Add governed test plane and close T04/T08

Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

targets/README.md

@@ -0,0 +1,14 @@
+# Target registrations
+
+A target name is not an E2 boundary. Each file in this directory is the
+honest applicability record the test plane admits against.
+
+| `target_id` | Applicability | Meaning |
+| --- | --- | --- |
+| `fixture-e2` | applicable | In-process known-good/known-bad harness. Offline only. |
+| `audit-core` | applicable | Two ordinary tenant-scoped senders instantiate E2. Live run still needs a new engagement and plane lease. |
+| `tenant-engine` | not_applicable | No tenant-A identity without tenant-B authority. |
+| `flex-auth` | pending | Initial envelope; owner has not confirmed the attacker identity. |
+
+`not_applicable` is a completed artifact, not a deferral. Do not relabel it to
+close a workplan. Do not reuse cancelled engagement IDs from `engagements/`.

targets/audit-core-e2.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "audit-core",
+  "posture_claim": "implemented E2; currently evidenced E1",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "applicability": "applicable",
+  "applicability_reason": "audit-core binds each sender token to a tenant set at one choke point. Two ordinary tenant-scoped senders instantiate the E2 model without operator or database privilege.",
+  "approval_classes": ["live-e2"],
+  "adapter": "runners/audit_core_e2.py",
+  "probe_pack": "probe-packs/audit-core-e2.json",
+  "known_bad_calibration": "src/whitehat_security/audit_fixtures.py",
+  "fixture_lifecycle": {
+    "create": "append two synthetic events and one reserved absent id",
+    "delete": "named immutable audit fixtures retained by target contract unless the owner provides a delete",
+    "ids_are_synthetic": true
+  },
+  "egress": "http://audit-core.audit-core.svc.cluster.local:8080",
+  "routes": [
+    "GET /readyz",
+    "POST /v1/events",
+    "GET /v1/events/{event_id}",
+    "GET /v1/events?correlation_id={correlation_id}"
+  ],
+  "identities": {
+    "count": 2,
+    "role": "ordinary tenant-scoped may_read/may_write fixture senders",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e2/audit-core"
+  },
+  "abort_telemetry": [
+    "p95_latency_ms",
+    "probe_attributable_5xx",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution"
+  ]
+}

targets/fixture-e2.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "fixture-e2",
+  "posture_claim": "E2",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "applicability": "applicable",
+  "applicability_reason": "In-process known-good/known-bad service created by this repository. It instantiates tenant A with no tenant B authority.",
+  "approval_classes": ["fixture-e2"],
+  "adapter": "src/whitehat_security/fixtures.py",
+  "probe_pack": "src/whitehat_security/fixtures.py",
+  "known_bad_calibration": "src/whitehat_security/fixtures.py",
+  "fixture_lifecycle": {
+    "create": "in-process constructor",
+    "delete": "drop process state",
+    "ids_are_synthetic": true
+  },
+  "egress": "in-process",
+  "routes": [
+    "GET /objects/{id}",
+    "GET /objects?tenant={tenant_id}",
+    "POST /objects",
+    "PATCH /objects/{id}",
+    "DELETE /objects/{id}"
+  ],
+  "identities": {
+    "count": 2,
+    "role": "ordinary tenant-scoped fixture actor",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e2/fixture"
+  },
+  "abort_telemetry": [
+    "p95_latency_ms",
+    "probe_attributable_5xx",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution"
+  ]
+}

targets/flex-auth-e2.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "flex-auth",
+  "posture_claim": "E2",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "applicability": "pending",
+  "applicability_reason": "Named in the initial envelope. No target-owner confirmation yet that a relationship-inheritance decision can be exercised as tenant A without tenant B authority.",
+  "approval_classes": ["live-e2"],
+  "routes": [],
+  "identities": {
+    "count": 2,
+    "role": "ordinary tenant-scoped decision subject; unconfirmed",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e2/flex-auth"
+  },
+  "abort_telemetry": [
+    "p95_latency_ms",
+    "probe_attributable_5xx",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution"
+  ]
+}

targets/tenant-engine-e2.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "tenant-engine",
+  "posture_claim": "implemented E2; currently evidenced E1",
+  "attacker_model": "E2-authenticated-tenant-a",
+  "applicability": "not_applicable",
+  "applicability_reason": "No authenticated tenant-A identity with no tenant-B authority exists. The platform operator is allowed to address every tenant; an unregistered actor tests caller authorization, not E2. Whitehat will not substitute either identity to finish the workplan.",
+  "approval_classes": ["live-e2"],
+  "routes": [],
+  "identities": {
+    "count": 2,
+    "role": "ordinary tenant-scoped caller; none currently exposed",
+    "ttl_seconds": 900,
+    "broker_audience": "whitehat-e2/tenant-engine"
+  },
+  "abort_telemetry": [
+    "p95_latency_ms",
+    "probe_attributable_5xx",
+    "unexpected_or_non_fixture_data",
+    "missing_attribution"
+  ]
+}