diff --git a/SCOPE.md b/SCOPE.md index 43c65ce..01d68fd 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -72,8 +72,8 @@ boundary always holds. - `T03` is in progress: the differential core, audit-core adapter and test plane admission exist. `tenant-engine` is registered `not_applicable` for E2. The foundational plane is applied. `WH-ENG-20260822-AUDIT-E2-01` is - proposed; live audit-core still needs approval, owner acknowledgement and - a connected custody broker. + operator-approved and awaits target-owner acknowledgement and a connected + custody broker. - `T04` is complete for every applicable E2 probe: generic and audit-core shaped fixtures fail known-bad and pass known-good in-process. - `T05` is in progress: 24-hour cadence, offline evaluator and in-process diff --git a/docs/operator-runbook.md b/docs/operator-runbook.md index da46838..000bdf4 100644 --- a/docs/operator-runbook.md +++ b/docs/operator-runbook.md @@ -28,8 +28,9 @@ PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets PYTHONPATH=src python3 -m whitehat_security.cli kill-switch ``` -`admit-plane` must succeed against a **new, approved** engagement ID. A -`proposed` record fails closed. The default live broker is unconnected and +`admit-plane` must succeed against a **new, approved and owner-acknowledged** +engagement ID. A `proposed` record and a record with pending target-owner +acknowledgement fail closed. The default live broker is unconnected and fails closed without requesting a credential. Create `plane/KILL` to abort independently of the runner. diff --git a/docs/test-plane.md b/docs/test-plane.md index a3ff5c9..bb9bf33 100644 --- a/docs/test-plane.md +++ b/docs/test-plane.md @@ -48,6 +48,6 @@ Create `plane/KILL` to abort independently of the runner process. ## Retired identifiers `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. The -foundational plane is provisioned first. `WH-ENG-20260822-AUDIT-E2-01` is the -next live-e2 **proposal**; it stays `proposed` until operator approval and -owner acknowledgement exist. The live custody broker remains unconnected. +foundational plane is provisioned first. `WH-ENG-20260822-AUDIT-E2-01` is +operator-approved and awaits target-owner acknowledgement. The live custody +broker remains unconnected. diff --git a/engagements/2026-08-22-audit-core-e2.json b/engagements/2026-08-22-audit-core-e2.json index f95edfb..c3de190 100644 --- a/engagements/2026-08-22-audit-core-e2.json +++ b/engagements/2026-08-22-audit-core-e2.json @@ -1,19 +1,19 @@ { "engagement_id": "WH-ENG-20260822-AUDIT-E2-01", - "status": "proposed", + "status": "awaiting-owner-acknowledgement", "proposal_at": "2026-08-22T09:44:00Z", - "proposal_reason": "Fresh live-e2 proposal after foundational plane apply. Operator approval and target-owner acknowledgement are pending. Zero target requests. Do not reuse WH-ENG-20260821-AUDIT-E2.", - "authorization_id": "pending-operator-approval", - "authorizer": null, - "approved_at": null, + "proposal_reason": "Fresh live-e2 proposal after foundational plane apply. Do not reuse WH-ENG-20260821-AUDIT-E2.", + "authorization_id": "operator-session-2026-08-22-e2-approval", + "authorizer": "repository operator and infrastructure owner", + "approved_at": "2026-08-22T09:52:55Z", "expires_at": "2026-08-22T18:15:00Z", "target": "http://audit-core.audit-core.svc.cluster.local:8080", "target_id": "audit-core", "target_owner": "audit-core / infrastructure operator", "target_owner_acknowledged_at": null, - "target_owner_acknowledgement_status": "pending", + "target_owner_acknowledgement_status": "pending; operator approved 2026-08-22T09:52:55Z", "environment": "production", - "production_approval": null, + "production_approval": "Explicit operator approval of WH-ENG-20260822-AUDIT-E2-01 in the coordinating session on 2026-08-22", "approval_class": "live-e2", "plane_namespace": "whitehat", "runner_image_digest": "sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10", diff --git a/engagements/2026-08-22-audit-core-e2.md b/engagements/2026-08-22-audit-core-e2.md index 992f16a..025dc7a 100644 --- a/engagements/2026-08-22-audit-core-e2.md +++ b/engagements/2026-08-22-audit-core-e2.md @@ -1,13 +1,13 @@ -# WH-ENG-20260822-AUDIT-E2-01 — proposal +# WH-ENG-20260822-AUDIT-E2-01 -Status: **proposed**. This is not operator approval, not target-owner -acknowledgement, and not authorization to send a packet. +Status: **operator-approved, awaiting target-owner acknowledgement**. +This is not yet authorization to send a packet or project credentials. -Reserved by audit-core in `c45151e1-df1a-4306-a70a-83be7875f01c` after Mason -applied the foundational plane (`c26a6e5`). The cancelled ID -`WH-ENG-20260821-AUDIT-E2` remains terminal. +Operator approved `2026-08-22T09:52:55Z` in the coordinating session +(`operator-session-2026-08-22-e2-approval`). Audit-core acknowledgement is +still pending. The cancelled ID `WH-ENG-20260821-AUDIT-E2` remains terminal. -| Field | Proposed value | +| Field | Value | | --- | --- | | Target | `audit-core.audit-core.svc.cluster.local:8080` | | Registration | `targets/audit-core-e2.json` (`applicable`, `live-e2`) | @@ -16,13 +16,11 @@ applied the foundational plane (`c26a6e5`). The cancelled ID | Identities | two ordinary tenant-scoped `may_read`/`may_write` senders, `source=whitehat-security`, TTL ≤ 900s, mount-only | | Routes | `GET /readyz`, `POST /v1/events`, `GET /v1/events/{event_id}`, `GET /v1/events?correlation_id=` | | Ceiling | concurrency 1; 10/min; at most 30 requests | -| Window | 2026-08-22T18:00:00Z–18:15:00Z (refresh at approval if stale) | +| Window | 2026-08-22T18:00:00Z–18:15:00Z | | Cleanup | revoke both leases; delete only named synthetic fixtures; prove cleanup | | Reporting | `risk-nexus`, no severity | -Offline preflight (`validate-engagement`, `admit-plane`) must fail closed while -`status` is `proposed` and the live custody broker is unconnected. That -failure is the expected result, not a pass. - -Do not apply `plane/runner-pod.yaml` against this ID until approval, -acknowledgement, and projected identities exist. +Offline preflight must fail closed until `target_owner_acknowledged_at` is +set. After acknowledgement, the live custody broker is still unconnected and +must fail closed until two identities are projected. Do not apply +`plane/runner-pod.yaml` before that. diff --git a/engagements/2026-08-22-plane-provision.md b/engagements/2026-08-22-plane-provision.md index f4d190e..a10e5d5 100644 --- a/engagements/2026-08-22-plane-provision.md +++ b/engagements/2026-08-22-plane-provision.md @@ -1,8 +1,9 @@ # Plane provision request — not an engagement Status: **foundational plane applied by ops-mason 2026-08-22** (`c26a6e5`). -This repository still applies nothing. Next: proposed engagement -`WH-ENG-20260822-AUDIT-E2-01`, not a runner or credential. +This repository still applies nothing. `WH-ENG-20260822-AUDIT-E2-01` is +operator-approved and awaits target-owner acknowledgement. Do not apply a +runner or credential until that acknowledgement exists. `WHITEHAT-WP-0001-T08` encoded the governed test plane as a contract. Live E2 still needs the cluster objects. This note asks `ops-mason` to provision the diff --git a/engagements/README.md b/engagements/README.md index 0e099cc..826dcf2 100644 --- a/engagements/README.md +++ b/engagements/README.md @@ -14,7 +14,7 @@ from `whitehat admit-plane`. `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod manifest under `runtime/` is bound to a cancelled ID and must not be applied. -`WH-ENG-20260822-AUDIT-E2-01` is **proposed**. Offline validation must fail -closed until operator approval and target-owner acknowledgement are recorded -and the custody broker is connected. +`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and **awaiting +target-owner acknowledgement**. Offline validation must fail closed until +that acknowledgement is recorded and the custody broker is connected. diff --git a/plane/README.md b/plane/README.md index 117f7c1..618cec2 100644 --- a/plane/README.md +++ b/plane/README.md @@ -11,7 +11,7 @@ packets. `ops-mason` provisions the foundational plane from these files audit-core egress NetworkPolicy, ServiceAccount `whitehat-runner` with `automountServiceAccountToken: false`. 2. A **new** unretired engagement proposal (`status: proposed`). -3. Operator approval and target-owner acknowledgement. +3. Operator approval, then target-owner acknowledgement. 4. Custody projection of two short-lived identities into the runner mount. 5. `whitehat admit-plane`, then a runner pod. Not before. diff --git a/tests/test_cli.py b/tests/test_cli.py index dc321a6..c9c86d5 100644 --- a/tests/test_cli.py +++ b/tests/test_cli.py @@ -24,16 +24,16 @@ def test_kill_switch_is_clear_by_default(capsys): assert capsys.readouterr().out.strip() == "clear" -def test_validate_engagement_refuses_proposed_record(capsys): +def test_validate_engagement_refuses_unacknowledged_record(capsys): with pytest.raises(SystemExit) as stopped: main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"]) assert stopped.value.code == 2 err = capsys.readouterr().err assert err.startswith("not authorized:") - assert "proposed" in err + assert "acknowledgement is pending" in err -def test_admit_plane_refuses_proposed_record(capsys): +def test_admit_plane_refuses_unacknowledged_record(capsys): with pytest.raises(SystemExit) as stopped: main([ "admit-plane", @@ -43,7 +43,7 @@ def test_admit_plane_refuses_proposed_record(capsys): assert stopped.value.code == 2 err = capsys.readouterr().err assert "not authorized:" in err - assert "proposed" in err + assert "acknowledgement is pending" in err def test_admit_plane_refuses_cancelled_engagement(capsys): diff --git a/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md b/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md index 518726a..86eb790 100644 --- a/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md +++ b/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md @@ -159,10 +159,10 @@ artifact, not a deferral); `flex-auth` is pending. The 2026-08-21 production engagement IDs were cancelled without sending a target request and are retired. ops-mason applied the foundational plane on -2026-08-22. `WH-ENG-20260822-AUDIT-E2-01` is a **proposed** live-e2 record -for audit-core: operator approval, owner acknowledgement and the custody -broker remain pending. Offline preflight must fail closed. Whitehat will not -relabel tenant-engine to finish this task. +2026-08-22. The operator approved `WH-ENG-20260822-AUDIT-E2-01` at +2026-08-22T09:52:55Z. Target-owner acknowledgement and the custody broker +remain pending. Offline preflight must fail closed until both exist. Whitehat +will not relabel tenant-engine to finish this task. ### T04 — Prove the probes fail