coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(WH-ENG-20260822-AUDIT-E2-01): bind declared fixtures

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a025c2-407a-7a32-b40a-f37a52f03f62
This commit is contained in:
tegwick 2026-08-22 12:04:50 +02:00
parent 461554a749
commit 1418dac0de
3 changed files with 39 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
engagements/2026-08-22-audit-core-e2.json
View file

@ -16,10 +16,10 @@
"production_approval": "Explicit operator approval of WH-ENG-20260822-AUDIT-E2-01 in the coordinating session on 2026-08-22",
"approval_class": "live-e2",
"plane_namespace": "whitehat",
"runner_image_digest": "sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",
"runner_image_digest": "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
"namespace": "whitehat",
"source": "dedicated pod whitehat/whitehat-e2-audit, labels whitehat.security/plane=true, whitehat.security/target=audit-core, whitehat.security/engagement=WH-ENG-20260822-AUDIT-E2-01, serviceAccount whitehat-runner, automountServiceAccountToken=false",
"source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",
"source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
"control_plane_scope": [
"GET apps/v1 deployment audit-core/audit-core for target revision only",
"GET v1 service audit-core/audit-core for target identity only",
@ -36,7 +36,8 @@
"fixture_ids": [
"tenant:trial:whitehat-a-20260822", "tenant:trial:whitehat-b-20260822",
"whitehat-e2-event-a-20260822", "whitehat-e2-event-b-20260822",
"whitehat-e2-absent-20260822", "whitehat-e2-correlation-20260822"
"whitehat-e2-absent-20260822", "whitehat-e2-forged-b-20260822",
"whitehat-e2-correlation-20260822"
],
"credential_lane": "audit-core sender registry through its sanctioned custody owner; no credential value retained",
"credential_role": "two temporary ordinary tenant-scoped may_read/may_write fixture senders bound to source=whitehat-security",

17
runners/audit_core_e2.py
View file

@ -169,6 +169,20 @@ def equivalent(left: dict, right: dict) -> bool:
))
def invocation_fixture_ids(args: argparse.Namespace) -> set[str]:
"""Exact synthetic identifiers the invocation may address or emit."""
return {
args.tenant_a,
args.tenant_b,
args.event_a,
args.event_b,
args.absent_event,
args.correlation,
args.forged_event,
}
def main() -> None:
parser = argparse.ArgumentParser()
parser.add_argument("--base-url", required=True)
@ -181,6 +195,7 @@ def main() -> None:
parser.add_argument("--event-a", required=True)
parser.add_argument("--event-b", required=True)
parser.add_argument("--absent-event", required=True)
parser.add_argument("--forged-event", required=True)
parser.add_argument("--correlation", required=True)
parser.add_argument("--occurred-at", required=True,
help="fixed RFC3339 fixture time; makes retries idempotent")
@ -238,7 +253,7 @@ def main() -> None:
"outcome": "finding" if reasons else "pass", "reasons": reasons,
"observations": {"owner": owner_corr, "attacker": attacker_corr}})
forged = "whitehat-e2-forged-b-20260821"
forged = args.forged_event
forged_response = client.observation(client.call(
args.token_a_file, "POST", "/v1/events",
event(forged, args.tenant_b, args.correlation, args.occurred_at)

19
tests/test_audit_core_runner.py
View file

@ -1,4 +1,6 @@
import importlib.util
import json
from argparse import Namespace
from pathlib import Path
@ -43,3 +45,20 @@ def test_post_headers_bind_idempotency_key_to_event_id():
def test_get_headers_have_no_idempotency_key():
headers = runner.request_headers("secret", "eng-1", "corr-1", None)
assert "Idempotency-Key" not in headers
def test_invocation_fixture_set_is_declared_by_current_engagement():
engagement = json.loads(
Path("engagements/2026-08-22-audit-core-e2.json").read_text()
)
args = Namespace(
tenant_a="tenant:trial:whitehat-a-20260822",
tenant_b="tenant:trial:whitehat-b-20260822",
event_a="whitehat-e2-event-a-20260822",
event_b="whitehat-e2-event-b-20260822",
absent_event="whitehat-e2-absent-20260822",
forged_event="whitehat-e2-forged-b-20260822",
correlation="whitehat-e2-correlation-20260822",
)
assert runner.invocation_fixture_ids(args) <= set(engagement["fixture_ids"])