coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare receipt-bound audit E2 third attempt

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
tegwick 2026-08-22 23:23:48 +02:00
parent 0525e632d7
commit 96d6781036
12 changed files with 440 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

16
engagements/receipts/README.md
View file

@ -1,16 +1,20 @@
# Projection receipts
Copy `example-projection-receipt.json` at window start and fill in the live
engagement id, `projected_at`, `expires_at`, and identity *names* from the
custody procedure. Never put token values, passwords, or registry payloads
here.
Legacy value-safe receipts remain supported for historical fixtures. New live
engagements use the canonical RAILIANCE-WP-0025 contract, broker-readiness,
projection, and cleanup receipts. Never hand-edit a live receipt or put token
values, passwords, or registry payloads here.
Live admission:
```sh
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane \
engagements/<record>.json targets/audit-core-e2.json \
--receipt engagements/receipts/<engagement>.json
--receipt /approved/path/projection.json \
--contract /approved/path/projection-contract.json \
--broker-receipt /approved/path/broker.json
```
Without `--receipt`, live admission fails closed and requests no credential.
Without all three bound documents, WP-0025 admission fails closed and requests
no credential. After platform cleanup, use `finalize-report` with the cleanup
receipt before delivery.