coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit live E2 from a value-safe custody receipt

Browse source 
WH-ENG-20260822-AUDIT-E2-02 projected and then aborted: admit-plane had no
receipt adapter, so the runner sent zero packets. Consume custody receipts
as handles only, keep unconnected admission fail-closed, and retire -02.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 21:31:49 +02:00
parent b6c1806680
commit 45548e44a2
14 changed files with 221 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

18
tests/test_engagement.py
View file

@ -1,5 +1,6 @@
import json
from datetime import UTC, datetime
from pathlib import Path
import pytest
@ -63,8 +64,13 @@ def test_pending_owner_acknowledgement_fails_closed(tmp_path):
load(tmp_path, data)
def test_retry_record_is_authorized_only_inside_its_window():
path = "engagements/2026-08-22-audit-core-e2-02.json"
def test_retry_record_is_authorized_only_inside_its_window(tmp_path):
data = json.loads(Path("engagements/2026-08-22-audit-core-e2-02.json").read_text())
data["status"] = "approved"
data.pop("aborted_at", None)
data.pop("abort_reason", None)
path = tmp_path / "retry.json"
path.write_text(json.dumps(data), encoding="utf-8")
with pytest.raises(AuthorizationError, match="has not started"):
Engagement.load(path, now=datetime(2026, 8, 22, 19, 14, tzinfo=UTC))
engagement = Engagement.load(path, now=datetime(2026, 8, 22, 19, 15, tzinfo=UTC))
@ -73,6 +79,14 @@ def test_retry_record_is_authorized_only_inside_its_window():
Engagement.load(path, now=datetime(2026, 8, 22, 19, 31, tzinfo=UTC))
def test_aborted_record_fails_closed():
with pytest.raises(AuthorizationError, match="aborted"):
Engagement.load(
"engagements/2026-08-22-audit-core-e2-02.json",
now=datetime(2026, 8, 22, 19, 20, tzinfo=UTC),
)
def test_elapsed_record_fails_closed_even_inside_old_window(tmp_path):
data = record()
data["status"] = "expired"