Prepare receipt-bound audit E2 third attempt
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
parent
0525e632d7
commit
96d6781036
12 changed files with 440 additions and 27 deletions
69
engagements/2026-08-22-audit-core-e2-03.json
Normal file
69
engagements/2026-08-22-audit-core-e2-03.json
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
"engagement_id": "WH-ENG-20260822-AUDIT-E2-03",
|
||||
"status": "proposed",
|
||||
"proposal_at": "2026-08-22T21:15:00Z",
|
||||
"proposal_reason": "Fresh attended attempt after -02 proved exact cleanup and exposed the now-implemented WP-0025 custody receipt handoff. No terminal identifier, identity, tenant, object, or Kubernetes Secret is reused.",
|
||||
"authorization_id": "operator-session-2026-08-22-e2-03-approval",
|
||||
"authorizer": "pending explicit repository operator approval",
|
||||
"approved_at": "",
|
||||
"expires_at": "2026-08-22T22:15:00Z",
|
||||
"target": "http://audit-core.audit-core.svc.cluster.local:8080",
|
||||
"target_id": "audit-core",
|
||||
"target_owner": "audit-core / infrastructure operator",
|
||||
"target_owner_acknowledged_at": "",
|
||||
"target_owner_acknowledgement_status": "pending direct review after operator approval",
|
||||
"environment": "production",
|
||||
"production_approval": "pending explicit approval of this exact -03 package",
|
||||
"approval_class": "live-e2",
|
||||
"plane_namespace": "whitehat",
|
||||
"runner_image_digest": "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
|
||||
"namespace": "whitehat",
|
||||
"source": "dedicated pod whitehat/whitehat-e2-audit-03, labels whitehat.security/plane=true, whitehat.security/target=audit-core, whitehat.security/engagement=WH-ENG-20260822-AUDIT-E2-03, serviceAccount whitehat-runner, automountServiceAccountToken=false",
|
||||
"source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
|
||||
"control_plane_scope": [
|
||||
"GET apps/v1 deployment audit-core/audit-core for target revision only",
|
||||
"GET v1 service audit-core/audit-core for target identity only",
|
||||
"CREATE/GET/EXEC/DELETE v1 pod whitehat/whitehat-e2-audit-03 only; EXEC may stream runners/audit_core_e2.py to python3 stdin and invoke no other program",
|
||||
"mount but never GET v1 secret whitehat/whitehat-e2-audit-credentials-03 provisioned by the custody owner",
|
||||
"GET pod log whitehat/whitehat-e2-audit-03 only"
|
||||
],
|
||||
"routes": [
|
||||
"GET /readyz",
|
||||
"POST /v1/events",
|
||||
"GET /v1/events/{event_id}",
|
||||
"GET /v1/events?correlation_id={correlation_id}"
|
||||
],
|
||||
"fixture_ids": [
|
||||
"tenant:trial:whitehat-a-20260822-03", "tenant:trial:whitehat-b-20260822-03",
|
||||
"whitehat-e2-event-a-20260822-03", "whitehat-e2-event-b-20260822-03",
|
||||
"whitehat-e2-absent-20260822-03", "whitehat-e2-forged-b-20260822-03",
|
||||
"whitehat-e2-correlation-20260822-03"
|
||||
],
|
||||
"credential_lane": "RAILIANCE-WP-0025 canonical value-safe custody receipts; no credential value retained",
|
||||
"credential_role": "two temporary ordinary tenant-scoped may_read/may_write fixture senders bound to source=whitehat-security",
|
||||
"credential_max_ttl_seconds": 900,
|
||||
"techniques": ["e2-differential"],
|
||||
"prohibited_techniques": [
|
||||
"discovery", "direct-database-access", "saturation", "large-payload",
|
||||
"real-data-collection", "adjacent-service-follow-up",
|
||||
"any control-plane operation outside control_plane_scope"
|
||||
],
|
||||
"rate_limit_per_minute": 10,
|
||||
"max_concurrency": 1,
|
||||
"maximum_requests": 30,
|
||||
"window_start": "2026-08-22T22:00:00Z",
|
||||
"window_end": "2026-08-22T22:15:00Z",
|
||||
"operator_contact": "repository operator in coordinating session",
|
||||
"abort_contact": "repository operator in coordinating session",
|
||||
"abort_thresholds": {
|
||||
"p95_latency_ms": 500,
|
||||
"probe_attributable_5xx": 1,
|
||||
"unexpected_or_non_fixture_data": 1,
|
||||
"missing_attribution": 1
|
||||
},
|
||||
"posture_claim": "implemented E2; currently evidenced E1",
|
||||
"attacker_model": "E2-authenticated-tenant-a",
|
||||
"finding_destination": "risk-nexus",
|
||||
"plane_bundle_digest": "9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035",
|
||||
"target_ingress": "audit-core-whitehat-ingress at audit-core 5b5196e; namespace=whitehat AND whitehat.security/plane=true AND whitehat.security/target=audit-core"
|
||||
}
|
||||
13
engagements/2026-08-22-audit-core-e2-03.md
Normal file
13
engagements/2026-08-22-audit-core-e2-03.md
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# WH-ENG-20260822-AUDIT-E2-03
|
||||
|
||||
Status: **proposed** for `2026-08-22T22:00:00Z`–`22:15:00Z`.
|
||||
|
||||
This is a fresh, terminal-unique attempt. It does not reuse the `-01` or `-02`
|
||||
identifier, senders, tenants, objects, mounted Secret, or runner pod. The
|
||||
projection gate closes at `22:03:00Z`; all custody resources expire and must be
|
||||
cleaned by `22:15:00Z`.
|
||||
|
||||
The run uses the canonical RAILIANCE-WP-0025 projection contract, Whitehat
|
||||
broker-readiness receipt, projection receipt, contract-bound `admit-plane`,
|
||||
cleanup receipt, and finalized report. No live action is authorized while this
|
||||
record remains proposed.
|
||||
|
|
@ -1,16 +1,20 @@
|
|||
# Projection receipts
|
||||
|
||||
Copy `example-projection-receipt.json` at window start and fill in the live
|
||||
engagement id, `projected_at`, `expires_at`, and identity *names* from the
|
||||
custody procedure. Never put token values, passwords, or registry payloads
|
||||
here.
|
||||
Legacy value-safe receipts remain supported for historical fixtures. New live
|
||||
engagements use the canonical RAILIANCE-WP-0025 contract, broker-readiness,
|
||||
projection, and cleanup receipts. Never hand-edit a live receipt or put token
|
||||
values, passwords, or registry payloads here.
|
||||
|
||||
Live admission:
|
||||
|
||||
```sh
|
||||
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane \
|
||||
engagements/<record>.json targets/audit-core-e2.json \
|
||||
--receipt engagements/receipts/<engagement>.json
|
||||
--receipt /approved/path/projection.json \
|
||||
--contract /approved/path/projection-contract.json \
|
||||
--broker-receipt /approved/path/broker.json
|
||||
```
|
||||
|
||||
Without `--receipt`, live admission fails closed and requests no credential.
|
||||
Without all three bound documents, WP-0025 admission fails closed and requests
|
||||
no credential. After platform cleanup, use `finalize-report` with the cleanup
|
||||
receipt before delivery.
|
||||
|
|
|
|||
113
engagements/runtime/WH-ENG-20260822-AUDIT-E2-03-invocation.md
Normal file
113
engagements/runtime/WH-ENG-20260822-AUDIT-E2-03-invocation.md
Normal file
|
|
@ -0,0 +1,113 @@
|
|||
# WH-ENG-20260822-AUDIT-E2-03 — attended invocation
|
||||
|
||||
This package is proposed for `22:00Z`–`22:15Z`; projection closes at `22:03Z`.
|
||||
Do nothing live until the engagement and the exact WP-0025 contract are
|
||||
approved and audit-core has acknowledged them.
|
||||
|
||||
Runtime value-safe artifacts are written beneath
|
||||
`/tmp/WH-ENG-20260822-AUDIT-E2-03/`:
|
||||
|
||||
- `broker.json`
|
||||
- `projection.json`
|
||||
- `runner-report.json`
|
||||
- `cleanup.json`
|
||||
- `final-report.json`
|
||||
|
||||
The platform contract is
|
||||
`/home/worsch/railiance-platform/docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json`.
|
||||
|
||||
## Broker gate, projection, and admission
|
||||
|
||||
From `railiance-platform`, after approval and before the window:
|
||||
|
||||
```bash
|
||||
python3 scripts/wp0025-broker-readiness.py approve \
|
||||
--contract docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json \
|
||||
--consumer-root /home/worsch/whitehat-security \
|
||||
--reviewer whitehat-owner \
|
||||
--receipt-out /tmp/WH-ENG-20260822-AUDIT-E2-03/broker.json
|
||||
|
||||
python3 scripts/custody-projection.py preflight \
|
||||
--contract docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json
|
||||
```
|
||||
|
||||
At or after `22:00Z`, no later than `22:03Z`:
|
||||
|
||||
```bash
|
||||
python3 scripts/custody-projection.py project \
|
||||
--contract docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json \
|
||||
--confirm WH-ENG-20260822-AUDIT-E2-03:attended \
|
||||
--receipt-out /tmp/WH-ENG-20260822-AUDIT-E2-03/projection.json
|
||||
```
|
||||
|
||||
From `whitehat-security`, admit before applying the runner:
|
||||
|
||||
```bash
|
||||
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane \
|
||||
engagements/2026-08-22-audit-core-e2-03.json \
|
||||
targets/audit-core-e2.json \
|
||||
--receipt /tmp/WH-ENG-20260822-AUDIT-E2-03/projection.json \
|
||||
--contract /home/worsch/railiance-platform/docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json \
|
||||
--broker-receipt /tmp/WH-ENG-20260822-AUDIT-E2-03/broker.json
|
||||
```
|
||||
|
||||
## Runner
|
||||
|
||||
Only after admission succeeds:
|
||||
|
||||
```bash
|
||||
ssh -o BatchMode=yes railiance01 kubectl apply -f - \
|
||||
< engagements/runtime/whitehat-e2-audit-20260822-03.yaml
|
||||
ssh -o BatchMode=yes railiance01 kubectl -n whitehat wait \
|
||||
--for=condition=Ready pod/whitehat-e2-audit-03 --timeout=60s
|
||||
```
|
||||
|
||||
Stream `runners/audit_core_e2.py` to `python3 -` inside that pod with these
|
||||
exact arguments:
|
||||
|
||||
```text
|
||||
--base-url http://audit-core.audit-core.svc.cluster.local:8080
|
||||
--engagement-id WH-ENG-20260822-AUDIT-E2-03
|
||||
--authorization-id operator-session-2026-08-22-e2-03-approval
|
||||
--target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
|
||||
--token-a-file /var/run/secrets/whitehat/token-a
|
||||
--token-b-file /var/run/secrets/whitehat/token-b
|
||||
--tenant-a tenant:trial:whitehat-a-20260822-03
|
||||
--tenant-b tenant:trial:whitehat-b-20260822-03
|
||||
--event-a whitehat-e2-event-a-20260822-03
|
||||
--event-b whitehat-e2-event-b-20260822-03
|
||||
--absent-event whitehat-e2-absent-20260822-03
|
||||
--forged-event whitehat-e2-forged-b-20260822-03
|
||||
--correlation whitehat-e2-correlation-20260822-03
|
||||
--occurred-at 2026-08-22T22:00:00Z
|
||||
--rate 10 --max-requests 30 --abort-p95-ms 500
|
||||
```
|
||||
|
||||
The runner output is the sanitized `runner-report.json`. Delete the runner
|
||||
immediately after execution, whether it passes, finds, or aborts.
|
||||
|
||||
## Cleanup and report finalization
|
||||
|
||||
From `railiance-platform`, before `22:15Z`:
|
||||
|
||||
```bash
|
||||
python3 scripts/custody-projection.py cleanup \
|
||||
--contract docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json \
|
||||
--receipt /tmp/WH-ENG-20260822-AUDIT-E2-03/projection.json \
|
||||
--confirm WH-ENG-20260822-AUDIT-E2-03:cleanup \
|
||||
--receipt-out /tmp/WH-ENG-20260822-AUDIT-E2-03/cleanup.json
|
||||
```
|
||||
|
||||
From `whitehat-security`, bind the report to the cleanup receipt and deliver it:
|
||||
|
||||
```bash
|
||||
PYTHONPATH=src python3 -m whitehat_security.cli finalize-report \
|
||||
/tmp/WH-ENG-20260822-AUDIT-E2-03/runner-report.json \
|
||||
--contract /home/worsch/railiance-platform/docs/WH-ENG-20260822-AUDIT-E2-03-custody-contract.json \
|
||||
--receipt /tmp/WH-ENG-20260822-AUDIT-E2-03/projection.json \
|
||||
--cleanup-receipt /tmp/WH-ENG-20260822-AUDIT-E2-03/cleanup.json \
|
||||
--output /tmp/WH-ENG-20260822-AUDIT-E2-03/final-report.json
|
||||
|
||||
PYTHONPATH=src python3 -m whitehat_security.cli deliver \
|
||||
/tmp/WH-ENG-20260822-AUDIT-E2-03/final-report.json --outbox outbox
|
||||
```
|
||||
51
engagements/runtime/whitehat-e2-audit-20260822-03.yaml
Normal file
51
engagements/runtime/whitehat-e2-audit-20260822-03.yaml
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
# CONTRACT ONLY. Do not apply until WP-0025 projection and admit-plane succeed.
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: whitehat-e2-audit-03
|
||||
namespace: whitehat
|
||||
labels:
|
||||
app.kubernetes.io/name: whitehat-security
|
||||
app.kubernetes.io/component: whitehat-probe
|
||||
whitehat.security/plane: "true"
|
||||
whitehat.security/target: audit-core
|
||||
whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-03
|
||||
spec:
|
||||
serviceAccountName: whitehat-runner
|
||||
automountServiceAccountToken: false
|
||||
activeDeadlineSeconds: 900
|
||||
restartPolicy: Never
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
fsGroup: 10001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: probe
|
||||
image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["sleep", "900"]
|
||||
resources:
|
||||
requests: {cpu: 5m, memory: 16Mi}
|
||||
limits: {cpu: 50m, memory: 64Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- name: credentials
|
||||
mountPath: /var/run/secrets/whitehat
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: credentials
|
||||
secret:
|
||||
secretName: whitehat-e2-audit-credentials-03
|
||||
defaultMode: 0440
|
||||
items:
|
||||
- key: token-a
|
||||
path: token-a
|
||||
- key: token-b
|
||||
path: token-b
|
||||
Loading…
Add table
Add a link
Reference in a new issue