coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add in-process known-bad fixtures for remaining ASM T-01–T-10

Browse source 
Each Canon test now has a fixture-asm registration that fails known-bad
and passes known-good in-process. Live asm-tNN targets stay pending.
No network, OpenBao, or packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
This commit is contained in:
tegwick 2026-09-02 13:05:42 +02:00
parent 75deaf073f
commit 6f1ca0bfef
38 changed files with 1132 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

7
evidence/README.md
View file

@ -2,9 +2,10 @@
This directory stores sanitized run artifacts. `offline-calibration.json`,
`offline-e3-calibration.json`, `offline-capacity-calibration.json`, and
`offline-asm-t06-calibration.json` are generated from repository-created
fixtures and prove only that the harness distinguishes known-good from
known-bad behavior. They are not target assurance. `WH-ENG-20260822-AUDIT-E2-02-abort.json`
`offline-asm-t01-calibration.json` … `offline-asm-t10-calibration.json` are
generated from repository-created fixtures and prove only that the harness
distinguishes known-good from known-bad behavior. They are not target
assurance. `WH-ENG-20260822-AUDIT-E2-02-abort.json`
is an abort record (`evidence_class: abort`), not an E2 pass or finding.
`WH-ENG-20260822-AUDIT-E2-03.json` is the first authorized target pass; SHA-256
`2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593`. A pass

35
evidence/offline-asm-t01-calibration.json Normal file
View file

@ -0,0 +1,35 @@
{
"ended_at": "2026-09-02T11:04:57.061632Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t01-excluded-action",
"reason": "known-bad ceiling allowed excluded destroy"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t01-excluded-action",
"reason": "ceiling held; excluded destroy did not mutate"
}
],
"limitations": [
"Offline ASM T-01 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-01-calibration-2026-09-02T11:04:57.061594Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:57.061594Z",
"target": {
"component": "in-process-ceiling",
"environment": "fixture"
},
"test_id": "T-01"
}

36
evidence/offline-asm-t02-calibration.json Normal file
View file

@ -0,0 +1,36 @@
{
"ended_at": "2026-09-02T11:04:57.309535Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t02-canary-detected",
"reason": "known-bad placed a canary digest in context"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t02-canary-absent",
"reason": "no canary digest in model-visible context"
}
],
"limitations": [
"Offline ASM T-02 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance.",
"Canary values are hashed; evidence stores only digests."
],
"outcome": "pass",
"run_id": "asm-t-02-calibration-2026-09-02T11:04:57.309489Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:57.309489Z",
"target": {
"component": "in-process-model-context",
"environment": "fixture"
},
"test_id": "T-02"
}

35
evidence/offline-asm-t03-calibration.json Normal file
View file

@ -0,0 +1,35 @@
{
"ended_at": "2026-09-02T11:04:57.557147Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t03-post-disconnect",
"reason": "known-bad omitted session binding"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t03-post-disconnect",
"reason": "supervised privilege stopped after disconnect"
}
],
"limitations": [
"Offline ASM T-03 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-03-calibration-2026-09-02T11:04:57.557108Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:57.557108Z",
"target": {
"component": "in-process-session",
"environment": "fixture"
},
"test_id": "T-03"
}

35
evidence/offline-asm-t04-calibration.json Normal file
View file

@ -0,0 +1,35 @@
{
"ended_at": "2026-09-02T11:04:57.810886Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t04-self-widen",
"reason": "known-bad allowed self-widening of the ceiling"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t04-self-widen",
"reason": "ordinary actor could not widen its ceiling"
}
],
"limitations": [
"Offline ASM T-04 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-04-calibration-2026-09-02T11:04:57.810845Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:57.810845Z",
"target": {
"component": "in-process-policy",
"environment": "fixture"
},
"test_id": "T-04"
}

35
evidence/offline-asm-t05-calibration.json Normal file
View file

@ -0,0 +1,35 @@
{
"ended_at": "2026-09-02T11:04:58.050219Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t05-wrong-audience",
"reason": "known-bad accepted A's artifact at B"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t05-wrong-audience",
"reason": "service B rejected A's audience-bound artifact"
}
],
"limitations": [
"Offline ASM T-05 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-05-calibration-2026-09-02T11:04:58.050180Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:58.050180Z",
"target": {
"component": "in-process-audience",
"environment": "fixture"
},
"test_id": "T-05"
}

6
evidence/offline-asm-t06-calibration.json
View file

@ -1,5 +1,5 @@
{
"ended_at": "2026-09-02T08:10:37.894382Z",
"ended_at": "2026-09-02T11:04:58.385199Z",
"evidence_class": "fixture",
"known_bad": [
{
@ -36,10 +36,10 @@
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t06-calibration-2026-09-02T08:10:37.814145Z",
"run_id": "asm-t06-calibration-2026-09-02T11:04:58.297167Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T08:10:37.814145Z",
"started_at": "2026-09-02T11:04:58.297167Z",
"target": {
"claimed_revision": "3cd9955ac935be398f0fbb6aa7263660a9888721",
"component": "secrets-engine",

35
evidence/offline-asm-t07-calibration.json Normal file
View file

@ -0,0 +1,35 @@
{
"ended_at": "2026-09-02T11:04:58.758606Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t07-over-threshold",
"reason": "known-bad disconnected the stop path"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t07-over-threshold",
"reason": "independent stop path denied over-threshold mutation"
}
],
"limitations": [
"Offline ASM T-07 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-07-calibration-2026-09-02T11:04:58.758567Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:58.758567Z",
"target": {
"component": "in-process-stop-path",
"environment": "fixture"
},
"test_id": "T-07"
}

41
evidence/offline-asm-t08-calibration.json Normal file
View file

@ -0,0 +1,41 @@
{
"ended_at": "2026-09-02T11:04:59.002786Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t08-unlink-record",
"reason": "known-bad unlinked a required decision record"
},
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t08-emission-gap",
"reason": "known-bad suppressed emission while naming an archive chain"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t08-complete-chain",
"reason": "held records reconstruct and emissions are complete"
}
],
"limitations": [
"Offline ASM T-08 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-08-calibration-2026-09-02T11:04:59.002751Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:59.002751Z",
"target": {
"component": "in-process-archive",
"environment": "fixture"
},
"test_id": "T-08"
}

41
evidence/offline-asm-t09-calibration.json Normal file
View file

@ -0,0 +1,41 @@
{
"ended_at": "2026-09-02T11:04:59.234388Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t09-emit-after-commit",
"reason": "known-bad committed state without a local outbox row"
},
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t09-archive-blocks-revoke",
"reason": "known-bad blocked emergency revocation on archive outage"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t09-atomicity-and-outage",
"reason": "outbox failure aborts load-bearing commit; archive outage does not block revocation"
}
],
"limitations": [
"Offline ASM T-09 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-09-calibration-2026-09-02T11:04:59.234350Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:59.234350Z",
"target": {
"component": "in-process-outbox",
"environment": "fixture"
},
"test_id": "T-09"
}

35
evidence/offline-asm-t10-calibration.json Normal file
View file

@ -0,0 +1,35 @@
{
"ended_at": "2026-09-02T11:04:59.468834Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 0,
"outcome": "finding",
"probe_id": "t10-unrevoked-path",
"reason": "known-bad left broker validation unrevoked"
}
],
"known_good": [
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t10-all-paths-closed",
"reason": "revoked credential failed on every original path"
}
],
"limitations": [
"Offline ASM T-10 calibration evaluates an in-process harness.",
"No network, live credential, or packet was used.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t-10-calibration-2026-09-02T11:04:59.468794Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T11:04:59.468794Z",
"target": {
"component": "in-process-revocation",
"environment": "fixture"
},
"test_id": "T-10"
}