coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add governed test plane and close T04/T08

Browse source 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 00:44:21 +02:00
parent 0aab0cb4c6
commit 95129d7a35
35 changed files with 1599 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/rules-of-engagement.md
View file

@ -2,7 +2,7 @@
Status: **accepted**
Version: 0.1
Version: 0.2
Date: 2026-08-18
@ -137,7 +137,24 @@ known-bad fixture pass is a finding until independently explained. Every live
probe must first fail against its known-bad fixture and pass against the
known-good fixture in the same revision.
## 10. Approval
## 10. Governed test plane
Live runs are admitted only through the test plane documented in
[`test-plane.md`](test-plane.md): dedicated namespace, default-deny networking,
projected short-lived identities, registered target, kill switch, rate watcher
and lease cleanup. The plane is a control, not authorization.
`fixture-e2` is the in-process class already permitted by §1. `live-e2` still
requires the dated engagement record, target-owner acknowledgement and
technique-specific operator approval required by §1, plus plane admission.
`e3`, recovery, saturation and destructive techniques keep separate explicit
approval classes and are not admitted by the E2 plane.
Cancelled engagement identifiers are terminal and must not be reused.
This section authorizes no live target and no packet.
## 11. Approval
Approved by: **repository operator**, by explicit approval in the coordinating
session
@ -149,3 +166,6 @@ Approved scope: these rules are accepted as the operating boundary for
fixture work. It does **not** authorize a live target or a packet to any target.
Every live run still requires the engagement record, target-owner
acknowledgement and any technique-specific operator approval required by §1.
v0.2 (2026-08-22) adds §10. It tightens admission; it does not expand
authorization or replace the 2026-08-21 acceptance.