coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add governed test plane and close T04/T08

Browse source 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 00:44:21 +02:00
parent 0aab0cb4c6
commit 95129d7a35
35 changed files with 1599 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

13
README.md
View file

@ -28,6 +28,8 @@ probes most worth having are the ones an author would not think to write.
- Operator runbook: [`docs/operator-runbook.md`](docs/operator-runbook.md)
- Session cutoff and redesign handoff:
[`docs/session-cutoff-2026-08-22.md`](docs/session-cutoff-2026-08-22.md)
- Governed test plane: [`docs/test-plane.md`](docs/test-plane.md)
- Target registrations: [`targets/`](targets/)
- Target packs: [`probe-packs/`](probe-packs/)
## Offline calibration
@ -37,8 +39,9 @@ make check
make fixture-evidence
```
This proves that every current differential probe passes an enforcing fixture
and detects the corresponding missing-tenant-predicate fixture. It sends no
network traffic and is not evidence about a target service. Live execution
requires a current target-specific record based on
[`engagements/template.json`](engagements/template.json).
This proves that every current differential probe, including the audit-core
shaped pack, passes an enforcing fixture and detects the corresponding
missing-tenant-predicate fixture. It sends no network traffic and is not
evidence about a target service. Live execution requires a current
target-specific record, a registered applicable target, and plane admission.
See [`docs/test-plane.md`](docs/test-plane.md).