coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record operator approval of WH-ENG-20260822-AUDIT-E2-01

Browse source 
Owner acknowledgement remains pending. Offline admission stays fail-closed.
No credentials requested and no packets sent.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 11:54:09 +02:00
parent 5082f86c61
commit 461554a749
10 changed files with 42 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

4
SCOPE.md
View file

@ -72,8 +72,8 @@ boundary always holds.
- `T03` is in progress: the differential core, audit-core adapter and test - `T03` is in progress: the differential core, audit-core adapter and test
plane admission exist. `tenant-engine` is registered `not_applicable` for plane admission exist. `tenant-engine` is registered `not_applicable` for
E2. The foundational plane is applied. `WH-ENG-20260822-AUDIT-E2-01` is E2. The foundational plane is applied. `WH-ENG-20260822-AUDIT-E2-01` is
proposed; live audit-core still needs approval, owner acknowledgement and operator-approved and awaits target-owner acknowledgement and a connected
a connected custody broker. custody broker.
- `T04` is complete for every applicable E2 probe: generic and audit-core - `T04` is complete for every applicable E2 probe: generic and audit-core
shaped fixtures fail known-bad and pass known-good in-process. shaped fixtures fail known-bad and pass known-good in-process.
- `T05` is in progress: 24-hour cadence, offline evaluator and in-process - `T05` is in progress: 24-hour cadence, offline evaluator and in-process

5
docs/operator-runbook.md
View file

@ -28,8 +28,9 @@ PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets
PYTHONPATH=src python3 -m whitehat_security.cli kill-switch PYTHONPATH=src python3 -m whitehat_security.cli kill-switch
``` ```
`admit-plane` must succeed against a **new, approved** engagement ID. A `admit-plane` must succeed against a **new, approved and owner-acknowledged**
`proposed` record fails closed. The default live broker is unconnected and engagement ID. A `proposed` record and a record with pending target-owner
acknowledgement fail closed. The default live broker is unconnected and
fails closed without requesting a credential. fails closed without requesting a credential.
Create `plane/KILL` to abort independently of the runner. Create `plane/KILL` to abort independently of the runner.

6
docs/test-plane.md
View file

@ -48,6 +48,6 @@ Create `plane/KILL` to abort independently of the runner process.
## Retired identifiers ## Retired identifiers
`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. The `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. The
foundational plane is provisioned first. `WH-ENG-20260822-AUDIT-E2-01` is the foundational plane is provisioned first. `WH-ENG-20260822-AUDIT-E2-01` is
next live-e2 **proposal**; it stays `proposed` until operator approval and operator-approved and awaits target-owner acknowledgement. The live custody
owner acknowledgement exist. The live custody broker remains unconnected. broker remains unconnected.

14
engagements/2026-08-22-audit-core-e2.json
View file

@ -1,19 +1,19 @@
{ {
"engagement_id": "WH-ENG-20260822-AUDIT-E2-01", "engagement_id": "WH-ENG-20260822-AUDIT-E2-01",
"status": "proposed", "status": "awaiting-owner-acknowledgement",
"proposal_at": "2026-08-22T09:44:00Z", "proposal_at": "2026-08-22T09:44:00Z",
"proposal_reason": "Fresh live-e2 proposal after foundational plane apply. Operator approval and target-owner acknowledgement are pending. Zero target requests. Do not reuse WH-ENG-20260821-AUDIT-E2.", "proposal_reason": "Fresh live-e2 proposal after foundational plane apply. Do not reuse WH-ENG-20260821-AUDIT-E2.",
"authorization_id": "pending-operator-approval", "authorization_id": "operator-session-2026-08-22-e2-approval",
"authorizer": null, "authorizer": "repository operator and infrastructure owner",
"approved_at": null, "approved_at": "2026-08-22T09:52:55Z",
"expires_at": "2026-08-22T18:15:00Z", "expires_at": "2026-08-22T18:15:00Z",
"target": "http://audit-core.audit-core.svc.cluster.local:8080", "target": "http://audit-core.audit-core.svc.cluster.local:8080",
"target_id": "audit-core", "target_id": "audit-core",
"target_owner": "audit-core / infrastructure operator", "target_owner": "audit-core / infrastructure operator",
"target_owner_acknowledged_at": null, "target_owner_acknowledged_at": null,
"target_owner_acknowledgement_status": "pending", "target_owner_acknowledgement_status": "pending; operator approved 2026-08-22T09:52:55Z",
"environment": "production", "environment": "production",
"production_approval": null, "production_approval": "Explicit operator approval of WH-ENG-20260822-AUDIT-E2-01 in the coordinating session on 2026-08-22",
"approval_class": "live-e2", "approval_class": "live-e2",
"plane_namespace": "whitehat", "plane_namespace": "whitehat",
"runner_image_digest": "sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10", "runner_image_digest": "sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",

26
engagements/2026-08-22-audit-core-e2.md
View file

@ -1,13 +1,13 @@
# WH-ENG-20260822-AUDIT-E2-01 — proposal # WH-ENG-20260822-AUDIT-E2-01
Status: **proposed**. This is not operator approval, not target-owner Status: **operator-approved, awaiting target-owner acknowledgement**.
acknowledgement, and not authorization to send a packet. This is not yet authorization to send a packet or project credentials.
Reserved by audit-core in `c45151e1-df1a-4306-a70a-83be7875f01c` after Mason Operator approved `2026-08-22T09:52:55Z` in the coordinating session
applied the foundational plane (`c26a6e5`). The cancelled ID (`operator-session-2026-08-22-e2-approval`). Audit-core acknowledgement is
`WH-ENG-20260821-AUDIT-E2` remains terminal. still pending. The cancelled ID `WH-ENG-20260821-AUDIT-E2` remains terminal.
| Field | Proposed value | | Field | Value |
| --- | --- | | --- | --- |
| Target | `audit-core.audit-core.svc.cluster.local:8080` | | Target | `audit-core.audit-core.svc.cluster.local:8080` |
| Registration | `targets/audit-core-e2.json` (`applicable`, `live-e2`) | | Registration | `targets/audit-core-e2.json` (`applicable`, `live-e2`) |
@ -16,13 +16,11 @@ applied the foundational plane (`c26a6e5`). The cancelled ID
| Identities | two ordinary tenant-scoped `may_read`/`may_write` senders, `source=whitehat-security`, TTL ≤ 900s, mount-only | | Identities | two ordinary tenant-scoped `may_read`/`may_write` senders, `source=whitehat-security`, TTL ≤ 900s, mount-only |
| Routes | `GET /readyz`, `POST /v1/events`, `GET /v1/events/{event_id}`, `GET /v1/events?correlation_id=` | | Routes | `GET /readyz`, `POST /v1/events`, `GET /v1/events/{event_id}`, `GET /v1/events?correlation_id=` |
| Ceiling | concurrency 1; 10/min; at most 30 requests | | Ceiling | concurrency 1; 10/min; at most 30 requests |
| Window | 2026-08-22T18:00:00Z–18:15:00Z (refresh at approval if stale) | | Window | 2026-08-22T18:00:00Z–18:15:00Z |
| Cleanup | revoke both leases; delete only named synthetic fixtures; prove cleanup | | Cleanup | revoke both leases; delete only named synthetic fixtures; prove cleanup |
| Reporting | `risk-nexus`, no severity | | Reporting | `risk-nexus`, no severity |
Offline preflight (`validate-engagement`, `admit-plane`) must fail closed while Offline preflight must fail closed until `target_owner_acknowledged_at` is
`status` is `proposed` and the live custody broker is unconnected. That set. After acknowledgement, the live custody broker is still unconnected and
failure is the expected result, not a pass. must fail closed until two identities are projected. Do not apply
`plane/runner-pod.yaml` before that.
Do not apply `plane/runner-pod.yaml` against this ID until approval,
acknowledgement, and projected identities exist.

5
engagements/2026-08-22-plane-provision.md
View file

@ -1,8 +1,9 @@
# Plane provision request — not an engagement # Plane provision request — not an engagement
Status: **foundational plane applied by ops-mason 2026-08-22** (`c26a6e5`). Status: **foundational plane applied by ops-mason 2026-08-22** (`c26a6e5`).
This repository still applies nothing. Next: proposed engagement This repository still applies nothing. `WH-ENG-20260822-AUDIT-E2-01` is
`WH-ENG-20260822-AUDIT-E2-01`, not a runner or credential. operator-approved and awaits target-owner acknowledgement. Do not apply a
runner or credential until that acknowledgement exists.
`WHITEHAT-WP-0001-T08` encoded the governed test plane as a contract. Live E2 `WHITEHAT-WP-0001-T08` encoded the governed test plane as a contract. Live E2
still needs the cluster objects. This note asks `ops-mason` to provision the still needs the cluster objects. This note asks `ops-mason` to provision the

6
engagements/README.md
View file

@ -14,7 +14,7 @@ from `whitehat admit-plane`. `WH-ENG-20260821-AUDIT-E2` and
`WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod `WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod
manifest under `runtime/` is bound to a cancelled ID and must not be applied. manifest under `runtime/` is bound to a cancelled ID and must not be applied.
`WH-ENG-20260822-AUDIT-E2-01` is **proposed**. Offline validation must fail `WH-ENG-20260822-AUDIT-E2-01` is operator-approved and **awaiting
closed until operator approval and target-owner acknowledgement are recorded target-owner acknowledgement**. Offline validation must fail closed until
and the custody broker is connected. that acknowledgement is recorded and the custody broker is connected.

2
plane/README.md
View file

@ -11,7 +11,7 @@ packets. `ops-mason` provisions the foundational plane from these files
audit-core egress NetworkPolicy, ServiceAccount `whitehat-runner` with audit-core egress NetworkPolicy, ServiceAccount `whitehat-runner` with
`automountServiceAccountToken: false`. `automountServiceAccountToken: false`.
2. A **new** unretired engagement proposal (`status: proposed`). 2. A **new** unretired engagement proposal (`status: proposed`).
3. Operator approval and target-owner acknowledgement. 3. Operator approval, then target-owner acknowledgement.
4. Custody projection of two short-lived identities into the runner mount. 4. Custody projection of two short-lived identities into the runner mount.
5. `whitehat admit-plane`, then a runner pod. Not before. 5. `whitehat admit-plane`, then a runner pod. Not before.

8
tests/test_cli.py
View file

@ -24,16 +24,16 @@ def test_kill_switch_is_clear_by_default(capsys):
assert capsys.readouterr().out.strip() == "clear" assert capsys.readouterr().out.strip() == "clear"
def test_validate_engagement_refuses_proposed_record(capsys): def test_validate_engagement_refuses_unacknowledged_record(capsys):
with pytest.raises(SystemExit) as stopped: with pytest.raises(SystemExit) as stopped:
main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"]) main(["validate-engagement", "engagements/2026-08-22-audit-core-e2.json"])
assert stopped.value.code == 2 assert stopped.value.code == 2
err = capsys.readouterr().err err = capsys.readouterr().err
assert err.startswith("not authorized:") assert err.startswith("not authorized:")
assert "proposed" in err assert "acknowledgement is pending" in err
def test_admit_plane_refuses_proposed_record(capsys): def test_admit_plane_refuses_unacknowledged_record(capsys):
with pytest.raises(SystemExit) as stopped: with pytest.raises(SystemExit) as stopped:
main([ main([
"admit-plane", "admit-plane",
@ -43,7 +43,7 @@ def test_admit_plane_refuses_proposed_record(capsys):
assert stopped.value.code == 2 assert stopped.value.code == 2
err = capsys.readouterr().err err = capsys.readouterr().err
assert "not authorized:" in err assert "not authorized:" in err
assert "proposed" in err assert "acknowledgement is pending" in err
def test_admit_plane_refuses_cancelled_engagement(capsys): def test_admit_plane_refuses_cancelled_engagement(capsys):

8
workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md
View file

@ -159,10 +159,10 @@ artifact, not a deferral); `flex-auth` is pending.
The 2026-08-21 production engagement IDs were cancelled without sending a The 2026-08-21 production engagement IDs were cancelled without sending a
target request and are retired. ops-mason applied the foundational plane on target request and are retired. ops-mason applied the foundational plane on
2026-08-22. `WH-ENG-20260822-AUDIT-E2-01` is a **proposed** live-e2 record 2026-08-22. The operator approved `WH-ENG-20260822-AUDIT-E2-01` at
for audit-core: operator approval, owner acknowledgement and the custody 2026-08-22T09:52:55Z. Target-owner acknowledgement and the custody broker
broker remain pending. Offline preflight must fail closed. Whitehat will not remain pending. Offline preflight must fail closed until both exist. Whitehat
relabel tenant-engine to finish this task. will not relabel tenant-engine to finish this task.
### T04 — Prove the probes fail ### T04 — Prove the probes fail