

## Attended sequence

Keep the operator terminal attached from projection through cleanup. The
platform-admin token file must remain outside Git with mode `0600`.

```bash
python3 scripts/audit-core-whitehat-e2-credentials.py preflight

# Run only after 18:00Z and no later than 18:03Z.
python3 scripts/audit-core-whitehat-e2-credentials.py project \
  --confirm WH-ENG-20260822-AUDIT-E2-01:attended
```

After projection succeeds, Whitehat may apply its approved runner contract and
execute only the invocation recorded in
`whitehat-security/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md`.
Stop immediately on an engagement abort threshold.

Whether the probe succeeds, fails, or aborts, clean up before 18:15Z:

```bash
python3 scripts/audit-core-whitehat-e2-credentials.py cleanup \
  --confirm WH-ENG-20260822-AUDIT-E2-01:attended
```

The command output is a value-safe JSON receipt. Record that receipt, the
audit-core rollout/readiness result, the Whitehat runner result, and the
absence of the mounted Secret. Never record a bearer, Secret data, sender
registry payload, or OpenBao response body.

## Abort path

If `project` fails after changing custody, it invokes the same exact cleanup
automatically. If the process itself is interrupted, run `cleanup` immediately;
it is idempotent and is allowed before or after the projection window. If
audit-core does not return 1/1 Ready after registry cleanup, do not re-add the
temporary identities—keep the Whitehat Secret absent and escalate the target
recovery separately.