diff --git a/INTENT.md b/INTENT.md index 6fbd468..802915a 100644 --- a/INTENT.md +++ b/INTENT.md @@ -4,16 +4,15 @@ role: null standard: net-kingdom/canon/standards/security-layer-model companion: net-kingdom/SECURITY-COMPANION.md declared_at: "2026-09-01" -conformance_state: blocked-clean --- # INTENT — whitehat-security > **Layer: Staff.** Offensive validation. This is this repository's own -> declaration under NetKingdom Security Layer Model v0.7 §11. A catalog row, +> declaration under NetKingdom Security Layer Model v0.8 §11. A catalog row, > a review note, or the 2026-08-28 gate-house insert that used to sit here is > not a declaration. The statute is -> `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted). The +> `net-kingdom/canon/standards/security-layer-model_v0.8.md` (accepted). The > operative form is `net-kingdom/SECURITY-COMPANION.md`. > > Offensive validation is interactive and non-deterministic. Acting at runtime diff --git a/SCOPE.md b/SCOPE.md index aad32b4..e5693ea 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -108,7 +108,10 @@ a complete engagement record already exists. No live target is authorized. - Repository status: active. - Layer: Staff (declared in `INTENT.md`, 2026-09-01). `conformance_state` - stays `blocked-clean`. `WHITEHAT-IN-0001` is closed. + stays `blocked-clean` in the dated + [declaration migration evidence](docs/evidence/2026-10-11-layer-declaration-migration.md), + outside declaration frontmatter under GH-DEC-2026-021 §5. + `WHITEHAT-IN-0001` is closed. - The capability statement above is the 2026-10-04 scope assessment. The comparison against `INTENT.md` is [`history/2026-10-04T0649Z-scope-against-intent.md`](history/2026-10-04T0649Z-scope-against-intent.md). diff --git a/docs/evidence/2026-10-11-layer-declaration-migration.md b/docs/evidence/2026-10-11-layer-declaration-migration.md new file mode 100644 index 0000000..0baa452 --- /dev/null +++ b/docs/evidence/2026-10-11-layer-declaration-migration.md @@ -0,0 +1,32 @@ +--- +type: evidence +date: "2026-10-11" +repository: whitehat-security +conformance_state: blocked-clean +source: INTENT.md +ruling: GH-DEC-2026-021 +validated_against: net-kingdom/canon/standards/security-layer-model_v0.8.md +scope: "Declaration frontmatter only; relocation of existing state, no live probing or full conformance determination" +--- + +# Declaration-state relocation + +GH-DEC-2026-021 §5 assigns conformance_state to run/evidence records rather +than the standing layer declaration. Accepted v0.8 source enables this +post-flip GH-WP-0004-T11 migration. The existing blocked-clean value is +preserved here, not upgraded to conformant. Historical workplans and scope +assessments remain unchanged. INTENT's governing statute citation now names +accepted v0.8; declaration keys retain no standard or companion version. + +This migration changes no probe, authorization gate, live target, capability, +or evidence axis. The declared Staff role and offensive-validation remit +remain the repository's own voice. A passing declaration test establishes +this limited structural property; no target isolation is established. + +Verification: all 117 offline tests passed against merged staged source, +with explicit existing SecretsEngine source and Railiance custody schema +paths. Three declaration tests also pass in the narrow staging directory. +The first full copied-tree run failed 19 tests because sibling source/schema +lookup cannot resolve from /tmp; supplying the documented environment +overrides restores the same source dependencies as the authoritative tree. +This was a verification-location failure, not a probe or capability change. diff --git a/docs/evidence/2026-10-11-layer-declaration-tests.log b/docs/evidence/2026-10-11-layer-declaration-tests.log new file mode 100644 index 0000000..3f8fe9a --- /dev/null +++ b/docs/evidence/2026-10-11-layer-declaration-tests.log @@ -0,0 +1,3 @@ +........................................................................ [ 61%] +............................................. [100%] +117 passed in 0.99s diff --git a/tests/test_layer_declaration.py b/tests/test_layer_declaration.py index c0dd53f..0f6ebed 100644 --- a/tests/test_layer_declaration.py +++ b/tests/test_layer_declaration.py @@ -26,7 +26,9 @@ def test_intent_declares_staff_in_own_voice(): layers = [v for k, v in _entries(frontmatter) if k == "layer"] # ASCII case-fold before comparing; nobody re-spells (GH-DEC-2026-017 §2). assert [v.casefold() for v in layers] == ["staff"] - assert "conformance_state: blocked-clean" in frontmatter + assert "conformance_state" not in dict(_entries(frontmatter)) + evidence = Path("docs/evidence/2026-10-11-layer-declaration-migration.md").read_text() + assert "conformance_state: blocked-clean" in evidence assert "gate-house insert that used to sit here is" in text assert "does not author our probes" in text diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md new file mode 100644 index 0000000..11d8206 --- /dev/null +++ b/workplans/ADHOC-2026-10-11.md @@ -0,0 +1,33 @@ +--- +id: WHITEHAT-WP-ADHOC-2026-10-11 +type: workplan +title: "Relocate declaration conformance state after accepted v0.8" +domain: infotech +repo: whitehat-security +status: finished +flavor: implementation +owner: codex +topic_slug: infotech +created: "2026-10-11" +updated: "2026-10-11" +--- + +## Relocate state without changing the security claim + +```task +id: WHITEHAT-WP-ADHOC-2026-10-11-T01 +status: done +priority: medium +``` + +Apply GH-DEC-2026-021 §5 and GateHouse GH-WP-0004-T11: move +conformance_state: blocked-clean out of INTENT declaration into the dated +layer-declaration migration evidence; retain SCOPE's blocked-clean claim +with an explicit evidence link; update the governing prose citation to +accepted v0.8. Declaration regression checks absence of the state key and +preservation of the recorded value. No probe, target or live authority changes. + +Verification: all 117 offline tests passed against the merged staged source +with explicit existing SecretsEngine fixture source and Railiance custody +schema paths. The three declaration tests pass directly against staging. +No network target was contacted.