coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare receipt-bound audit E2 third attempt

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
tegwick 2026-08-22 23:23:48 +02:00
parent 0525e632d7
commit 96d6781036
12 changed files with 440 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/WHITEHAT-WP-0005-broker-receipt-admission.md
View file

@ -48,3 +48,21 @@ state_hub_task_id: "a6209f8a-b767-5ce8-8842-c9e454977f83"
Add required `--broker-receipt` for WP-0025 admission, pass it through
`broker_from_receipt`, and require exact digest equality. CLI tests cover
a missing broker receipt and a mismatched recanonicalized digest.
### T02 — Bind runner authorization and final report to cleanup
```task
id: WHITEHAT-WP-0005-T02
status: done
priority: high
```
Fresh-run setup found two remaining operational misbindings. The audit-core
runner hard-coded the authorization id from the original 2026-08-21 attempt,
and its sanitized report could only say credential cleanup was pending.
The runner now requires `--authorization-id` and carries that exact value into
the report. `finalize-report` validates the WP-0025 projection contract,
projection receipt, and cleanup receipt, binds their engagement, target, image,
lease, and canonical receipt id to the runner report, and only then records
custody revocation as complete. Mismatched reports fail closed.