NetKingdom owns this; and a targeting rule, because scope widened

Operator decision: whitehat is a NetKingdom facility, framed offensively -
offence is how you find out, and a control is believed until someone tries it.
Our own estate is one target among those we choose, not the only one.

I had argued for the-custodian on independence grounds. The counter-argument is
better: offensive security is security work and belongs with the security repo.
The residual tension is real and recorded rather than argued away - NetKingdom
now owns both the Tenancy Posture framework and the facility that tests
conformance to it, which is NetKingdom assessing NetKingdom. The mitigation is
that findings leave for risk-nexus under separate ownership rather than being
resolved in place. Proportionate, not perfect, and worth revisiting if
conformance findings start getting quietly closed.

The reframe changes what this repo must guard against, and that is the
substantial part of this commit. A facility that can be pointed at
infrastructure we do not own is the single thing that could turn this repo from
an asset into a liability, so the targeting rule is structural rather than
cultural.

No target without recorded authorization from whoever is responsible for it.
Own estate in build mode has standing authorization; production needs its own,
because the blast radius differs and so does the decision; anything we do not
own needs written per-engagement authorization recorded here before a packet is
sent.

Three non-authorizations written down because each is a way teams talk
themselves into it: a commercial relationship with the target, the target being
publicly reachable, and believing the owner would obviously be fine with it.
Unauthorized probing is criminal in most jurisdictions regardless of intent,
and a white-hat facility that gets this wrong is an attacker with better
paperwork.

Two consequences. The authorization record is part of the finding - a report
that cannot name what it ran under is not a finding, it is an incident. And
scope creep during an engagement is prohibited: a probe that discovers an
adjacent system stops at the boundary, because following the interesting thing
is how an authorized test becomes an unauthorized one.

Findings routing now forks. Our estate goes to risk-nexus and on to the owning
repo. Any other target goes to that infrastructure's responsible party on the
engagement's agreed terms, with risk-nexus still recording that it happened.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md

@@ -5,7 +5,7 @@ title: "Produce the adversarial evidence the Tenancy Posture ladders require"
 domain: infotech
 repo: whitehat-security
 status: proposed
-owner: the-custodian
+owner: net-kingdom
 topic_slug: whitehat-security
 created: "2026-08-17"
 updated: "2026-08-17"
@@ -42,9 +42,16 @@ An automated facility that probes systems without written scope is
 indistinguishable from the threat it models. This is the gating task and it is
 not paperwork.
 
-- **Scope.** Which systems, which namespaces, which credentials. Explicitly:
-  build-mode environments now; production requires a separate, recorded
-  authorization.
+- **Target authorization**, the control that matters most now the facility is
+  scoped to any surface we choose rather than only our own. No target without a
+  recorded authorization from its responsible party. Our estate in build mode
+  has standing authorization; production needs its own; anything we do not own
+  needs written per-engagement authorization recorded here before a packet is
+  sent. A commercial relationship, public reachability, and "they would
+  obviously be fine with it" are each explicitly not authorization.
+- **Scope.** Which systems, which namespaces, which credentials — and a hard
+  stop at the engagement boundary. A probe that discovers an adjacent system
+  reports what it saw and does not follow it.
 - **Prohibited actions**, stated as hard rules rather than intentions:
   no destructive operations against data the estate did not create for the
   test; no exfiltration of real tenant data even as proof of a finding —
@@ -179,8 +186,11 @@ findings route out, work does not come in.
 
 ## Open questions
 
-1. **Owner confirmation.** Proposed `the-custodian`, deliberately not
-   NetKingdom, whose framework this verifies. Needs the operator's yes.
+1. **Owner: NetKingdom** — settled 2026-08-17. Offensive security is security
+   work. The residual tension (NetKingdom owning both the Tenancy Posture
+   framework and the facility that tests conformance to it) is mitigated by
+   findings routing out to `risk-nexus` under separate ownership, and is
+   recorded in INTENT rather than argued away.
 2. **Where probes run from.** In-cluster gives realistic network position;
    outside gives independence from the substrate under test. Probably both,
    eventually; pick one to start.