Admit E3 and capacity on the test plane

Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

targets/README.md

@@ -9,6 +9,10 @@ honest applicability record the test plane admits against.
 | `audit-core` | applicable | Two ordinary tenant-scoped senders instantiate E2. Live run still needs a new engagement and plane lease. |
 | `tenant-engine` | not_applicable | No tenant-A identity without tenant-B authority. |
 | `flex-auth` | pending | Initial envelope; owner has not confirmed the attacker identity. |
+| `fixture-e3` | applicable | In-process E3 evaluator. One runtime identity, no `BYPASSRLS`. |
+| `platform-pg` | pending | Live E3 needs a named database, ordinary runtime role, and dated window. |
+| `fixture-capacity` | applicable | In-process P1/P2 evaluator. Generates no load. |
+| `shared-substrate` | pending | Live capacity needs an operator window and aggressor ceiling. |
 
 `not_applicable` is a completed artifact, not a deferral. Do not relabel it to
 close a workplan. Do not reuse cancelled engagement IDs from `engagements/`.

targets/fixture-capacity.json

@@ -0,0 +1,29 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "fixture-capacity",
+  "posture_claim": "P1/P2",
+  "attacker_model": "bounded co-resident saturating its own allowance",
+  "applicability": "applicable",
+  "applicability_reason": "In-process evaluator created by this repository. It generates no load and records governor binding plus neighbour degradation.",
+  "approval_classes": ["fixture-capacity"],
+  "adapter": "src/whitehat_security/capacity.py",
+  "probe_pack": "src/whitehat_security/capacity.py",
+  "known_bad_calibration": "src/whitehat_security/capacity.py",
+  "fixture_lifecycle": {
+    "create": "in-process samples",
+    "delete": "drop process state",
+    "ids_are_synthetic": true
+  },
+  "egress": "in-process",
+  "routes": ["baseline", "loaded"],
+  "identities": {
+    "count": 0,
+    "role": "none; fixture generates no network load",
+    "broker_audience": "whitehat-capacity/fixture"
+  },
+  "abort_telemetry": [
+    "governor_unbound",
+    "aggressor_exceeded_ceiling",
+    "missing_neighbour_sample"
+  ]
+}

targets/fixture-e3.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "fixture-e3",
+  "posture_claim": "E3",
+  "attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit",
+  "applicability": "applicable",
+  "applicability_reason": "In-process evaluator created by this repository. It uses one ordinary runtime identity and never grants BYPASSRLS or superuser.",
+  "approval_classes": ["fixture-e3"],
+  "adapter": "src/whitehat_security/e3.py",
+  "probe_pack": "src/whitehat_security/e3.py",
+  "known_bad_calibration": "src/whitehat_security/e3.py",
+  "fixture_lifecycle": {
+    "create": "in-process constructor",
+    "delete": "drop process state",
+    "ids_are_synthetic": true
+  },
+  "egress": "in-process",
+  "routes": [
+    "conformance",
+    "unset_guc",
+    "wrong_tenant_read",
+    "wrong_tenant_insert",
+    "runtime_bypassrls",
+    "unsafe_definer",
+    "reset_to_b"
+  ],
+  "identities": {
+    "count": 1,
+    "role": "ordinary runtime database role without BYPASSRLS",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e3/fixture"
+  },
+  "abort_telemetry": [
+    "statement_timeout",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution",
+    "privilege_escalation"
+  ]
+}

targets/platform-pg-e3.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "platform-pg",
+  "posture_claim": "E3",
+  "attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit",
+  "applicability": "pending",
+  "applicability_reason": "Named in the rules of engagement as outside the initial API-probe envelope. A live run needs the database owner to confirm an ordinary runtime role without BYPASSRLS, the conformance view, and a dated window. This registration does not authorize a connection.",
+  "approval_classes": ["e3"],
+  "routes": [],
+  "identities": {
+    "count": 1,
+    "role": "ordinary runtime database role without BYPASSRLS or superuser",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e3/platform-pg"
+  },
+  "abort_telemetry": [
+    "statement_timeout",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution",
+    "privilege_escalation"
+  ]
+}

targets/shared-substrate-capacity.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "shared-substrate",
+  "posture_claim": "P1/P2",
+  "attacker_model": "bounded co-resident saturating its own allowance",
+  "applicability": "pending",
+  "applicability_reason": "No operator-approved substrate window or aggressor ceiling exists. Saturation against a shared rail is an outage if run without those bounds. This registration does not authorize load.",
+  "approval_classes": ["capacity"],
+  "routes": [],
+  "identities": {
+    "count": 0,
+    "role": "none until a window names the aggressor consumer",
+    "broker_audience": "whitehat-capacity/shared-substrate"
+  },
+  "abort_telemetry": [
+    "governor_unbound",
+    "aggressor_exceeded_ceiling",
+    "missing_neighbour_sample",
+    "shared_substrate_abort_threshold"
+  ]
+}