coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the audit-core E2-03 target pass and close T03/T07

Browse source 
Land the sanitized WH-ENG-20260822-AUDIT-E2-03 report, mark the
engagement completed and terminal, and close the applicable E2 harness
and risk-nexus delivery tasks. flex-auth stays pending; tenant-engine
stays not_applicable.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-23 00:42:31 +02:00
parent 5fcb3ec280
commit 3295b715c5
18 changed files with 293 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

21
SCOPE.md
View file

@ -65,15 +65,16 @@ boundary always holds.
## Current state
- Repository status: active.
- Active plan: `WHITEHAT-WP-0001`. Meantime polish: `WHITEHAT-WP-0002` and
`WHITEHAT-WP-0003` (Railiance WP-0025 custody adapter).
- Active plan: `WHITEHAT-WP-0001`. Meantime polish: `WHITEHAT-WP-0002` through
`WHITEHAT-WP-0005` (Railiance WP-0025 custody adapter and fail-closed
admission).
- `T01` is complete: the rules of engagement were accepted on 2026-08-21.
- `T02` is complete: the per-axis attacker model is recorded in
`docs/attacker-model.md`.
- `T03` is in progress: `WH-ENG-20260822-AUDIT-E2-01` expired unused;
`WH-ENG-20260822-AUDIT-E2-02` aborted after projection because admission
had no receipt adapter. Zero packets. A later live run needs a new ID and
`admit-plane --receipt`.
- `T03` is complete for currently applicable E2 targets: `audit-core` has
dated pass `WH-ENG-20260822-AUDIT-E2-03`; `tenant-engine` remains
`not_applicable`. `flex-auth` is still pending. `-01` and `-02` are
terminal without E2 evidence.
- `T04` is complete for every applicable E2 probe: generic and audit-core
shaped fixtures fail known-bad and pass known-good in-process.
- `T05` is in progress: 24-hour cadence, offline evaluator and in-process
@ -81,12 +82,12 @@ boundary always holds.
runtime identity.
- `T06` is in progress: the characterization evaluator is calibrated
in-process; `shared-substrate` is pending a live window and ceiling.
- `T07` is in progress: reports can be queued to `outbox/`; the first target
report has not been produced.
- `T07` is complete: the `-03` sanitized pass was delivered to `risk-nexus`
as `40e3f825-fc70-4091-96d2-9ab01d42184a`.
- `T08` is the governed test plane contract. Cluster provisioning is outside
this repository.
- No live probe traffic is authorized; each target still requires its own
engagement record, plane admission and approvals.
- `-03` is terminal. A later live run needs a new engagement ID, plane
admission, and approvals. `flex-auth` and P1/P2 remain unrun.
## Relationships