coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit E3 and capacity on the test plane

Browse source 
Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 09:40:27 +02:00
parent 4882c2d47a
commit 7e83a66573
22 changed files with 501 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

7
evidence/README.md
View file

@ -1,8 +1,9 @@
# Evidence
This directory stores sanitized run artifacts. `offline-calibration.json` is
generated from repository-created fixtures and proves only that the harness
distinguishes known-good from known-bad behavior.
This directory stores sanitized run artifacts. `offline-calibration.json` and
`offline-e3-calibration.json` are generated from repository-created fixtures
and prove only that the harness distinguishes known-good from known-bad
behavior. They are not target assurance.
Before committing target evidence, verify that it contains no response body,
credential, database URL, real tenant identifier, or real tenant value. A

99
evidence/offline-e3-calibration.json Normal file
View file

@ -0,0 +1,99 @@
{
"cadence": {
"interval": "24h",
"maximum_detection_window": "24h plus run and reporting latency",
"reset_triggers": [
"schema migration",
"role or grant change",
"RLS policy change",
"security-definer function change",
"posture mechanism change"
],
"triggered_run_deadline": "before deployment promotion"
},
"ended_at": "2026-08-22T07:39:54.791280Z",
"evidence_class": "fixture",
"known_bad": [
{
"outcome": "finding",
"probe_id": "conformance-view-empty",
"reason": "expectation failed: zero_rows"
},
{
"outcome": "finding",
"probe_id": "unset-guc-reads-none",
"reason": "expectation failed: zero_rows"
},
{
"outcome": "finding",
"probe_id": "tenant-a-cannot-read-b",
"reason": "expectation failed: zero_rows"
},
{
"outcome": "finding",
"probe_id": "tenant-a-cannot-insert-b",
"reason": "expectation failed: statement_rejected"
},
{
"outcome": "finding",
"probe_id": "runtime-lacks-bypassrls",
"reason": "expectation failed: false"
},
{
"outcome": "finding",
"probe_id": "unsafe-definer-inventory-empty",
"reason": "expectation failed: zero_rows"
},
{
"outcome": "inconclusive",
"probe_id": "sql-compromise-reset",
"reason": "E3-B observation records the documented SQL-compromise limit"
}
],
"known_good": [
{
"outcome": "pass",
"probe_id": "conformance-view-empty",
"reason": "expectation met: zero_rows"
},
{
"outcome": "pass",
"probe_id": "unset-guc-reads-none",
"reason": "expectation met: zero_rows"
},
{
"outcome": "pass",
"probe_id": "tenant-a-cannot-read-b",
"reason": "expectation met: zero_rows"
},
{
"outcome": "pass",
"probe_id": "tenant-a-cannot-insert-b",
"reason": "expectation met: statement_rejected"
},
{
"outcome": "pass",
"probe_id": "runtime-lacks-bypassrls",
"reason": "expectation met: false"
},
{
"outcome": "pass",
"probe_id": "unsafe-definer-inventory-empty",
"reason": "expectation met: zero_rows"
},
{
"outcome": "inconclusive",
"probe_id": "sql-compromise-reset",
"reason": "E3-B observation records the documented SQL-compromise limit"
}
],
"limitations": [
"Offline E3 calibration evaluates the harness; it is not target assurance.",
"No database connection or live credential was used.",
"sql-compromise-reset is E3's documented limit and stays inconclusive."
],
"outcome": "pass",
"run_id": "e3-calibration-2026-08-22T07:39:54.791131Z",
"schema_version": "whitehat-e3-calibration/v1",
"started_at": "2026-08-22T07:39:54.791131Z"
}