coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish WHITEHAT-WP-0001 and own live residuals in WP-0006

Browse source 
Close T05 and T06 on the same applicable-target rule as T03: E3 cadence
and in-process calibration, platform-pg not_applicable, P1/P2 evaluator
proven against known-good and known-bad samples. Persist offline capacity
calibration. Live E3, P1/P2, flex-auth E2, and a later audit-core run
move to WHITEHAT-WP-0006, which authorizes no packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
This commit is contained in:
tegwick 2026-09-01 20:26:47 +02:00
parent 69e03efd7f
commit 43327183d8
13 changed files with 355 additions and 73 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/e3-cadence.md
View file

@ -20,6 +20,9 @@ PYTHONPATH=src python3 -m whitehat_security.cli e3-fixtures
`e3-fixtures` calibrates the seven expected outcomes in-process, including
keeping the SQL-compromise reset as `inconclusive`. It opens no database
connection and is not target assurance.
`evidence/offline-e3-calibration.json` is the fixture artifact. A live
database run is owned by `WHITEHAT-WP-0006` and still requires a runtime-safe
surface, named database, and window.
The run checks the conformance view, unset-GUC reads, wrong-tenant reads and
writes, `BYPASSRLS` on the runtime identity, and unsafe `SECURITY DEFINER`

7
docs/noisy-neighbour-runbook.md
View file

@ -23,5 +23,10 @@ The evaluator is calibrated offline with:
PYTHONPATH=src python3 -m whitehat_security.cli capacity-fixture
```
That command generates no load and is not P1/P2 target evidence.
That command generates no load and is not P1/P2 target evidence. Known-good
binds and stays within ceiling; known-bad detects an unbound governor, an
exceeded ceiling, and a missing neighbour sample.
`evidence/offline-capacity-calibration.json` is the fixture artifact. A live
run is owned by `WHITEHAT-WP-0006` and still requires an operator-approved
window and aggressor ceiling.

5
docs/operator-runbook.md
View file

@ -15,8 +15,9 @@ make fixture-evidence
Success requires every read/write probe to pass against the enforcing fixture
and to produce a finding against the fixture with its tenant predicate removed.
`make fixture-evidence` also writes `evidence/offline-e3-calibration.json`.
Both files are calibration evidence, not target assurance.
`make fixture-evidence` also writes `evidence/offline-e3-calibration.json` and
`evidence/offline-capacity-calibration.json`. Those files are calibration
evidence, not target assurance.
## Test plane