Add governed test plane and close T04/T08
Encode fail-closed admission, target registrations, and a credential broker that never returns secret values. Calibrate audit-core shaped probes in-process. Send no packets and request no live credentials. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
parent
0aab0cb4c6
commit
95129d7a35
35 changed files with 1599 additions and 103 deletions
|
|
@ -89,8 +89,10 @@ Drafted in `docs/rules-of-engagement.md` on 2026-08-18 with authorization
|
|||
classes, per-run records, initial target envelope, hard prohibitions,
|
||||
credential/attribution rules, rate defaults, abort/cleanup and evidence
|
||||
schema. The operator accepted v0.1 on 2026-08-21 with the scope recorded in
|
||||
§10. The acceptance approves the operating rules and offline fixture work; it
|
||||
does not pre-authorize any live target.
|
||||
what is now §11. v0.2 (2026-08-22) adds §10, the governed test plane, as a
|
||||
stricter admission control. It does not expand authorization. The acceptance
|
||||
approves the operating rules and offline fixture work; it does not
|
||||
pre-authorize any live target.
|
||||
|
||||
### T02 — The attacker model per axis
|
||||
|
||||
|
|
@ -141,30 +143,31 @@ The core technique: run the same request as two tenants and compare.
|
|||
produced ordinary-looking responses, a 403 and a 404, and nothing alerted.
|
||||
- Capture evidence as a count and a schema shape, never as tenant data (T01).
|
||||
|
||||
**Acceptance:** run against `tenant-engine` and `audit-core`, both of which
|
||||
currently claim `E2`. The artifact is the run record, not a green tick.
|
||||
**Acceptance:** a dated run record against every *applicable* E2 target. The
|
||||
artifact is the run record, not a green tick. `tenant-engine` is registered
|
||||
`not_applicable` for E2; that record is the artifact for that target.
|
||||
`audit-core` remains the live E2 target and still needs a new admitted
|
||||
engagement.
|
||||
|
||||
Implementation progress, 2026-08-21: `src/whitehat_security/differential.py`
|
||||
now performs owner/attacker/absent comparisons, detects fixture disclosure and
|
||||
write-side state change, and persists only sanitized observations. Concrete
|
||||
route inventories live in `probe-packs/tenant-engine-e2.json` and
|
||||
`probe-packs/audit-core-e2.json`. The two target runs remain gated on complete
|
||||
engagement records, owner acknowledgements and executable identity adapters.
|
||||
Implementation progress, 2026-08-22: `src/whitehat_security/differential.py`
|
||||
performs owner/attacker/absent comparisons, detects fixture disclosure and
|
||||
write-side state change, and persists only sanitized observations. Live entry
|
||||
is `execute_authorized`, which requires a plane lease. Concrete route
|
||||
inventories live in `probe-packs/`. Target honesty lives in `targets/`:
|
||||
`audit-core` is applicable; `tenant-engine` is `not_applicable` (that is the
|
||||
artifact, not a deferral); `flex-auth` is pending.
|
||||
|
||||
Production engagements were operator-approved on 2026-08-21 and committed in
|
||||
`engagements/`. Audit-core accepted the route/identity shape and reviewed the
|
||||
adapter; its first review caught a missing idempotency header before traffic,
|
||||
which is corrected and regression-tested. `docs/target-applicability.md`
|
||||
records a separate issue: tenant-engine currently exposes no authenticated
|
||||
tenant-A identity with no tenant-B authority, so its E2 applicability is
|
||||
pending owner confirmation rather than being faked with its all-tenant service
|
||||
operator or an unauthenticated actor.
|
||||
The 2026-08-21 production engagement IDs were cancelled without sending a
|
||||
target request and are retired. A live audit-core run still needs a **new**
|
||||
engagement, target-owner acknowledgement, provisioned `whitehat` namespace,
|
||||
and a connected custody broker. Whitehat will not relabel tenant-engine to
|
||||
finish this task.
|
||||
|
||||
### T04 — Prove the probes fail
|
||||
|
||||
```task
|
||||
id: WHITEHAT-WP-0001-T04
|
||||
status: progress
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "a2afc0f5-3ece-410c-864c-829a8aac30fc"
|
||||
```
|
||||
|
|
@ -179,12 +182,13 @@ the same discipline applies here and is not optional.
|
|||
**Acceptance:** every probe in T03 demonstrated failing before any of them is
|
||||
trusted passing.
|
||||
|
||||
Implementation progress, 2026-08-21: five generic read/list/create/update/
|
||||
delete probes pass the enforcing in-process fixture and all five produce
|
||||
findings when its tenant predicate is removed. The sanitized artifact is
|
||||
`evidence/offline-calibration.json`; fourteen tests guard the calibration and
|
||||
fail-closed authorization behavior. Target-specific probes are not trusted
|
||||
passing until they receive the same calibration.
|
||||
Completed 2026-08-22. Five generic read/list/create/update/delete probes and
|
||||
the three audit-core shaped probes pass the enforcing in-process fixture and
|
||||
all produce findings when the tenant predicate is removed. Tenant-engine has
|
||||
no applicable E2 identity, so its pack is not calibrated as if it were E2.
|
||||
`make fixture-evidence` refreshes `evidence/offline-calibration.json`.
|
||||
Target probes are still not trusted passing against a live service until a
|
||||
new admitted engagement runs.
|
||||
|
||||
### T05 — RLS conformance under attack (the E3 artifact)
|
||||
|
||||
|
|
@ -263,28 +267,56 @@ A **passing** run is also reported. "The attacks we thought of did not work" is
|
|||
the honest claim, and recording it dated is what lets anyone see how stale the
|
||||
assurance has become.
|
||||
|
||||
Implementation progress, 2026-08-21: `schemas/run-report.schema.json` defines
|
||||
the minimized evidence contract and `whitehat risk-message` renders both pass
|
||||
and finding deliveries without severity. Offline calibration is deliberately
|
||||
not routed as target assurance. Completion awaits the first authorized target
|
||||
report being delivered to `risk-nexus`.
|
||||
Implementation progress, 2026-08-22: `schemas/run-report.schema.json` defines
|
||||
the minimized evidence contract, `whitehat risk-message` renders both pass
|
||||
and finding deliveries without severity, and `whitehat deliver` queues a
|
||||
target report to `outbox/`. Fixture calibration is refused as target
|
||||
assurance. Completion awaits the first authorized target report being
|
||||
delivered to `risk-nexus`.
|
||||
|
||||
### T08 — Governed test plane
|
||||
|
||||
The 2026-08-22 cutoff's missing infrastructure, encoded here so live work can
|
||||
resume later without assembling authority during the run.
|
||||
|
||||
```task
|
||||
id: WHITEHAT-WP-0001-T08
|
||||
status: done
|
||||
priority: high
|
||||
```
|
||||
|
||||
Completed 2026-08-22 as a repository contract, not a cluster provision:
|
||||
|
||||
- Target registration schema and catalog, including an honest
|
||||
`not_applicable` state.
|
||||
- Fail-closed admission: retired IDs, kill switch, approval class, namespace,
|
||||
pinned digest, known-bad calibration, two identity handles.
|
||||
- Credential broker interface that never returns secret values. The live
|
||||
broker is unconnected and raises before any custody call.
|
||||
- Rate watcher, lease cleanup, default-deny plane manifests, runner identity.
|
||||
- Automatic outbox delivery of target reports only.
|
||||
|
||||
`ops-mason` still has to provision namespace, network policy and a real
|
||||
custody projection after a new engagement ID exists. That provision is not
|
||||
this task, and this task does not authorize it.
|
||||
|
||||
## Sequencing
|
||||
|
||||
T01 gates all. T02 shapes T03/T05/T06. T04 gates trusting any of them. T07 can
|
||||
follow T03.
|
||||
T01 gates all. T02 shapes T03/T05/T06. T04 gates trusting any of them. T08
|
||||
gates live T03. T07 can follow T03.
|
||||
|
||||
## Session cutoff — 2026-08-22
|
||||
|
||||
This session ends with the workplan deliberately **active**, not cosmetically
|
||||
complete. T01 and T02 are done. T03 through T07 remain in progress. The two
|
||||
The coordinating session ended with the workplan deliberately **active**. T01,
|
||||
T02, T04 and T08 are done. T03, T05, T06 and T07 remain in progress. The two
|
||||
dated production engagement records were cancelled without sending any target
|
||||
request; cancelled engagement IDs are terminal and must never be reused.
|
||||
|
||||
The offline instrument is implemented and calibrated, but the estate does not
|
||||
yet provide the governed test plane needed to exercise it routinely and safely.
|
||||
The exact completed scope, unresolved scope, and recommended restart boundary
|
||||
are recorded in `docs/session-cutoff-2026-08-22.md`.
|
||||
The offline instrument is implemented, calibrated, and plane-gated. The
|
||||
estate still has to provision the cluster plane and a value-safe credential
|
||||
broker before any live evidence exists. Resume only with new engagement IDs.
|
||||
The exact completed scope is recorded in `docs/session-cutoff-2026-08-22.md`
|
||||
and `docs/test-plane.md`.
|
||||
|
||||
## Risks
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue