coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Promote ASM T-01–T-10 into WHITEHAT-WP-0007 and triage each test

Browse source 
Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto
E2, E3, or capacity. Register all ten Canon tests as pending with named
blockers, known-bad designs, and result routes. Add a value-safe
conformance-message renderer. Authorizes no probe.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
This commit is contained in:
tegwick 2026-09-02 01:11:16 +02:00
parent 44d6958b71
commit 5384f051d2
24 changed files with 850 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/rules-of-engagement.md
View file

@ -144,13 +144,16 @@ Live runs are admitted only through the test plane documented in
projected short-lived identities, registered target, kill switch, rate watcher
and lease cleanup. The plane is a control, not authorization.
`fixture-e2`, `fixture-e3` and `fixture-capacity` are in-process classes
already permitted by §1. `live-e2` still requires the dated engagement
record, target-owner acknowledgement and technique-specific operator approval
required by §1, plus plane admission. Live `e3` additionally names the
database and uses one ordinary runtime role with no `BYPASSRLS`. Live
`capacity` additionally names an aggressor ceiling and a substrate window.
Recovery and destructive techniques remain outside this plane.
`fixture-e2`, `fixture-e3`, `fixture-capacity` and `fixture-asm` are
in-process classes already permitted by §1 once a registration is
`applicable`. No ASM registration is applicable yet. `live-e2` still requires
the dated engagement record, target-owner acknowledgement and
technique-specific operator approval required by §1, plus plane admission.
Live `e3` additionally names the database and uses one ordinary runtime role
with no `BYPASSRLS`. Live `capacity` additionally names an aggressor ceiling
and a substrate window. Live `asm` additionally names the Canon `test_id` and
component revision. Recovery, archive-disable and other destructive
techniques remain outside this plane.
Cancelled engagement identifiers are terminal and must not be reused.