coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin audit E2 probe source identity

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
This commit is contained in:
tegwick 2026-08-22 00:10:10 +02:00
parent 070c3cdb17
commit 6ba6929b8e
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
engagements/2026-08-21-audit-core-e2.json
View file

@ -11,12 +11,14 @@
"environment": "production",
"production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
"namespace": "audit-core",
"source": "dedicated attributed probe pod in an owner-approved ingress namespace",
"source": "dedicated pod user-engine/whitehat-e2-audit, labels app.kubernetes.io/name=user-engine and whitehat.security/engagement=WH-ENG-20260821-AUDIT-E2, with no service-account token",
"source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10",
"control_plane_scope": [
"GET apps/v1 deployment audit-core/audit-core for target revision only",
"GET v1 service audit-core/audit-core for target identity only",
"CREATE/GET/DELETE one named attributed probe pod and its credential projection only",
"GET the named probe pod log only"
"CREATE/GET/DELETE v1 pod user-engine/whitehat-e2-audit only",
"mount but never GET v1 secret user-engine/whitehat-e2-audit-credentials provisioned by the custody owner",
"GET pod log user-engine/whitehat-e2-audit only"
],
"routes": [
"GET /readyz",