2026-08-22 12:16:29 +02:00
|
|
|
|
# WH-ENG-20260822-AUDIT-E2-01 — invocation (no secrets)
|
|
|
|
|
|
|
|
|
|
|
|
Do not apply the runner pod and do not mint credentials until the custody
|
|
|
|
|
|
owner projects two mount-only tokens at window start. Minting now would
|
|
|
|
|
|
exhaust the 900-second TTL before `18:00Z`.
|
|
|
|
|
|
|
|
|
|
|
|
Current time-gate: `validate-engagement` and `admit-plane` fail closed with
|
|
|
|
|
|
`engagement window has not started` until `2026-08-22T18:00:00Z`. After the
|
|
|
|
|
|
window opens, `admit-plane` still fails closed while the live custody broker
|
|
|
|
|
|
is unconnected.
|
|
|
|
|
|
|
|
|
|
|
|
## Custody projection (railiance-platform)
|
|
|
|
|
|
|
2026-08-22 15:03:03 +02:00
|
|
|
|
Procedure is implemented at railiance-platform `864cc20`
|
|
|
|
|
|
(`docs/audit-core-whitehat-e2-credential-projection.md`). `project` is
|
|
|
|
|
|
hard-gated to **18:00Z–18:03Z**. Cleanup must finish before 18:15Z. No mint
|
|
|
|
|
|
before the gate.
|
2026-08-22 12:16:29 +02:00
|
|
|
|
|
|
|
|
|
|
| Handle | Binding |
|
|
|
|
|
|
| --- | --- |
|
|
|
|
|
|
| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822`, `may_read=true`, `may_write=true` |
|
|
|
|
|
|
| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822`, `may_read=true`, `may_write=true` |
|
|
|
|
|
|
|
2026-08-22 15:03:03 +02:00
|
|
|
|
Attended commands, from railiance-platform, after 18:00Z and no later than 18:03Z:
|
|
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
|
python3 scripts/audit-core-whitehat-e2-credentials.py preflight
|
|
|
|
|
|
python3 scripts/audit-core-whitehat-e2-credentials.py project \
|
|
|
|
|
|
--confirm WH-ENG-20260822-AUDIT-E2-01:attended
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
After that notice, apply the runner contract and the invocation below. Before
|
|
|
|
|
|
18:15Z:
|
|
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
|
python3 scripts/audit-core-whitehat-e2-credentials.py cleanup \
|
|
|
|
|
|
--confirm WH-ENG-20260822-AUDIT-E2-01:attended
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Never return token values to whitehat, State Hub, or chat.
|
2026-08-22 12:16:29 +02:00
|
|
|
|
|
|
|
|
|
|
## Runner (inside the admitted pod, after projection)
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
python3 - \
|
|
|
|
|
|
--base-url http://audit-core.audit-core.svc.cluster.local:8080 \
|
|
|
|
|
|
--engagement-id WH-ENG-20260822-AUDIT-E2-01 \
|
|
|
|
|
|
--target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \
|
|
|
|
|
|
--token-a-file /var/run/secrets/whitehat/token-a \
|
|
|
|
|
|
--token-b-file /var/run/secrets/whitehat/token-b \
|
|
|
|
|
|
--tenant-a tenant:trial:whitehat-a-20260822 \
|
|
|
|
|
|
--tenant-b tenant:trial:whitehat-b-20260822 \
|
|
|
|
|
|
--event-a whitehat-e2-event-a-20260822 \
|
|
|
|
|
|
--event-b whitehat-e2-event-b-20260822 \
|
|
|
|
|
|
--absent-event whitehat-e2-absent-20260822 \
|
|
|
|
|
|
--forged-event whitehat-e2-forged-b-20260822 \
|
|
|
|
|
|
--correlation whitehat-e2-correlation-20260822 \
|
|
|
|
|
|
--occurred-at 2026-08-22T18:00:00Z \
|
|
|
|
|
|
--rate 10 --max-requests 30 --abort-p95-ms 500
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory
|
|
|
|
|
|
and must stay inside `fixture_ids`.
|
