coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add governed test plane and close T04/T08

Browse source 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 00:44:21 +02:00
parent 0aab0cb4c6
commit 95129d7a35
35 changed files with 1599 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

350
evidence/offline-calibration.json
View file

@ -1,5 +1,5 @@
{
"ended_at": "2026-08-21T21:51:31.697322Z",
"ended_at": "2026-08-21T22:43:03.740339Z",
"evidence_class": "fixture",
"expected": {
"known_bad": "finding",
@ -12,7 +12,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "eaad30a4dc5b105af70231b5a4e72b9fc61e64a73a24074f919efd6fb5f9e9ae",
"run_digest": "2804e68bca6d4652529b13014b55efa296eb81101726ff8d6634dff4b97c5f32",
"schema": [
"$",
"$.error:str"
@ -23,7 +23,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "5b9c2a46c8b84818280ce239e6bb01157bbcdf93165b8bfa97dd2c8c9121280f",
"run_digest": "6095953dfd3d463aa844f1c51d20745bb5c0c5a79ce223c7445e57b6c323cd31",
"schema": [
"$",
"$.id:str",
@ -36,7 +36,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "5b9c2a46c8b84818280ce239e6bb01157bbcdf93165b8bfa97dd2c8c9121280f",
"run_digest": "6095953dfd3d463aa844f1c51d20745bb5c0c5a79ce223c7445e57b6c323cd31",
"schema": [
"$",
"$.id:str",
@ -60,7 +60,7 @@
"content_type": "application/json",
"count": 0,
"fixture_match_count": 0,
"run_digest": "de0385fce9a44845bc70a21d8561a6b3211538b2c32d9b35789042dfe594f223",
"run_digest": "4a8cefe3ea0fa3fb888d8c578dd227c6a12216868da197f82b1e4de23aedd0f0",
"schema": [
"$",
"$.items[]"
@ -71,7 +71,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "3985d8408fbce3de8f6cd6dbf9b2d70257bbaee903cc5bc5a3da61610f6689c0",
"run_digest": "29e86fd84a1c6aa038d8d1278d52c4470135bcc81db39b800940132e2761bc7b",
"schema": [
"$",
"$.items[]",
@ -86,7 +86,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "3985d8408fbce3de8f6cd6dbf9b2d70257bbaee903cc5bc5a3da61610f6689c0",
"run_digest": "29e86fd84a1c6aa038d8d1278d52c4470135bcc81db39b800940132e2761bc7b",
"schema": [
"$",
"$.items[]",
@ -111,7 +111,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "857d9822bdfb939e4f126efa577be8d4a9e64ab023f5d611ca581498a963d048",
"run_digest": "4a2f56562162e6bb6745ca18b8e7325c9565235506d3870bb907ba588ac4fadc",
"schema": [
"$",
"$.error:str"
@ -122,7 +122,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 2,
"run_digest": "06e7ab37f09fcbcb142cf1d09927885685ef9f9d273f2ec49186c40a16c04c18",
"run_digest": "5e5ea8b63082ebc7bcce23fd5b66098a2e4ee092dba8a1c4c2a562e70e7c9550",
"schema": [
"$",
"$.id:str",
@ -134,7 +134,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "bf9bfc96947e5da52b13b9e027ad6f5c115da06c05dc7c79b82ea6b3a6514965",
"run_digest": "3a686f08bad5214b56d3e0aa05c141998519809e5cb16499c3f3784a0becbe4a",
"schema": [
"$",
"$.id:str"
@ -156,7 +156,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "65bb2998672433c35d92bdb9b15965b2eb72776280b5cecc95c9d94e9149af12",
"run_digest": "44a1c9a896f575f82c40a744d41519a1f84469cfe22fc889f6f68756da57d77f",
"schema": [
"$",
"$.error:str"
@ -167,7 +167,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "7e3e05697523dde79079b1a5cf6ed50e12177962742b8b7ddcf62d025daad6ad",
"run_digest": "f48030bb08aa0d07380f0cec2ff0f919c5312fa780e3388984e8d4873440189f",
"schema": [
"$",
"$.id:str",
@ -180,7 +180,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "49d1b1ff789c3cf3709f0e7fe0041dc6cdbbfc7106ee736bb9d8acfcbb13568b",
"run_digest": "5baf8016840cabb74202e381f5f163a463c1279382d8f74332f3b602f1c9704e",
"schema": [
"$",
"$.id:str",
@ -205,7 +205,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "15604312df72ed94d0b08f047fbe1e185e3bd6f49e41cb6cb6b779ba0c06be0a",
"run_digest": "6d9c1f7d5d5c20afb8d8337ba4214e04be05e1b2336edc6263720c2f349a04cc",
"schema": [
"$",
"$.error:str"
@ -216,7 +216,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 1,
"run_digest": "ec66dc06c3b3202bc3e2f233c0eed22848106a5dbb2d39ca90233bfbb853e852",
"run_digest": "32d054c129bb639b1beb7b8ca83a9556b88558facc84132e9fec63950cb4e66d",
"schema": [
"$",
"$.deleted:str"
@ -227,7 +227,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "961561666050ffa3e74a3ccf98a27859fd657a962767ff7a507cb6cca7a1cd5b",
"run_digest": "3853f8bf9f473716ce4fced2d44f3a58b411c078afc6f131b4a47eda4929f798",
"schema": [
"$",
"$.id:str",
@ -245,6 +245,154 @@
"tenant-B fixture state changed",
"attacker response differs from the absent-object reference"
]
},
{
"observations": {
"absent": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "b6638dcf2a3cf24a99ea503a0661f8ec3011b22689bdd6777c98693e4d49f80c",
"schema": [
"$",
"$.error:str"
],
"status": 404
},
"attacker": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "099b50b271a61251f76de35b36f832e9d52711cdd3d2e086464e52f8ab075ec7",
"schema": [
"$",
"$.correlation_id:str",
"$.id:str",
"$.label:str",
"$.tenant:str"
],
"status": 200
},
"owner": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "099b50b271a61251f76de35b36f832e9d52711cdd3d2e086464e52f8ab075ec7",
"schema": [
"$",
"$.correlation_id:str",
"$.id:str",
"$.label:str",
"$.tenant:str"
],
"status": 200
}
},
"operation": "read",
"outcome": "finding",
"probe_id": "audit-event-by-id",
"reasons": [
"attacker response contains a tenant-B fixture marker",
"attacker response differs from the absent-object reference"
]
},
{
"observations": {
"absent": {
"content_type": "application/json",
"count": 0,
"fixture_match_count": 0,
"run_digest": "738fa714a179543df7c4cdf663dcd27d2c636e73a5c6aa006c07b083d513dd0d",
"schema": [
"$",
"$.events[]"
],
"status": 200
},
"attacker": {
"content_type": "application/json",
"count": 2,
"fixture_match_count": 3,
"run_digest": "02a06a47c2f9de17df2d857b945d5629196e74d40314e0a1842e1f728a440c8d",
"schema": [
"$",
"$.events[]",
"$.events[]",
"$.events[].correlation_id:str",
"$.events[].id:str",
"$.events[].label:str",
"$.events[].tenant:str"
],
"status": 200
},
"owner": {
"content_type": "application/json",
"count": 2,
"fixture_match_count": 3,
"run_digest": "02a06a47c2f9de17df2d857b945d5629196e74d40314e0a1842e1f728a440c8d",
"schema": [
"$",
"$.events[]",
"$.events[]",
"$.events[].correlation_id:str",
"$.events[].id:str",
"$.events[].label:str",
"$.events[].tenant:str"
],
"status": 200
}
},
"operation": "read",
"outcome": "finding",
"probe_id": "audit-correlation-slice",
"reasons": [
"attacker response contains a tenant-B fixture marker"
]
},
{
"observations": {
"absent": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "a8ee76d5c9e51366ae25603241b71d3377f08f3aaded0ff1537b8f1f9640b851",
"schema": [
"$",
"$.error:str"
],
"status": 403
},
"attacker": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 2,
"run_digest": "f57a7a61abe2d3e7b3af734900863d295a4b6eed8579729b86ad75d73dcb85bb",
"schema": [
"$",
"$.id:str",
"$.tenant:str"
],
"status": 202
},
"owner": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "2801a3c1b5f46865ac24d24a748dc7124ac3982b85dd20bdb596c033c008708f",
"schema": [
"$",
"$.id:str"
],
"status": 202
}
},
"operation": "create",
"outcome": "finding",
"probe_id": "audit-append-as-b",
"reasons": [
"attacker response contains a tenant-B fixture marker",
"tenant-B fixture state changed"
]
}
],
"known_good": [
@ -254,7 +402,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "eddeeb2191de71535b4d2c06a88807ba797dff4b2c13481f06c522e0315bb7ea",
"run_digest": "056e35eda0bacdda3e2a862a5e325f5fe090b8090f83037b5172200ff7b0e6dc",
"schema": [
"$",
"$.error:str"
@ -265,7 +413,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "eddeeb2191de71535b4d2c06a88807ba797dff4b2c13481f06c522e0315bb7ea",
"run_digest": "056e35eda0bacdda3e2a862a5e325f5fe090b8090f83037b5172200ff7b0e6dc",
"schema": [
"$",
"$.error:str"
@ -276,7 +424,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "13c9649399717d67dec6441a3e6ee046a389a84549fc39538548bb7e2496df37",
"run_digest": "49ea6432de7c9a88d2b32a4601d4fa811436909127084edaed522c28bc627235",
"schema": [
"$",
"$.id:str",
@ -297,7 +445,7 @@
"content_type": "application/json",
"count": 0,
"fixture_match_count": 0,
"run_digest": "db750d043a8e87c08f86b35735cbde33060236fbf673934edd16a2ef8077b314",
"run_digest": "61f8492a8388851bdfe14592a200635255cbe24d068f524ae6de9d6b68260c3d",
"schema": [
"$",
"$.items[]"
@ -308,7 +456,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "a1cbcf47d0c2f17a97abc59e2a559729fc027337f4360be44287764a6b061e7e",
"run_digest": "3add37393c96826ead72b129dbf8ac0efd07c254231a7a5a40640d953e82320e",
"schema": [
"$",
"$.items[]",
@ -323,7 +471,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "1ce9addbaf53fb9dd8ced38fd0bbd237e7d338ac3ad31a2d8e06e168620d91c6",
"run_digest": "479d2a3ab215dd0a629ca719163e1454439b782193e5202bf34e65c0c3a7ccf9",
"schema": [
"$",
"$.items[]",
@ -346,7 +494,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "2375ef32a41c0e05c19b2e362c0b2d1e490b0ecf863b7db9a3fb2c7824650f88",
"run_digest": "e33ae1117bfbf3ea0f2beee3ada7a4b2e7105e3f8ff9ea0f32e1a458e97c8277",
"schema": [
"$",
"$.error:str"
@ -357,7 +505,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "2375ef32a41c0e05c19b2e362c0b2d1e490b0ecf863b7db9a3fb2c7824650f88",
"run_digest": "e33ae1117bfbf3ea0f2beee3ada7a4b2e7105e3f8ff9ea0f32e1a458e97c8277",
"schema": [
"$",
"$.error:str"
@ -368,7 +516,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "93a604c1def0003e5ba2ac6bb71607adfaa5ad27e6f314c9e135d22ed91f4d50",
"run_digest": "11a2bc634aa1f2cda1bb7f137339bc47f69c21f025b47fa6fd5795c0840b4adf",
"schema": [
"$",
"$.id:str"
@ -387,7 +535,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "128ec07ad319e1bd03582118fcb672edee8bdb90cf04259fd1c70565a49dfb24",
"run_digest": "31c30991423c8f2d3dd4757e0fdd188b37f6470a6babad1d9700aef0f451da32",
"schema": [
"$",
"$.error:str"
@ -398,7 +546,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "128ec07ad319e1bd03582118fcb672edee8bdb90cf04259fd1c70565a49dfb24",
"run_digest": "31c30991423c8f2d3dd4757e0fdd188b37f6470a6babad1d9700aef0f451da32",
"schema": [
"$",
"$.error:str"
@ -409,7 +557,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "39041e5495f98db586db32437188e52a4d1afe349f9b29f1fcbb8c2ed163f750",
"run_digest": "fb069aca7ea87059083bee9517d11d411a68e8b1ba88a1bf59394f11c6ab83c2",
"schema": [
"$",
"$.id:str",
@ -430,7 +578,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "d494c9a631fb3af8ad9a36c369d6633d5baa727b078f1740c1e08fc811834959",
"run_digest": "9205aee8ba243fc42f8ccf89fad98523c85c39adaa2311e9263512b2cc6faa9e",
"schema": [
"$",
"$.error:str"
@ -441,7 +589,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "d494c9a631fb3af8ad9a36c369d6633d5baa727b078f1740c1e08fc811834959",
"run_digest": "9205aee8ba243fc42f8ccf89fad98523c85c39adaa2311e9263512b2cc6faa9e",
"schema": [
"$",
"$.error:str"
@ -452,7 +600,7 @@
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "a5ea7cb1c5b72a7b06f989181b4ff39debe887134fcc69c0053602dbc82b98da",
"run_digest": "681e463a7d41ce5ff05da5bc75241a0a176e8a6c1fdb19e1e88cc8f9490e023b",
"schema": [
"$",
"$.id:str",
@ -466,6 +614,142 @@
"outcome": "pass",
"probe_id": "delete-b",
"reasons": []
},
{
"observations": {
"absent": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "e41d24b31b123d4a33e4d94a1015005694eeb0d00cf243b6238ac76ce28020e7",
"schema": [
"$",
"$.error:str"
],
"status": 404
},
"attacker": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "e41d24b31b123d4a33e4d94a1015005694eeb0d00cf243b6238ac76ce28020e7",
"schema": [
"$",
"$.error:str"
],
"status": 404
},
"owner": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "4308d43196348f1b1e55796f2e27b89c90371261e7d0472706778ad60562ab70",
"schema": [
"$",
"$.correlation_id:str",
"$.id:str",
"$.label:str",
"$.tenant:str"
],
"status": 200
}
},
"operation": "read",
"outcome": "pass",
"probe_id": "audit-event-by-id",
"reasons": []
},
{
"observations": {
"absent": {
"content_type": "application/json",
"count": 0,
"fixture_match_count": 0,
"run_digest": "014cf19c288b1c2a1411f08523dac6664bd2f62418148b9ff7f6875ab3f30d53",
"schema": [
"$",
"$.events[]"
],
"status": 200
},
"attacker": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "603bc2c5c8f8f643d2bc9c1822e5a8c3414b181aab311410c6ae753ec50d56c3",
"schema": [
"$",
"$.events[]",
"$.events[]",
"$.events[].correlation_id:str",
"$.events[].id:str",
"$.events[].label:str",
"$.events[].tenant:str"
],
"status": 200
},
"owner": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 3,
"run_digest": "e2715b7b38e5f4141f6017e362301cd27219f0e591bab2250679815eb6a3b937",
"schema": [
"$",
"$.events[]",
"$.events[]",
"$.events[].correlation_id:str",
"$.events[].id:str",
"$.events[].label:str",
"$.events[].tenant:str"
],
"status": 200
}
},
"operation": "read",
"outcome": "pass",
"probe_id": "audit-correlation-slice",
"reasons": []
},
{
"observations": {
"absent": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "ead0052d3e827ac7333f98a802459109362838131fd81e6a14c74809b320195d",
"schema": [
"$",
"$.error:str"
],
"status": 403
},
"attacker": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "ead0052d3e827ac7333f98a802459109362838131fd81e6a14c74809b320195d",
"schema": [
"$",
"$.error:str"
],
"status": 403
},
"owner": {
"content_type": "application/json",
"count": 1,
"fixture_match_count": 0,
"run_digest": "f84797611f1a1c39fbfd93d06e7007352ea47fa87250613c56df52a64a6322c4",
"schema": [
"$",
"$.id:str"
],
"status": 202
}
},
"operation": "create",
"outcome": "pass",
"probe_id": "audit-append-as-b",
"reasons": []
}
],
"limitations": [
@ -473,7 +757,7 @@
"No network request, database connection, or live credential was used."
],
"outcome": "pass",
"run_id": "fixture-calibration-2026-08-21T21:51:31.696239Z",
"run_id": "fixture-calibration-2026-08-21T22:43:03.737244Z",
"schema_version": "whitehat-calibration/v1",
"started_at": "2026-08-21T21:51:31.696239Z"
"started_at": "2026-08-21T22:43:03.737244Z"
}