coulomb/whitehat-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

intake WHITEHAT-IN-0003: request redacted release diff review facility

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
This commit is contained in:
tegwick 2026-10-21 21:07:41 +02:00
parent 42fe7a12c7
commit 7f49a74bf2
1 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
intakes/intakes.md
View file

@ -93,3 +93,31 @@ routed_at: '2026-09-01T23:11:24.530643Z'
closed_at: '2026-09-01T23:11:26.350174Z'
outcome: promoted
```
## WHITEHAT-IN-0003 — Request: secret-aware release diff review (rendered vs. live, values redacted)
```yaml
id: WHITEHAT-IN-0003
kind: intake
title: 'Request: secret-aware release diff review (rendered vs. live, values redacted)'
status: open
origin: cross-repo
origin_ref: the-custodian CUST-WP-0071 wave 1 (2026-10-21), railiance-forge FORGE-WP-0011
priority: medium
owner: whitehat-security
requested_by: the-custodian
description: 'Agents may not read Secret values (guard-secret-reads). Several deploy
paths still compose Helm values from Secrets, for example railiance-apps
make forgejo-deploy via tools/forgejo-helm-secrets.sh. Forgejo also has Helm drift:
the last release revision is 9 (July) while the live Deployment is at revision 14
after out-of-band rollouts. An agent therefore cannot verify that an upgrade changes
only the reviewed fields, so the founder has to diff by hand. REQUESTED: a facility
that renders the candidate release (with secret inputs resolved inside a trusted
boundary), diffs it against live objects, and returns a redacted, reviewable report.
The report shows structure and field paths for every change; Secret and secret-derived
values appear only as changed/unchanged digests. It ends with a verdict on whether
the change set equals the declared intent (e.g. resource requests only). The founder
would review and accept the report instead of evaluating raw diffs. Natural consumers:
the CUST-WP-0071 allocation waves and the planned release-registry drift check
(RELREG-WP-0001).'
```