coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require a WP-0025 broker receipt at admit-plane

Browse source 
Platform reproduced a recanonicalized projection receipt with a
substituted all-zero broker digest on the operational path. WP-0025
admission now requires --broker-receipt, threads it through
broker_from_receipt, and refuses unless the digest matches exactly.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 22:32:15 +02:00
parent cb6620f33b
commit 0db73f0605
5 changed files with 140 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/whitehat_security/cli.py
View file

@ -96,6 +96,10 @@ def main(argv: list[str] | None = None) -> None:
"--contract",
help="WP-0025 projection contract; required for railiance.custody-projection-receipt",
)
admit_plane.add_argument(
"--broker-receipt",
help="WP-0025 broker-readiness receipt; required for railiance.custody-projection-receipt",
)
commands.add_parser("kill-switch")
deliver = commands.add_parser("deliver")
deliver.add_argument("report")
@ -145,7 +149,11 @@ def main(argv: list[str] | None = None) -> None:
record = Engagement.load(args.engagement)
registration = load_registration(args.registration)
broker = (
broker_from_receipt(args.receipt, contract_path=args.contract)
broker_from_receipt(
args.receipt,
contract_path=args.contract,
broker_path=args.broker_receipt,
)
if args.receipt else default_broker(record)
)
lease = admit(engagement=record, registration=registration,