coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WHITEHAT-WP-0001 and own live residuals in WP-0006

Browse source 
Close T05 and T06 on the same applicable-target rule as T03: E3 cadence
and in-process calibration, platform-pg not_applicable, P1/P2 evaluator
proven against known-good and known-bad samples. Persist offline capacity
calibration. Live E3, P1/P2, flex-auth E2, and a later audit-core run
move to WHITEHAT-WP-0006, which authorizes no packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
This commit is contained in:
tegwick 2026-09-01 20:26:47 +02:00
parent 69e03efd7f
commit 43327183d8
13 changed files with 355 additions and 73 deletions
Download patch file Download diff file Expand all files Collapse all files

37
SCOPE.md
View file

@ -65,29 +65,16 @@ boundary always holds.
## Current state
- Repository status: active.
- Active plan: `WHITEHAT-WP-0001`. Meantime polish: `WHITEHAT-WP-0002` through
`WHITEHAT-WP-0005` (Railiance WP-0025 custody adapter and fail-closed
admission).
- `T01` is complete: the rules of engagement were accepted on 2026-08-21.
- `T02` is complete: the per-axis attacker model is recorded in
`docs/attacker-model.md`.
- `T03` is complete for currently applicable E2 targets: `audit-core` has
dated pass `WH-ENG-20260822-AUDIT-E2-03`; `tenant-engine` remains
`not_applicable`. `flex-auth` is still pending. `-01` and `-02` are
terminal without E2 evidence.
- `T04` is complete for every applicable E2 probe: generic and audit-core
shaped fixtures fail known-bad and pass known-good in-process.
- `T05` is in progress: 24-hour cadence, offline evaluator and in-process
calibration exist; `platform-pg` is `not_applicable` for the requested
runtime identity.
- `T06` is in progress: the characterization evaluator is calibrated
in-process; `shared-substrate` is pending a live window and ceiling.
- `T07` is complete: the `-03` sanitized pass was delivered to `risk-nexus`
as `40e3f825-fc70-4091-96d2-9ab01d42184a`.
- `T08` is the governed test plane contract. Cluster provisioning is outside
this repository.
- `-03` is terminal. A later live run needs a new engagement ID, plane
admission, and approvals. `flex-auth` and P1/P2 remain unrun.
- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005`. Residual live
evidence is owned by `WHITEHAT-WP-0006` and is blocked on authorization.
- `WHITEHAT-WP-0001` T01–T08 are complete for every applicable target.
`audit-core` has dated E2 pass `WH-ENG-20260822-AUDIT-E2-03`.
`tenant-engine` E2 and `platform-pg` E3 stay `not_applicable`. `flex-auth`
E2 and `shared-substrate` P1/P2 stay `pending`. Offline E2, E3 and P1/P2
harnesses fail known-bad and pass known-good in-process.
- `-01`, `-02` and `-03` are terminal. A later live run needs a new
engagement ID, plane admission, and the approvals required by the rules of
engagement. `WHITEHAT-WP-0006` owns that work and authorizes no packet.
## Relationships
@ -103,4 +90,6 @@ boundary always holds.
2. Read [the rules of engagement](docs/rules-of-engagement.md) before any probe
design or execution.
3. Read [`WHITEHAT-WP-0001`](workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md)
for active tasks and sequencing.
for the finished applicable-target artifacts, then
[`WHITEHAT-WP-0006`](workplans/WHITEHAT-WP-0006-authorized-live-residuals.md)
for unauthorized live residuals.