coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add governed test plane and close T04/T08

Browse source 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 00:44:21 +02:00
parent 0aab0cb4c6
commit 95129d7a35
35 changed files with 1599 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/whitehat_security/differential.py
View file

@ -2,10 +2,11 @@ from __future__ import annotations
import os
from dataclasses import dataclass
from datetime import datetime
from typing import Callable
from .engagement import Engagement
from .model import Observation, ProbeResult, Response, observe
from .plane import PlaneLease
Request = Callable[[], Response]
State = Callable[[], object]
@ -49,12 +50,17 @@ def execute(probe: DifferentialProbe, *, salt: bytes | None = None) -> ProbeResu
)
def execute_authorized(probe: DifferentialProbe, *, engagement: Engagement,
route: str, salt: bytes | None = None) -> ProbeResult:
"""Live entry point: authorization is rechecked immediately before calls."""
engagement.validate()
engagement.permits(technique="e2-differential", route=route)
return execute(probe, salt=salt)
def execute_authorized(probe: DifferentialProbe, *, lease: PlaneLease,
route: str, salt: bytes | None = None,
now: datetime | None = None) -> ProbeResult:
"""Live entry point: plane admission is rechecked immediately before calls."""
lease.engagement.validate(now=now)
lease.permits(technique="e2-differential", route=route)
lease.watcher.acquire()
try:
return execute(probe, salt=salt)
finally:
lease.watcher.release()
def _equivalent_denial(left: Observation, right: Observation) -> bool: