coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add governed test plane and close T04/T08

Browse source 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
tegwick 2026-08-22 00:44:21 +02:00
parent 0aab0cb4c6
commit 95129d7a35
35 changed files with 1599 additions and 103 deletions
Download patch file Download diff file Expand all files Collapse all files

40
tests/test_cli.py
View file

@ -12,3 +12,43 @@ def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
main(["validate-engagement", str(path)])
assert stopped.value.code == 2
assert capsys.readouterr().err.startswith("not authorized:")
def test_validate_targets_accepts_catalog(capsys):
main(["validate-targets", "targets"])
assert capsys.readouterr().out.startswith("validated 4 target registrations")
def test_kill_switch_is_clear_by_default(capsys):
main(["kill-switch"])
assert capsys.readouterr().out.strip() == "clear"
def test_admit_plane_refuses_cancelled_engagement(capsys):
with pytest.raises(SystemExit) as stopped:
main([
"admit-plane",
"engagements/2026-08-21-audit-core-e2.json",
"targets/audit-core-e2.json",
])
assert stopped.value.code == 2
assert "not authorized:" in capsys.readouterr().err
def test_deliver_refuses_fixture_calibration(tmp_path, capsys):
report = tmp_path / "fixture.json"
report.write_text(json.dumps({
"schema_version": "whitehat-run/v1", "run_id": "run-1",
"evidence_class": "fixture", "engagement_id": "eng",
"authorization_id": "auth", "target": "fixture-e2",
"target_revision": "local", "posture_claim": "E2",
"attacker_model": "E2", "started_at": "2026-08-22T00:00:00Z",
"ended_at": "2026-08-22T00:01:00Z", "outcome": "pass",
"attempted_operations": 1, "cleanup": "n/a",
"credential_revocation": "n/a", "probes": [], "limitations": [],
"assurance_statement": "not proof",
}), encoding="utf-8")
with pytest.raises(SystemExit) as stopped:
main(["deliver", str(report), "--outbox", str(tmp_path / "outbox")])
assert stopped.value.code == 2
assert "fixture evidence" in capsys.readouterr().err