Record clean security workplan cutoff

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38

README.md

@@ -26,6 +26,8 @@ probes most worth having are the ones an author would not think to write.
 - Rules of engagement (accepted; live targets still require engagement approval):
   [`docs/rules-of-engagement.md`](docs/rules-of-engagement.md)
 - Operator runbook: [`docs/operator-runbook.md`](docs/operator-runbook.md)
+- Session cutoff and redesign handoff:
+  [`docs/session-cutoff-2026-08-22.md`](docs/session-cutoff-2026-08-22.md)
 - Target packs: [`probe-packs/`](probe-packs/)
 
 ## Offline calibration

docs/session-cutoff-2026-08-22.md

@@ -0,0 +1,78 @@
+# Session cutoff — 2026-08-22
+
+This is the clean stopping point for the session that prepared
+`WHITEHAT-WP-0001`. It separates implemented and calibrated work from target
+evidence that does not exist yet.
+
+## Safety state at cutoff
+
+- No live adversarial request was sent to `audit-core`, `tenant-engine`, or any
+  other target.
+- No probe pod, fixture, credential, secret, database connection, or load was
+  created.
+- `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are cancelled.
+  Their identifiers are terminal and must not be reused.
+- No pass or finding was delivered to `risk-nexus`, because offline calibration
+  is not target assurance.
+
+## Completed
+
+- Registered the repository, workplan, and tasks consistently in State Hub.
+- Established first-class repository intent, scope, ownership, rules of
+  engagement, attacker model, evidence contract, and operator runbook.
+- Implemented a Python evidence harness with minimized, body-free reporting.
+- Implemented five differential read/list/create/update/delete probes.
+- Calibrated every probe against both an enforcing fixture and a deliberately
+  vulnerable fixture; the vulnerable fixture is detected.
+- Added engagement authorization, expiry, route, rate, concurrency, credential
+  TTL, production approval, owner acknowledgement, and cancellation gates.
+- Added E3 cadence/evaluation, capacity characterization, and pass/finding
+  message formatting.
+- Added and reviewed an `audit-core` E2 adapter and exact attributed pod
+  manifest. Target review found a missing `Idempotency-Key`; the adapter was
+  corrected and its retry fixtures made deterministic.
+- Recorded why `tenant-engine` does not currently instantiate the stated E2
+  attacker model instead of forcing a misleading probe.
+- The repository check suite passes with 23 tests, and both probe packs
+  validate.
+
+## Not completed
+
+- No service has a dated target E2 artifact from this facility.
+- `audit-core` still needs formal target-owner acknowledgement of the final
+  adapter and engagement revision, plus two sanctioned ordinary tenant-scoped
+  `may_read`/`may_write` fixture identities with a maximum 900-second lifetime.
+- `tenant-engine` still needs an applicability decision: expose a real
+  tenant-bound identity that models E2, or mark this target not applicable for
+  E2 and test the authorization boundary where it actually exists.
+- Target adapters have not yet been calibrated against target-shaped known-bad
+  implementations.
+- E3 still needs an authorized database consumer and live SQL runner on the
+  declared 24-hour and pre-promotion cadence.
+- P1/P2 still needs a separately approved substrate/load window and ceilings.
+- No target pass/finding has been delivered to `risk-nexus`.
+
+## Required redesign before resuming
+
+Build a governed whitehat test plane rather than assembling authority during
+each run:
+
+1. A dedicated namespace and immutable runner identity, with default-deny
+   networking and explicit target egress.
+2. A credential broker that accepts an engagement ID and projects two
+   short-lived, tenant-scoped fixture identities directly into the runner,
+   then expires and revokes them without exposing values to the operator or
+   agent.
+3. A target registration contract containing the posture claim, attacker
+   model, fixture lifecycle, exact routes, adapter, known-bad calibration,
+   abort telemetry, and an honest not-applicable state.
+4. A pinned runner image, required engagement/admission labels, health and rate
+   watchers, an independently usable kill switch, and automatic cleanup.
+5. Standing authorization only for low-rate, fixture-only registered E2 runs;
+   database compromise, recovery, saturation, and destructive techniques keep
+   separate explicit approval classes.
+6. Automatic delivery of both passing and finding reports to `risk-nexus`.
+
+Resume only with new engagement IDs after that plane can issue the correct test
+identities and enforce the complete envelope. The existing workplan remains the
+backlog: T01 and T02 are done; T03, T04, T05, T06, and T07 remain in progress.

engagements/2026-08-21-audit-core-e2.json

@@ -1,5 +1,8 @@
 {
   "engagement_id": "WH-ENG-20260821-AUDIT-E2",
+  "status": "cancelled",
+  "cancelled_at": "2026-08-21T22:18:03Z",
+  "cancellation_reason": "Session cutoff: final target-owner acknowledgement and sanctioned tenant-scoped fixture identities were not obtained. Zero target requests were sent.",
   "authorization_id": "operator-session-2026-08-21-e2-approval",
   "authorizer": "repository operator and infrastructure owner",
   "approved_at": "2026-08-21T21:56:00Z",
@@ -7,7 +10,7 @@
   "target": "http://audit-core.audit-core.svc.cluster.local:8080",
   "target_owner": "audit-core / infrastructure operator",
   "target_owner_acknowledged_at": null,
-  "target_owner_acknowledgement_status": "pending corrected adapter/record review; target review received 2026-08-21T22:04:19Z",
+  "target_owner_acknowledgement_status": "not obtained before cancellation; target review received 2026-08-21T22:04:19Z",
   "environment": "production",
   "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
   "namespace": "audit-core",

engagements/2026-08-21-tenant-engine-e2.json

@@ -1,5 +1,8 @@
 {
   "engagement_id": "WH-ENG-20260821-TENANT-E2",
+  "status": "cancelled",
+  "cancelled_at": "2026-08-21T22:18:03Z",
+  "cancellation_reason": "Session cutoff: E2 attacker-model applicability and target-owner acknowledgement remained unresolved. Zero target requests were sent.",
   "authorization_id": "operator-session-2026-08-21-e2-approval",
   "authorizer": "repository operator and infrastructure owner",
   "approved_at": "2026-08-21T21:56:00Z",
@@ -7,7 +10,7 @@
   "target": "http://tenant-engine.tenant-engine.svc.cluster.local:8090",
   "target_owner": "tenant-engine / infrastructure operator",
   "target_owner_acknowledged_at": null,
-  "target_owner_acknowledgement_status": "pending E2 attacker-model applicability review requested 2026-08-21T22:07:10Z",
+  "target_owner_acknowledgement_status": "not obtained before cancellation; E2 attacker-model applicability remains unresolved",
   "environment": "production",
   "production_approval": "Explicit user approval of engagements/2026-08-21-e2-proposals.md in the coordinating session",
   "namespace": "tenant-engine",

src/whitehat_security/engagement.py

@@ -37,6 +37,8 @@ class Engagement:
         return engagement
 
     def validate(self, *, now: datetime | None = None) -> None:
+        if self.raw.get("status") == "cancelled":
+            raise AuthorizationError("engagement is cancelled")
         current = now or datetime.now(UTC)
         start = _timestamp(self.raw["window_start"])
         end = _timestamp(self.raw["window_end"])

tests/test_engagement.py

@@ -63,6 +63,14 @@ def test_pending_owner_acknowledgement_fails_closed(tmp_path):
         load(tmp_path, data)
 
 
+def test_cancelled_record_fails_closed_even_with_owner_acknowledgement(tmp_path):
+    data = record()
+    data["status"] = "cancelled"
+    data["cancelled_at"] = "2026-08-21T08:02:00Z"
+    with pytest.raises(AuthorizationError, match="cancelled"):
+        load(tmp_path, data)
+
+
 def _write(tmp_path, data):
     path = tmp_path / "engagement.json"
     path.write_text(json.dumps(data), encoding="utf-8")

workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md

@@ -8,7 +8,7 @@ status: active
 owner: net-kingdom
 topic_slug: whitehat-security
 created: "2026-08-17"
-updated: "2026-08-21"
+updated: "2026-08-22"
 state_hub_workstream_id: "ecc16edc-9f9b-4fc4-8fb1-96b947a59299"
 ---
 
@@ -274,6 +274,18 @@ report being delivered to `risk-nexus`.
 T01 gates all. T02 shapes T03/T05/T06. T04 gates trusting any of them. T07 can
 follow T03.
 
+## Session cutoff — 2026-08-22
+
+This session ends with the workplan deliberately **active**, not cosmetically
+complete. T01 and T02 are done. T03 through T07 remain in progress. The two
+dated production engagement records were cancelled without sending any target
+request; cancelled engagement IDs are terminal and must never be reused.
+
+The offline instrument is implemented and calibrated, but the estate does not
+yet provide the governed test plane needed to exercise it routinely and safely.
+The exact completed scope, unresolved scope, and recommended restart boundary
+are recorded in `docs/session-cutoff-2026-08-22.md`.
+
 ## Risks
 
 **The facility becomes the threat.** Mitigated by T01, and by holding no