coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit live E2 from a value-safe custody receipt

Browse source 
WH-ENG-20260822-AUDIT-E2-02 projected and then aborted: admit-plane had no
receipt adapter, so the runner sent zero packets. Consume custody receipts
as handles only, keep unconnected admission fail-closed, and retire -02.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 21:31:49 +02:00
parent b6c1806680
commit 45548e44a2
14 changed files with 221 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/operator-runbook.md
View file

@ -50,7 +50,7 @@ retired.
```sh
PYTHONPATH=src python3 -m whitehat_security.cli validate-engagement engagements/<record>.json
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json --receipt <custody-receipt.json>
```
7. Confirm target identity/revision and probe attribution before the first

19
docs/test-plane.md
View file

@ -16,10 +16,10 @@ A live E2 run is admitted only when every item below is true:
5. The runner namespace is `whitehat`, the image digest is pinned, and
engagement labels are present. Live E3 also names a `database`. Live
capacity also names an `aggressor_ceiling`.
6. The custody broker projected the registered number of identity *handles*
(two for E2, one runtime for E3, none for capacity fixtures). Credential
values are not returned to the operator or agent. Live classes fail closed
while the custody broker is unconnected.
6. A value-safe custody **receipt** is supplied to `admit-plane --receipt`.
The receipt names handles, mount keys, expiry and `secret_values_observed:
false`. It must not contain token values. Without a receipt, live admission
fails closed and requests no credential.
7. The kill switch is clear.
8. The rate watcher is attached. Cleanup revokes the lease.
@ -38,7 +38,7 @@ requested.
```sh
PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json --receipt <custody-receipt.json>
PYTHONPATH=src python3 -m whitehat_security.cli kill-switch
PYTHONPATH=src python3 -m whitehat_security.cli deliver evidence/<run>.json --outbox outbox
```
@ -47,7 +47,8 @@ Create `plane/KILL` to abort independently of the runner process.
## Retired identifiers
`WH-ENG-20260821-AUDIT-E2`, `WH-ENG-20260821-TENANT-E2`, and
`WH-ENG-20260822-AUDIT-E2-01` are terminal. The last of those expired at
18:15Z with no projection-ready notice and zero packets. A later live E2 run
needs a new ID, a new window, and a fresh attended projection.
`WH-ENG-20260821-AUDIT-E2`, `WH-ENG-20260821-TENANT-E2`,
`WH-ENG-20260822-AUDIT-E2-01`, and `WH-ENG-20260822-AUDIT-E2-02` are terminal.
`-02` projected and then aborted: admission had no receipt adapter, so the
runner sent zero packets. A later live E2 run needs a new ID, a new window,
a custody receipt, and `admit-plane --receipt`.