coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the audit-core E2-03 target pass and close T03/T07

Browse source 
Land the sanitized WH-ENG-20260822-AUDIT-E2-03 report, mark the
engagement completed and terminal, and close the applicable E2 harness
and risk-nexus delivery tasks. flex-auth stays pending; tenant-engine
stays not_applicable.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-23 00:42:31 +02:00
parent 5fcb3ec280
commit 3295b715c5
18 changed files with 293 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

4
engagements/2026-08-22-audit-core-e2-03.json
View file

@ -1,6 +1,8 @@
{
"engagement_id": "WH-ENG-20260822-AUDIT-E2-03",
"status": "approved",
"status": "completed",
"completed_at": "2026-08-22T22:16:58Z",
"completion_reason": "Target pass over 10 operations. Runner ended 22:10:25Z; receipt-bound cleanup 22:13:48Z; sanitized report delivered to risk-nexus as 40e3f825-fc70-4091-96d2-9ab01d42184a. Identifier is terminal.",
"proposal_at": "2026-08-22T21:15:00Z",
"proposal_reason": "Fresh attended attempt after -02 proved exact cleanup and exposed the now-implemented WP-0025 custody receipt handoff. No terminal identifier, identity, tenant, object, or Kubernetes Secret is reused.",
"authorization_id": "operator-session-2026-08-22-e2-03-approval",

18
engagements/2026-08-22-audit-core-e2-03.md
View file

@ -1,14 +1,12 @@
# WH-ENG-20260822-AUDIT-E2-03
Status: **approved** for `2026-08-22T22:00:00Z`–`22:15:00Z`.
Status: **completed**. Identifier is terminal.
This is a fresh, terminal-unique attempt. It does not reuse the `-01` or `-02`
identifier, senders, tenants, objects, mounted Secret, or runner pod. The
projection gate closes at `22:03:00Z`; all custody resources expire and must be
cleaned by `22:15:00Z`. The repository operator approved the exact package at
`21:29:21Z`; audit-core acknowledged it after approval at `21:29:22Z`.
Attended window `2026-08-22T22:00:00Z`–`22:15:00Z`. Projection at `22:01:35Z`,
runner `22:09:30Z`–`22:10:25Z` (10 operations, three probes passed), cleanup
`22:13:48Z`, report to risk-nexus `22:16:58Z` (`40e3f825-fc70-4091-96d2-9ab01d42184a`).
Sanitized evidence: `evidence/WH-ENG-20260822-AUDIT-E2-03.json`.
The run uses the canonical RAILIANCE-WP-0025 projection contract, Whitehat
broker-readiness receipt, projection receipt, contract-bound `admit-plane`,
cleanup receipt, and finalized report. Projection remains forbidden before
`22:00:00Z` and after `22:03:00Z`.
A pass means only that the attempted attacks did not work. It is not proof that
the tenant boundary always holds. Do not reuse this identifier, its senders,
tenants, objects, Secret, or runner pod.

5
engagements/README.md
View file

@ -16,6 +16,7 @@ manifest under `runtime/` is bound to a cancelled ID and must not be applied.
`WH-ENG-20260822-AUDIT-E2-01` expired unused. `WH-ENG-20260822-AUDIT-E2-02`
aborted after projection because `admit-plane` had no receipt adapter; zero
packets. Neither identifier may be reused. Live admission requires
`--receipt` of a value-safe custody projection.
packets. `WH-ENG-20260822-AUDIT-E2-03` completed as a bounded target pass.
Those identifiers may not be reused. Live admission requires `--receipt`,
`--contract`, and `--broker-receipt` of WP-0025 documents.

6
engagements/runtime/WH-ENG-20260822-AUDIT-E2-03-invocation.md
View file

@ -1,8 +1,8 @@
# WH-ENG-20260822-AUDIT-E2-03 — attended invocation
This package is proposed for `22:00Z`–`22:15Z`; projection closes at `22:03Z`.
Do nothing live until the engagement and the exact WP-0025 contract are
approved and audit-core has acknowledged them.
This engagement **completed** at `2026-08-22T22:16:58Z`. Do not apply the
runner, project credentials, or reuse this identifier. The record below is
the attended sequence that was used.
Runtime value-safe artifacts are written beneath
`/tmp/WH-ENG-20260822-AUDIT-E2-03/`: