Register whitehat-security and align operating boundaries

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Produce the adversarial evidence the Tenancy Posture ladders require"
 domain: infotech
 repo: whitehat-security
-status: proposed
+status: active
 owner: net-kingdom
 topic_slug: whitehat-security
 created: "2026-08-17"
-updated: "2026-08-17"
+updated: "2026-08-21"
 ---
 
 # WHITEHAT-WP-0001 — cross-tenant evidence
@@ -45,10 +45,12 @@ not paperwork.
 - **Target authorization**, the control that matters most now the facility is
   scoped to any surface we choose rather than only our own. No target without a
   recorded authorization from its responsible party. Our estate in build mode
-  has standing authorization; production needs its own; anything we do not own
-  needs written per-engagement authorization recorded here before a packet is
-  sent. A commercial relationship, public reachability, and "they would
-  obviously be fine with it" are each explicitly not authorization.
+  has standing authorization only as a prerequisite: every live run still
+  needs the dated engagement record and target-owner acknowledgement defined in
+  the rules of engagement. Production needs its own authorization; anything we
+  do not own needs written per-engagement authorization recorded here before a
+  packet is sent. A commercial relationship, public reachability, and "they
+  would obviously be fine with it" are each explicitly not authorization.
 - **Scope.** Which systems, which namespaces, which credentials — and a hard
   stop at the engagement boundary. A probe that discovers an adjacent system
   reports what it saw and does not follow it.
@@ -75,8 +77,26 @@ This is exactly the class of thing `risk-nexus`'s escalation duty exists for.
 ### T01 — Rules of engagement
 As above. Gates everything.
 
+```task
+id: WHITEHAT-WP-0001-T01
+status: progress
+priority: high
+```
+
+Drafted in `docs/rules-of-engagement.md` on 2026-08-18 with authorization
+classes, per-run records, initial target envelope, hard prohibitions,
+credential/attribution rules, rate defaults, abort/cleanup and evidence
+schema. It authorizes no live traffic until the operator personally approves
+§10. T01 remains progress and continues to gate every later task.
+
 ### T02 — The attacker model per axis
 
+```task
+id: WHITEHAT-WP-0001-T02
+status: wait
+priority: high
+```
+
 What the adversary is assumed to hold, so a probe is judged against a threat
 rather than against taste. Drawn from *Tenancy Posture* §4.3, which already
 distinguishes them:
@@ -95,6 +115,12 @@ only tested accident would report a strength E3 does not have.
 
 ### T03 — Differential cross-tenant harness (the E2 artifact)
 
+```task
+id: WHITEHAT-WP-0001-T03
+status: wait
+priority: high
+```
+
 The core technique: run the same request as two tenants and compare.
 
 - Provision two disposable tenants against a target service.
@@ -111,6 +137,12 @@ currently claim `E2`. The artifact is the run record, not a green tick.
 
 ### T04 — Prove the probes fail
 
+```task
+id: WHITEHAT-WP-0001-T04
+status: wait
+priority: high
+```
+
 A probe that has only ever passed is not evidence.
 
 Build known-bad fixtures — a service with a deliberately missing tenant
@@ -123,6 +155,12 @@ trusted passing.
 
 ### T05 — RLS conformance under attack (the E3 artifact)
 
+```task
+id: WHITEHAT-WP-0001-T05
+status: wait
+priority: medium
+```
+
 `rapp-postgres` ADR-0003 supplies an `rls_conformance` view and a template, and
 states plainly that the platform's guarantee is **detection, not prevention** —
 a table created by a later migration ships without a policy until something
@@ -141,6 +179,12 @@ the number to this repo. Set it, and state the resulting window in the record.
 
 ### T06 — Noisy-neighbour characterisation (the P1/P2 artifact)
 
+```task
+id: WHITEHAT-WP-0001-T06
+status: wait
+priority: medium
+```
+
 The framework had to reword this artifact once already: its first draft
 required proof that a saturating consumer "does not breach" another's
 allowance, which shared infrastructure cannot provide.
@@ -156,6 +200,12 @@ consumer connection ceiling, a saturation probe is an outage if run carelessly.
 
 ### T07 — Reporting into risk-nexus
 
+```task
+id: WHITEHAT-WP-0001-T07
+status: wait
+priority: medium
+```
+
 Findings leave this repo in one direction. A run produces: what was attempted,
 under which attacker model, when, against which posture claim, and the outcome.
 It carries no severity — that is `risk-nexus`'s.