Propose WH-ENG-20260822-AUDIT-E2-01 without authorizing traffic
Align plane ordering with Mason's apply, record the fresh audit-core engagement as proposed, and keep offline admission fail-closed until operator approval and owner acknowledgement exist. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
parent
7e83a66573
commit
5082f86c61
12 changed files with 176 additions and 19 deletions
68
engagements/2026-08-22-audit-core-e2.json
Normal file
68
engagements/2026-08-22-audit-core-e2.json
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
{
|
||||
"engagement_id": "WH-ENG-20260822-AUDIT-E2-01",
|
||||
"status": "proposed",
|
||||
"proposal_at": "2026-08-22T09:44:00Z",
|
||||
"proposal_reason": "Fresh live-e2 proposal after foundational plane apply. Operator approval and target-owner acknowledgement are pending. Zero target requests. Do not reuse WH-ENG-20260821-AUDIT-E2.",
|
||||
"authorization_id": "pending-operator-approval",
|
||||
"authorizer": null,
|
||||
"approved_at": null,
|
||||
"expires_at": "2026-08-22T18:15:00Z",
|
||||
"target": "http://audit-core.audit-core.svc.cluster.local:8080",
|
||||
"target_id": "audit-core",
|
||||
"target_owner": "audit-core / infrastructure operator",
|
||||
"target_owner_acknowledged_at": null,
|
||||
"target_owner_acknowledgement_status": "pending",
|
||||
"environment": "production",
|
||||
"production_approval": null,
|
||||
"approval_class": "live-e2",
|
||||
"plane_namespace": "whitehat",
|
||||
"runner_image_digest": "sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",
|
||||
"namespace": "whitehat",
|
||||
"source": "dedicated pod whitehat/whitehat-e2-audit, labels whitehat.security/plane=true, whitehat.security/target=audit-core, whitehat.security/engagement=WH-ENG-20260822-AUDIT-E2-01, serviceAccount whitehat-runner, automountServiceAccountToken=false",
|
||||
"source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",
|
||||
"control_plane_scope": [
|
||||
"GET apps/v1 deployment audit-core/audit-core for target revision only",
|
||||
"GET v1 service audit-core/audit-core for target identity only",
|
||||
"CREATE/GET/EXEC/DELETE v1 pod whitehat/whitehat-e2-audit only; EXEC may stream runners/audit_core_e2.py to python3 stdin and invoke no other program",
|
||||
"mount but never GET v1 secret whitehat/whitehat-e2-audit-credentials provisioned by the custody owner",
|
||||
"GET pod log whitehat/whitehat-e2-audit only"
|
||||
],
|
||||
"routes": [
|
||||
"GET /readyz",
|
||||
"POST /v1/events",
|
||||
"GET /v1/events/{event_id}",
|
||||
"GET /v1/events?correlation_id={correlation_id}"
|
||||
],
|
||||
"fixture_ids": [
|
||||
"tenant:trial:whitehat-a-20260822", "tenant:trial:whitehat-b-20260822",
|
||||
"whitehat-e2-event-a-20260822", "whitehat-e2-event-b-20260822",
|
||||
"whitehat-e2-absent-20260822", "whitehat-e2-correlation-20260822"
|
||||
],
|
||||
"credential_lane": "audit-core sender registry through its sanctioned custody owner; no credential value retained",
|
||||
"credential_role": "two temporary ordinary tenant-scoped may_read/may_write fixture senders bound to source=whitehat-security",
|
||||
"credential_max_ttl_seconds": 900,
|
||||
"techniques": ["e2-differential"],
|
||||
"prohibited_techniques": [
|
||||
"discovery", "direct-database-access", "saturation", "large-payload",
|
||||
"real-data-collection", "adjacent-service-follow-up",
|
||||
"any control-plane operation outside control_plane_scope"
|
||||
],
|
||||
"rate_limit_per_minute": 10,
|
||||
"max_concurrency": 1,
|
||||
"maximum_requests": 30,
|
||||
"window_start": "2026-08-22T18:00:00Z",
|
||||
"window_end": "2026-08-22T18:15:00Z",
|
||||
"operator_contact": "repository operator in coordinating session",
|
||||
"abort_contact": "repository operator in coordinating session",
|
||||
"abort_thresholds": {
|
||||
"p95_latency_ms": 500,
|
||||
"probe_attributable_5xx": 1,
|
||||
"unexpected_or_non_fixture_data": 1,
|
||||
"missing_attribution": 1
|
||||
},
|
||||
"posture_claim": "implemented E2; currently evidenced E1",
|
||||
"attacker_model": "E2-authenticated-tenant-a",
|
||||
"finding_destination": "risk-nexus",
|
||||
"plane_bundle_digest": "9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035",
|
||||
"target_ingress": "audit-core-whitehat-ingress at audit-core 5b5196e; namespace=whitehat AND whitehat.security/plane=true AND whitehat.security/target=audit-core"
|
||||
}
|
||||
28
engagements/2026-08-22-audit-core-e2.md
Normal file
28
engagements/2026-08-22-audit-core-e2.md
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
# WH-ENG-20260822-AUDIT-E2-01 — proposal
|
||||
|
||||
Status: **proposed**. This is not operator approval, not target-owner
|
||||
acknowledgement, and not authorization to send a packet.
|
||||
|
||||
Reserved by audit-core in `c45151e1-df1a-4306-a70a-83be7875f01c` after Mason
|
||||
applied the foundational plane (`c26a6e5`). The cancelled ID
|
||||
`WH-ENG-20260821-AUDIT-E2` remains terminal.
|
||||
|
||||
| Field | Proposed value |
|
||||
| --- | --- |
|
||||
| Target | `audit-core.audit-core.svc.cluster.local:8080` |
|
||||
| Registration | `targets/audit-core-e2.json` (`applicable`, `live-e2`) |
|
||||
| Source | pod `whitehat/whitehat-e2-audit` with plane and target labels, SA `whitehat-runner`, no token |
|
||||
| Image pin | `forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10` |
|
||||
| Identities | two ordinary tenant-scoped `may_read`/`may_write` senders, `source=whitehat-security`, TTL ≤ 900s, mount-only |
|
||||
| Routes | `GET /readyz`, `POST /v1/events`, `GET /v1/events/{event_id}`, `GET /v1/events?correlation_id=` |
|
||||
| Ceiling | concurrency 1; 10/min; at most 30 requests |
|
||||
| Window | 2026-08-22T18:00:00Z–18:15:00Z (refresh at approval if stale) |
|
||||
| Cleanup | revoke both leases; delete only named synthetic fixtures; prove cleanup |
|
||||
| Reporting | `risk-nexus`, no severity |
|
||||
|
||||
Offline preflight (`validate-engagement`, `admit-plane`) must fail closed while
|
||||
`status` is `proposed` and the live custody broker is unconnected. That
|
||||
failure is the expected result, not a pass.
|
||||
|
||||
Do not apply `plane/runner-pod.yaml` against this ID until approval,
|
||||
acknowledgement, and projected identities exist.
|
||||
|
|
@ -1,6 +1,8 @@
|
|||
# Plane provision request — not an engagement
|
||||
|
||||
Status: **coordination only; apply nothing from this repository**
|
||||
Status: **foundational plane applied by ops-mason 2026-08-22** (`c26a6e5`).
|
||||
This repository still applies nothing. Next: proposed engagement
|
||||
`WH-ENG-20260822-AUDIT-E2-01`, not a runner or credential.
|
||||
|
||||
`WHITEHAT-WP-0001-T08` encoded the governed test plane as a contract. Live E2
|
||||
still needs the cluster objects. This note asks `ops-mason` to provision the
|
||||
|
|
|
|||
|
|
@ -14,3 +14,7 @@ from `whitehat admit-plane`. `WH-ENG-20260821-AUDIT-E2` and
|
|||
`WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod
|
||||
manifest under `runtime/` is bound to a cancelled ID and must not be applied.
|
||||
|
||||
`WH-ENG-20260822-AUDIT-E2-01` is **proposed**. Offline validation must fail
|
||||
closed until operator approval and target-owner acknowledgement are recorded
|
||||
and the custody broker is connected.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue