Record clean security workplan cutoff

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

docs/session-cutoff-2026-08-22.md

@@ -0,0 +1,78 @@
+# Session cutoff — 2026-08-22
+
+This is the clean stopping point for the session that prepared
+`WHITEHAT-WP-0001`. It separates implemented and calibrated work from target
+evidence that does not exist yet.
+
+## Safety state at cutoff
+
+- No live adversarial request was sent to `audit-core`, `tenant-engine`, or any
+  other target.
+- No probe pod, fixture, credential, secret, database connection, or load was
+  created.
+- `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are cancelled.
+  Their identifiers are terminal and must not be reused.
+- No pass or finding was delivered to `risk-nexus`, because offline calibration
+  is not target assurance.
+
+## Completed
+
+- Registered the repository, workplan, and tasks consistently in State Hub.
+- Established first-class repository intent, scope, ownership, rules of
+  engagement, attacker model, evidence contract, and operator runbook.
+- Implemented a Python evidence harness with minimized, body-free reporting.
+- Implemented five differential read/list/create/update/delete probes.
+- Calibrated every probe against both an enforcing fixture and a deliberately
+  vulnerable fixture; the vulnerable fixture is detected.
+- Added engagement authorization, expiry, route, rate, concurrency, credential
+  TTL, production approval, owner acknowledgement, and cancellation gates.
+- Added E3 cadence/evaluation, capacity characterization, and pass/finding
+  message formatting.
+- Added and reviewed an `audit-core` E2 adapter and exact attributed pod
+  manifest. Target review found a missing `Idempotency-Key`; the adapter was
+  corrected and its retry fixtures made deterministic.
+- Recorded why `tenant-engine` does not currently instantiate the stated E2
+  attacker model instead of forcing a misleading probe.
+- The repository check suite passes with 23 tests, and both probe packs
+  validate.
+
+## Not completed
+
+- No service has a dated target E2 artifact from this facility.
+- `audit-core` still needs formal target-owner acknowledgement of the final
+  adapter and engagement revision, plus two sanctioned ordinary tenant-scoped
+  `may_read`/`may_write` fixture identities with a maximum 900-second lifetime.
+- `tenant-engine` still needs an applicability decision: expose a real
+  tenant-bound identity that models E2, or mark this target not applicable for
+  E2 and test the authorization boundary where it actually exists.
+- Target adapters have not yet been calibrated against target-shaped known-bad
+  implementations.
+- E3 still needs an authorized database consumer and live SQL runner on the
+  declared 24-hour and pre-promotion cadence.
+- P1/P2 still needs a separately approved substrate/load window and ceilings.
+- No target pass/finding has been delivered to `risk-nexus`.
+
+## Required redesign before resuming
+
+Build a governed whitehat test plane rather than assembling authority during
+each run:
+
+1. A dedicated namespace and immutable runner identity, with default-deny
+   networking and explicit target egress.
+2. A credential broker that accepts an engagement ID and projects two
+   short-lived, tenant-scoped fixture identities directly into the runner,
+   then expires and revokes them without exposing values to the operator or
+   agent.
+3. A target registration contract containing the posture claim, attacker
+   model, fixture lifecycle, exact routes, adapter, known-bad calibration,
+   abort telemetry, and an honest not-applicable state.
+4. A pinned runner image, required engagement/admission labels, health and rate
+   watchers, an independently usable kill switch, and automatic cleanup.
+5. Standing authorization only for low-rate, fixture-only registered E2 runs;
+   database compromise, recovery, saturation, and destructive techniques keep
+   separate explicit approval classes.
+6. Automatic delivery of both passing and finding reports to `risk-nexus`.
+
+Resume only with new engagement IDs after that plane can issue the correct test
+identities and enforce the complete envelope. The existing workplan remains the
+backlog: T01 and T02 are done; T03, T04, T05, T06, and T07 remain in progress.