From 75df0207c3d42ff3fcbbdb5f6a1e3719b9e0438f Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 1 Sep 2026 20:49:53 +0200 Subject: [PATCH] Declare Staff in INTENT.md and record WP-0001 DoD-Ok MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the transcribed gate-house review note with this repository's own v0.7 §11 declaration. Close WHITEHAT-IN-0001: Staff, blocked-clean, probe authorship retained here. Record DoD-Ok on WHITEHAT-WP-0001 so the finished plan is not quality-debt-open. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9 --- INTENT.md | 48 ++++++++++++++----- SCOPE.md | 2 + intakes/intakes.md | 18 ++++++- tests/test_layer_declaration.py | 12 +++++ .../WHITEHAT-WP-0001-cross-tenant-evidence.md | 4 ++ 5 files changed, 71 insertions(+), 13 deletions(-) create mode 100644 tests/test_layer_declaration.py diff --git a/INTENT.md b/INTENT.md index 3b81a8b..1e44891 100644 --- a/INTENT.md +++ b/INTENT.md @@ -1,19 +1,42 @@ +--- +layer: Staff +role: null +standard: net-kingdom/canon/standards/security-layer-model_v0.7.md +standard_version: "0.7" +companion: net-kingdom/SECURITY-COMPANION.md +declared_at: "2026-09-01" +conformance_state: blocked-clean +--- + # INTENT — whitehat-security -> **NetKingdom layering review — 2026-08-28.** This repository's role was reviewed -> against the NetKingdom IT-security layer model: **Taxonomy → Tooling → Engines → -> Staff**, layered by determinism and by the kind of artifact each layer produces. -> Findings and the argument behind them: -> `gate-house/history/2026-08-28-security-layer-model-and-gate-house-recut.md`. -> The model is `net-kingdom/canon/standards/security-layer-model_v0.1.md` (proposed), -> ratified by `gate-house/decisions/decisions.md` GH-DEC-2026-001. +> **Layer: Staff.** Offensive validation. This is this repository's own +> declaration under NetKingdom Security Layer Model v0.7 §11. A catalog row, +> a review note, or the 2026-08-28 gate-house insert that used to sit here is +> not a declaration. The statute is +> `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted). The +> operative form is `net-kingdom/SECURITY-COMPANION.md`. > -> The layer rule that binds every repository: **Staff never touches tooling -> directly. It acts only through engine APIs.** +> Offensive validation is interactive and non-deterministic. Acting at runtime +> does not make this an Engine. We produce dated adversarial evidence, not a +> decision surface and not state another layer depends on at runtime. Findings +> leave through `risk-nexus`. > -> **This repository is Staff — interactive, non-deterministic; offensive validation.** Add the layer label and the Staff invariant. whitehat-security executes gate-house's assurance specifications (T-01…T-10 of the Active Secrets Management Canon) as one of its targets, and findings return through the conformance loop: gate-house asserts an invariant, the engines implement it, whitehat tries to break it, kings-guard observes it in operation, findings return to gate-house as doctrine change. The specifications are gate-house's; the attack, and the verdict on whether the control actually held, are whitehat's. +> **Staff never touches Tooling directly. It acts only through Engine APIs.** +> This repository holds no OpenBao client, no database driver, and no cluster +> mutation API. The default custody broker raises before any custody call. +> Manifests in `plane/` are a contract for `ops-mason`, not a client. Live E3 +> and P1/P2 sit at zero until a runtime-safe engine surface and an approved +> window exist; that is blocked-clean, not a quieter Tooling client. > -> *This note records what should change. The body below is not yet adapted.* +> **The conformance loop, in our words.** gate-house states an invariant. +> Engines implement it. This repository designs the attack and records whether +> that attack held. kings-guard observes operation. Findings that should change +> doctrine return to gate-house; findings that should change a system go to +> `risk-nexus` and the owning repo. gate-house may specify *what must hold*, +> including T-01…T-10 of the Active Secrets Management Canon as targets. It +> does not author our probes. A probe list written outside this repository is +> not our evidence. ## Why this repo exists @@ -104,6 +127,9 @@ worth revisiting if conformance findings ever start getting quietly closed. good looks like. This repo says whether we have it. - **Blocking delivery.** In build mode a finding is information. If that changes it will be a recorded decision, not a habit that accretes. +- **A decision surface.** Staff does not render or cache an authorization + decision. Probe admission is fail-closed against an engagement record; it + is not a policy decision point. ## The targeting rule diff --git a/SCOPE.md b/SCOPE.md index 3806e77..22bae02 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -65,6 +65,8 @@ boundary always holds. ## Current state - Repository status: active. +- Layer: Staff (declared in `INTENT.md`, 2026-09-01). `WHITEHAT-IN-0001` is + closed. - Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005`. Residual live evidence is owned by `WHITEHAT-WP-0006` and is blocked on authorization. - `WHITEHAT-WP-0001` T01–T08 are complete for every applicable target. diff --git a/intakes/intakes.md b/intakes/intakes.md index b529d1d..9975566 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -7,7 +7,7 @@ id: WHITEHAT-IN-0001 kind: intake title: 'Declaration requested: state this repository''s layer in INTENT.md (security layer model §11)' -status: open +status: closed origin: cross-repo origin_ref: net-kingdom security-layer-model_v0.4 §11 priority: low @@ -33,5 +33,19 @@ description: 'A conformance sweep on 2026-08-28 found this repository has no lay If the proposed layer is wrong for what this repository actually does, that is more useful to us than a label added to close a checkbox. Standard: net-kingdom/canon/standards/security-layer-model_v0.4.md.' created: '2026-08-28T21:03:30.332146Z' -updated: '2026-08-28T21:03:30.332146Z' +updated: '2026-09-01T18:50:00Z' +quality_doc: DoC-Ok +quality_doc_at: "2026-09-01" +quality_doc_by: grok +notes: +- content: 'Declared Staff in INTENT.md in this repository''s own voice (v0.7 §11 + frontmatter, not the 2026-08-28 review note). Offensive validation is interactive + and non-deterministic; live E3/P1/P2 sit at zero with no Tooling client + (blocked-clean). Assent to the conformance loop with one correction: gate-house + may specify the invariant, including T-01…T-10 as targets; it does not author + our probes. A probe list written outside this repository is not our evidence.' + author: whitehat-security + created: '2026-09-01T18:50:00Z' +closed_at: '2026-09-01T18:50:00Z' +outcome: declared Staff; probe authorship retained here ``` diff --git a/tests/test_layer_declaration.py b/tests/test_layer_declaration.py new file mode 100644 index 0000000..0475f42 --- /dev/null +++ b/tests/test_layer_declaration.py @@ -0,0 +1,12 @@ +from pathlib import Path + + +def test_intent_declares_staff_in_own_voice(): + text = Path("INTENT.md").read_text(encoding="utf-8") + assert text.startswith("---\n") + frontmatter = text.split("---\n", 2)[1] + assert "layer: Staff" in frontmatter + assert 'standard_version: "0.7"' in frontmatter + assert "conformance_state: blocked-clean" in frontmatter + assert "gate-house insert that used to sit here is" in text + assert "does not author our probes" in text diff --git a/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md b/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md index 6eadad0..4e9bd30 100644 --- a/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md +++ b/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md @@ -10,6 +10,10 @@ topic_slug: whitehat-security created: "2026-08-17" updated: "2026-09-01" state_hub_workstream_id: "3049aa1e-b188-514f-9ad7-bf3026094fb9" +quality_dod: DoD-Ok +quality_dod_at: "2026-09-01" +quality_dod_by: grok +quality_dod_note: "T01–T08 done for every applicable target; live residuals owned by WHITEHAT-WP-0006; make check passed; no live traffic." --- # WHITEHAT-WP-0001 — cross-tenant evidence