coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add governed test plane and close T04/T08

Browse source 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 00:44:21 +02:00
parent 0aab0cb4c6
commit 95129d7a35
35 changed files with 1599 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/operator-runbook.md
View file

@ -18,6 +18,23 @@ and to produce a finding against the fixture with its tenant predicate removed.
`evidence/offline-calibration.json` is calibration evidence, not target
assurance.
## Test plane
Live execution is gated by [`docs/test-plane.md`](test-plane.md). Before any
target run:
```sh
PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets
PYTHONPATH=src python3 -m whitehat_security.cli kill-switch
```
`admit-plane` must succeed against a **new** engagement ID. The default live
broker is unconnected and fails closed without requesting a credential.
Create `plane/KILL` to abort independently of the runner.
Cancelled IDs `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are
retired.
## Prepare a target run
1. Select the target's probe pack and review every route with its owner.
@ -27,10 +44,11 @@ assurance.
4. Provision only the two disposable tenants/objects named in the record.
5. Obtain the ordinary modeled credential through its custody lane. Do not put
its value in the record or shell history.
6. Validate within the approved window:
6. Validate within the approved window, then admit the plane:
```sh
PYTHONPATH=src python3 -m whitehat_security.cli validate-engagement engagements/<record>.json
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json
```
7. Confirm target identity/revision and probe attribution before the first
@ -61,7 +79,9 @@ unexpected response by broadening routes, identities, discovery, or privilege.
proven; otherwise `pass`.
- Validate the record against `schemas/run-report.schema.json`.
- Route both passing and finding target reports to `risk-nexus`; never assign
severity. The message formatter is `whitehat risk-message <report.json>`.
severity. Queue the delivery with `whitehat deliver <report.json>` (fixture
calibration is refused). The message formatter is
`whitehat risk-message <report.json>`.
- Schedule the next run from the target's declared cadence.
No target run is complete until its dated report and risk-nexus delivery are