From 7bc0933118187000e7090d9b3cc087c3aa295401 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 2 Sep 2026 15:43:07 +0200 Subject: [PATCH] Finish WHITEHAT-WP-0007 and own live ASM residuals in WP-0008 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Triage and in-process T-01–T-10 calibration are complete. Live ASM runs move to WHITEHAT-WP-0008, which authorizes no packet. Record DoD-Ok on WP-0007. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9 --- SCOPE.md | 15 +++-- .../WHITEHAT-WP-0007-asm-t01-t10-triage.md | 33 ++++++++--- .../WHITEHAT-WP-0008-live-asm-residuals.md | 55 +++++++++++++++++++ 3 files changed, 88 insertions(+), 15 deletions(-) create mode 100644 workplans/WHITEHAT-WP-0008-live-asm-residuals.md diff --git a/SCOPE.md b/SCOPE.md index 2f0a6e4..f69bff4 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -67,12 +67,13 @@ boundary always holds. - Repository status: active. - Layer: Staff (declared in `INTENT.md`, 2026-09-01). `WHITEHAT-IN-0001` is closed. -- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005`. Residual live - Tenancy Posture evidence is owned by `WHITEHAT-WP-0006` and is blocked on - authorization. -- Active: `WHITEHAT-WP-0007` triages Gate House ASM T-01…T-10. Live +- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005` and + `WHITEHAT-WP-0007`. Residual live Tenancy Posture evidence is + `WHITEHAT-WP-0006`. Residual live ASM is `WHITEHAT-WP-0008`. Both are + blocked on authorization. +- `WHITEHAT-WP-0007` triaged Gate House ASM T-01…T-10. Live `asm-tNN` registrations remain `pending`. In-process `fixture-asm-t01`…`t10` - calibrations exist. That work authorizes no live probe. + calibrations exist. That work authorized no live probe. - `WHITEHAT-WP-0001` T01–T08 are complete for every applicable target. `audit-core` has dated E2 pass `WH-ENG-20260822-AUDIT-E2-03`. `tenant-engine` E2 and `platform-pg` E3 stay `not_applicable`. `flex-auth` @@ -100,4 +101,6 @@ boundary always holds. [`WHITEHAT-WP-0006`](workplans/WHITEHAT-WP-0006-authorized-live-residuals.md) for unauthorized live Tenancy Posture residuals, and [`WHITEHAT-WP-0007`](workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md) - for ASM T-01…T-10 triage. + for finished ASM T-01…T-10 triage, and + [`WHITEHAT-WP-0008`](workplans/WHITEHAT-WP-0008-live-asm-residuals.md) + for unauthorized live ASM residuals. diff --git a/workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md b/workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md index 30ba328..1bf5721 100644 --- a/workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md +++ b/workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md @@ -4,7 +4,7 @@ type: workplan title: "Triage Gate House ASM T-01–T-10 executable targets" domain: infotech repo: whitehat-security -status: active +status: finished owner: net-kingdom topic_slug: whitehat-security created: "2026-09-02" @@ -12,7 +12,12 @@ updated: "2026-09-02" related: - WHITEHAT-IN-0002 - WHITEHAT-WP-0001 + - WHITEHAT-WP-0008 state_hub_workstream_id: "a06d1a9b-d9fa-5bec-bf03-e0e9b5b0ee3a" +quality_dod: DoD-Ok +quality_dod_at: "2026-09-02" +quality_dod_by: grok +quality_dod_note: "T01–T10 triage done; fixture-asm-t01…t10 calibrated known-bad/known-good in-process; T-06 reporting envelope sent. Live ASM owned by WHITEHAT-WP-0008. make check passed. No live traffic." --- # WHITEHAT-WP-0007 — ASM T-01–T-10 triage @@ -278,19 +283,29 @@ state_hub_task_id: "28b231b2-b51f-5484-89cb-e709258a3a15" ```task id: WHITEHAT-WP-0007-T11 -status: wait +status: done priority: medium state_hub_task_id: "13518801-015f-51ef-9d07-8cf989e08710" ``` -In-process known-bad calibration exists for T-01…T-10 -(`targets/fixture-asm-tNN.json`, `evidence/offline-asm-tNN-calibration.json`). -Any live ASM run is blocked until a target owner names the surface, identities, -and window for that test. Do not relabel a pending live target to finish this -plan. Do not send a packet. +Done 2026-09-02 for the in-process part: T-01…T-10 have `fixture-asm-tNN` +registrations and `evidence/offline-asm-tNN-calibration.json`. Known-bad +loses the oracle; known-good passes. T-06 also has a +conformance-reporting.v1 fixture envelope +(`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`) with `engagement_id=fixture-asm-t06` +and RoE v0.2 §1. Live ASM is owned by `WHITEHAT-WP-0008`. This task does not +relabel pending live targets and sent no packet. ## Sequencing -T01–T10 are the triage and are done together. T11 cannot start without an -owner-named surface. Offline Tenancy Posture work remains on +T01–T10 were the triage. T11's fixture work is done. Live runs are +`WHITEHAT-WP-0008`. Offline Tenancy Posture work remains on `WHITEHAT-WP-0001` / `WHITEHAT-WP-0006`. + +## Closeout — 2026-09-02 + +This workplan is **finished**. Gate House's first completion condition is met: +ten triaged Canon tests, each with applicability, known-bad design, owning +surface, and result route, plus in-process calibration. A later live run needs +a new engagement ID, an `applicable` live registration, and plane admission. +`WHITEHAT-WP-0008` owns that residual and authorizes no packet. diff --git a/workplans/WHITEHAT-WP-0008-live-asm-residuals.md b/workplans/WHITEHAT-WP-0008-live-asm-residuals.md new file mode 100644 index 0000000..3bc2b76 --- /dev/null +++ b/workplans/WHITEHAT-WP-0008-live-asm-residuals.md @@ -0,0 +1,55 @@ +--- +id: WHITEHAT-WP-0008 +type: workplan +title: "Authorized live ASM residuals after WHITEHAT-WP-0007" +domain: infotech +repo: whitehat-security +status: blocked +owner: net-kingdom +topic_slug: whitehat-security +created: "2026-09-02" +updated: "2026-09-02" +related: + - WHITEHAT-WP-0007 + - WHITEHAT-IN-0002 +--- + +# WHITEHAT-WP-0008 — live ASM residuals + +## Goal + +Own live `asm-assurance-targets.v1` runs that `WHITEHAT-WP-0007` correctly did +not execute. In-process known-bad calibration for T-01…T-10 already exists. + +This plan authorizes no engagement, runner, credential, traffic, or load. + +## Origin + +`WHITEHAT-WP-0007` finished on 2026-09-02. Its artifacts are ten triaged +Canon tests, `fixture-asm-t01`…`t10` in-process calibrations, the T-06 +conformance-reporting.v1 fixture envelope, and pending live `asm-tNN` +registrations. Live residuals must not remain only in that plan's prose. + +## Tasks + +### T01 — Live ASM under a new engagement + +```task +id: WHITEHAT-WP-0008-T01 +status: wait +priority: medium +``` + +Blocked until a target owner names, for a specific Canon `test_id`, the +component revision, identities, window, and technique, and until a complete +engagement record plus plane admission exist. `asm-t01`…`asm-t10` stay +`pending` until that happens. Do not relabel a pending target to finish this +task. Do not send a packet. + +T-06 live still needs a named approval-engine and consuming PEP; the +in-process consume client at secrets-engine `4b4d556` is not that surface. + +## Sequencing + +Nothing starts without the rules of engagement §1 record and plane admission. +Offline fixtures stay on `WHITEHAT-WP-0007`.