2026-08-17 14:37:50 +00:00
|
|
|
# whitehat-security
|
|
|
|
|
|
2026-10-04 08:54:40 +02:00
|
|
|
NetKingdom's offensive security facility. It calibrates adversarial probes
|
|
|
|
|
offline and admits a live run only under a complete engagement record. No
|
|
|
|
|
live target is authorized by the repository itself.
|
Seed INTENT and WP-0001: adversarial evidence facility
Answers the Tenancy Posture question that has been unowned since the framework
was drafted - who verifies a consumer's tenant boundary. Two repos were asked
and both correctly declined as fleet-scope work. The work needed a home.
Independence is the load-bearing property, not a nicety. rapp-postgres wrote
fifteen probes against its own isolation model and found four real defects,
which is good work and still the author checking their own homework. The probes
worth having are the ones the author would not think to write, because the
assumption that produced the defect produces the blind spot.
That argues against NetKingdom owning this even though it owns the security
canon: a facility verifying conformance to a framework must not report to the
repo that owns the framework, or self-grading just moves up a level. Proposed
owner is the-custodian, consistent with policy and risk. Needs confirmation.
Two things stated because overclaiming is the failure this estate keeps
catching in itself. "Automated" has a ceiling - the highest-impact cross-tenant
findings need someone who understands what the data means, since a response can
be well-formed, 200, fast, and contain another tenant's rows; so automate the
reproducible and flag the irreducible for dated review. And a passing suite
proves the attacks we thought of did not work, not that the boundary holds. The
gap between those sentences is where breaches live.
WP-0001 gates everything behind rules of engagement, because an automated
facility probing systems without written scope is indistinguishable from the
threat it models. No standing privilege, no BYPASSRLS, no superuser - an
attacker would not have them and a probe holding them proves nothing. No
exfiltration of real tenant data even as proof; a count and a schema shape are
proof enough. And no saturation probing outside a declared window, because with
a six-consumer connection ceiling that is an outage for every co-resident.
T04 exists because a probe that has only ever passed is not evidence. Every
probe must be shown failing against a known-bad fixture before it is trusted
passing - the same discipline rapp-postgres used when it verified its drift
check by deliberately re-pinning to a bad digest.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:41:36 +02:00
|
|
|
|
2026-10-04 08:54:40 +02:00
|
|
|
The estate's **adversarial evidence facility**: it can test whether a claimed
|
|
|
|
|
boundary holds, and today that capability is the offline harness plus one
|
|
|
|
|
terminal historical audit-core E2 pass. It does not run on a schedule.
|
Seed INTENT and WP-0001: adversarial evidence facility
Answers the Tenancy Posture question that has been unowned since the framework
was drafted - who verifies a consumer's tenant boundary. Two repos were asked
and both correctly declined as fleet-scope work. The work needed a home.
Independence is the load-bearing property, not a nicety. rapp-postgres wrote
fifteen probes against its own isolation model and found four real defects,
which is good work and still the author checking their own homework. The probes
worth having are the ones the author would not think to write, because the
assumption that produced the defect produces the blind spot.
That argues against NetKingdom owning this even though it owns the security
canon: a facility verifying conformance to a framework must not report to the
repo that owns the framework, or self-grading just moves up a level. Proposed
owner is the-custodian, consistent with policy and risk. Needs confirmation.
Two things stated because overclaiming is the failure this estate keeps
catching in itself. "Automated" has a ceiling - the highest-impact cross-tenant
findings need someone who understands what the data means, since a response can
be well-formed, 200, fast, and contain another tenant's rows; so automate the
reproducible and flag the irreducible for dated review. And a passing suite
proves the attacks we thought of did not work, not that the boundary holds. The
gap between those sentences is where breaches live.
WP-0001 gates everything behind rules of engagement, because an automated
facility probing systems without written scope is indistinguishable from the
threat it models. No standing privilege, no BYPASSRLS, no superuser - an
attacker would not have them and a probe holding them proves nothing. No
exfiltration of real tenant data even as proof; a count and a schema shape are
proof enough. And no saturation probing outside a declared window, because with
a six-consumer connection ceiling that is an outage for every co-resident.
T04 exists because a probe that has only ever passed is not evidence. Every
probe must be shown failing against a known-bad fixture before it is trusted
passing - the same discipline rapp-postgres used when it verified its drift
check by deliberately re-pinning to a bad digest.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:41:36 +02:00
|
|
|
|
|
|
|
|
It exists because a repo testing its own boundary grades its own homework. The
|
|
|
|
|
probes most worth having are the ones an author would not think to write.
|
|
|
|
|
|
2026-08-21 22:52:37 +02:00
|
|
|
- **Independent in operation.** It does not take a declared posture as true.
|
|
|
|
|
NetKingdom owns both the security canon and this facility, so findings leave
|
|
|
|
|
through `risk-nexus` under separate ownership rather than being resolved here.
|
Seed INTENT and WP-0001: adversarial evidence facility
Answers the Tenancy Posture question that has been unowned since the framework
was drafted - who verifies a consumer's tenant boundary. Two repos were asked
and both correctly declined as fleet-scope work. The work needed a home.
Independence is the load-bearing property, not a nicety. rapp-postgres wrote
fifteen probes against its own isolation model and found four real defects,
which is good work and still the author checking their own homework. The probes
worth having are the ones the author would not think to write, because the
assumption that produced the defect produces the blind spot.
That argues against NetKingdom owning this even though it owns the security
canon: a facility verifying conformance to a framework must not report to the
repo that owns the framework, or self-grading just moves up a level. Proposed
owner is the-custodian, consistent with policy and risk. Needs confirmation.
Two things stated because overclaiming is the failure this estate keeps
catching in itself. "Automated" has a ceiling - the highest-impact cross-tenant
findings need someone who understands what the data means, since a response can
be well-formed, 200, fast, and contain another tenant's rows; so automate the
reproducible and flag the irreducible for dated review. And a passing suite
proves the attacks we thought of did not work, not that the boundary holds. The
gap between those sentences is where breaches live.
WP-0001 gates everything behind rules of engagement, because an automated
facility probing systems without written scope is indistinguishable from the
threat it models. No standing privilege, no BYPASSRLS, no superuser - an
attacker would not have them and a probe holding them proves nothing. No
exfiltration of real tenant data even as proof; a count and a schema shape are
proof enough. And no saturation probing outside a declared window, because with
a six-consumer connection ceiling that is an outage for every co-resident.
T04 exists because a probe that has only ever passed is not evidence. Every
probe must be shown failing against a known-bad fixture before it is trusted
passing - the same discipline rapp-postgres used when it verified its drift
check by deliberately re-pinning to a bad digest.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-17 16:41:36 +02:00
|
|
|
- **It finds; it does not fix.** Findings route to `risk-nexus`, which owns
|
|
|
|
|
severity and disclosure. The repo that owns the defect owns the repair.
|
|
|
|
|
- **A pass means the attacks we tried did not work** — not that the boundary
|
|
|
|
|
holds. Reports say so.
|
|
|
|
|
|
2026-08-21 22:52:37 +02:00
|
|
|
- Intent: [`INTENT.md`](INTENT.md)
|
|
|
|
|
- Scope: [`SCOPE.md`](SCOPE.md)
|
|
|
|
|
- Workplans: [`workplans/`](workplans/)
|
2026-08-21 23:09:22 +02:00
|
|
|
- Attacker model: [`docs/attacker-model.md`](docs/attacker-model.md)
|
|
|
|
|
- Rules of engagement (accepted; live targets still require engagement approval):
|
2026-08-21 22:52:37 +02:00
|
|
|
[`docs/rules-of-engagement.md`](docs/rules-of-engagement.md)
|
2026-08-21 23:53:27 +02:00
|
|
|
- Operator runbook: [`docs/operator-runbook.md`](docs/operator-runbook.md)
|
2026-08-22 00:24:00 +02:00
|
|
|
- Session cutoff and redesign handoff:
|
|
|
|
|
[`docs/session-cutoff-2026-08-22.md`](docs/session-cutoff-2026-08-22.md)
|
2026-08-22 00:44:21 +02:00
|
|
|
- Governed test plane: [`docs/test-plane.md`](docs/test-plane.md)
|
|
|
|
|
- Target registrations: [`targets/`](targets/)
|
2026-08-21 23:53:27 +02:00
|
|
|
- Target packs: [`probe-packs/`](probe-packs/)
|
|
|
|
|
|
|
|
|
|
## Offline calibration
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
make check
|
|
|
|
|
make fixture-evidence
|
|
|
|
|
```
|
|
|
|
|
|
2026-08-22 00:44:21 +02:00
|
|
|
This proves that every current differential probe, including the audit-core
|
|
|
|
|
shaped pack, passes an enforcing fixture and detects the corresponding
|
|
|
|
|
missing-tenant-predicate fixture. It sends no network traffic and is not
|
|
|
|
|
evidence about a target service. Live execution requires a current
|
|
|
|
|
target-specific record, a registered applicable target, and plane admission.
|
|
|
|
|
See [`docs/test-plane.md`](docs/test-plane.md).
|