diff --git a/engagements/2026-10-04-guessed-live-inputs.md b/engagements/2026-10-04-guessed-live-inputs.md new file mode 100644 index 0000000..82e17ab --- /dev/null +++ b/engagements/2026-10-04-guessed-live-inputs.md @@ -0,0 +1,109 @@ +# Guessed inputs for the blocked live residuals — 2026-10-04 + +Status: **proposed; sends no traffic** + +These are educated guesses for the inputs named by `WHITEHAT-WP-0006`, +`WHITEHAT-WP-0008`, and `WHITEHAT-WP-0012`. A guess is not operator approval, +target-owner acknowledgement, or an engagement id. `Engagement.load` is not +pointed at this file. No packet, database connection, load, or failure +injection is authorized. + +Evidenced means an owner-repo file says it. Guessed means the closest +candidate, and the candidate still fails the task's bar where the table says +so. Unknown means no number was written down, and none was invented. + +## WHITEHAT-WP-0006-T01 — live E3 + +Read from `rapp-postgres` `11c1d489`. The explicit grant is still +migration-only. `platform-pg` stays `not_applicable` until that grant changes +and a human approves a connection. + +| Field | Value | Mark | +| --- | --- | --- | +| Database | `isolation_probe` on `platform-pg` | evidenced | +| Schema and view | `isolation_probe.rls_conformance` | evidenced | +| Runtime role | `isolation_probe_app`, `NOBYPASSRLS`, `NOLOGIN` | evidenced | +| Migration role that can read the view | `isolation_probe_migrate` | evidenced | +| Statement timeout | `2s` | evidenced | +| Namespace | `databases` | evidenced | +| Live workload has enabled the template | no | evidenced | + +The smallest owner change is one `GRANT SELECT` on that view to +`isolation_probe_app` inside `scripts/render_consumers.py`. It does not create +a login. A connectable identity would be a short-lived `LOGIN INHERIT` member +of that role. No OpenBao role for this probe is declared in that repo. This +repository does not make that grant. + +## WHITEHAT-WP-0006-T02 — live P1/P2 + +No file is an approved substrate window. `the-custodian` already said it +would not draft one. Probe allowance, aggressor consumer, headroom threshold, +and abort numbers are unknown. They are not filled in here. + +Evidenced bounds a future window would have to stay inside, from +`rapp-postgres` ADR-0004, are a 14-connection quota per consumer and an +enforced cell of four consumers on `platform-pg`. Those are admission +estimates. They are not a probe allowance and they do not name an aggressor. +The fixture ceiling `10` in the offline capacity calibration is not a live +allowance. + +## WHITEHAT-WP-0006-T03 — remaining E2 + +Read from `access-engine` `257a83e9`. No checked-in subject is tenant A with +no tenant-B authority. The closest fixture, `cross-tenant-deny` in +`examples/user-engine/policy_fixtures.yaml`, does not qualify: subject +`admin` carries `tenant-admin` and is denied because the request tenant +differs, not because the identity has no tenant-B grant. It is not the +engagement identity. + +| Field | Value | Mark | +| --- | --- | --- | +| Decision route | `POST /v1/check` | evidenced | +| Audience | `flex-auth` | evidenced | +| Caller binding name | `user-engine` | evidenced, not a secret | +| Service DNS | `flex-auth-user-engine.flex-auth.svc.cluster.local:8080` | guessed for the subject-tenant pin only | +| Tenant-A identity | none | evidenced absence | + +`audit-core` `28b567e` is a consistency sync after `1149273`. It does not mint +a new engagement id. `WH-ENG-20260822-AUDIT-E2-01`, `-02`, and `-03` stay +terminal. + +## WHITEHAT-WP-0008-T01 — one live ASM test + +The guessed first test is **T-06**. The other nine Canon tests have no named +component revision and non-secret identity class together. This guess does +not admit them, and it does not admit T-06. + +| Field | Value | Mark | +| --- | --- | --- | +| Component | `approval-engine` | evidenced | +| Deployed image | `sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49` | evidenced in `deploy/approval-engine.yaml` | +| Source of that image | `be1a388a848cf59e9ff3a5420f88a70ca0a52e7e` | evidenced | +| Checkout HEAD | `1044a5f36d3d9dc9ca031e48f486fd0f122c5cf5` | evidenced, and it is not the deployed image | +| Routes | `GET /v1/approvals/{id}/claim`, `POST /v1/approvals/{id}/consume` | evidenced | +| Identity class | `principal_type=service`, client name `secrets-engine-approval`, audience `approval-engine` | evidenced as a registration class, not a leased credential | +| Fixture technique | `asm-assurance` | evidenced | +| Consuming PEP | absent | evidenced. `APPROVAL-WP-0002-T05` stays wait. `secrets-engine` `approval_consume.py` remains the in-process module, not the live surface | + +Window, abort contact, and engagement id are unknown. They are not invented. + +## WHITEHAT-WP-0012-T03 — live E4 + +No `tenancy.yaml` declares current `E: 4`. `apps-pg` remains E4-unreachable: +shared credential, current `E: 0`. The closest named P3-shaped application is +`vergabe-teilnahme`, and it does not qualify. Its pilot still uses a shared +`apps-pg` database and role. It is not registered as an E4 target. + +## WHITEHAT-WP-0012-T04 — live R4 + +No service has a complete copy inventory. `audit-core` stays R2 and is not +the owner. The closest incomplete text is `rapp-postgres` ADR-0002: one WAL +stream, one base backup, and an erasure horizon. It does not list derived +copies and it does not name an R4 route. It is not an R4 inventory. + +## WHITEHAT-WP-0012-T05 — live V2, V3, or V4 + +No `tenancy.yaml` declares `V` above 1. `audit-core` documents V1 for the +operation "accept an audit event" and says V2 is not reachable while +`platform-pg` has one instance. A restart is not V2. No failure domain, RTO, +or RPO is guessed, and no instance is a candidate for termination. diff --git a/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md b/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md index 4b68ff7..6240ee1 100644 --- a/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md +++ b/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md @@ -46,7 +46,7 @@ flavor: residual priority: medium state_hub_task_id: "ed82ecb5-e9b9-57e2-a010-5531763f7c4e" blocked_on: message-from:rapp-postgres -blocking_reason: "rapp-postgres must name a database whose ordinary runtime identity can read the conformance view without BYPASSRLS, superuser, or owner privilege, and a complete engagement must name that database, window, rate ceiling, abort contact, and finding destination." +blocking_reason: "Guessed 2026-10-04 from rapp-postgres 11c1d489: database isolation_probe on platform-pg, view isolation_probe.rls_conformance, runtime role isolation_probe_app is NOBYPASSRLS and NOLOGIN, and SELECT is still granted only to isolation_probe_migrate. A human must approve that one grant and a short-lived login member, then a complete engagement must name the window, rate ceiling, abort contact, and finding destination. The guess is not approval. See engagements/2026-10-04-guessed-live-inputs.md." ``` Blocked on `rapp-postgres`. Rechecked 2026-10-04: `consumers/isolation-probe.yaml` @@ -64,7 +64,7 @@ flavor: residual priority: medium state_hub_task_id: "f226b8e1-4754-5360-a73f-a607718fc69d" needs_human: true -blocking_reason: "An operator must approve a substrate window naming the aggressor consumer, allowance, concurrency and resource ceilings, service classes, headroom threshold, and abort thresholds. No repository has published that window." +blocking_reason: "No approved substrate window exists. The 2026-10-04 guess leaves the aggressor, probe allowance, headroom threshold, and abort numbers unknown rather than inventing them. rapp-postgres ADR-0004's 14-connection quota and four-consumer cell are admission estimates, not a probe allowance. An operator must still approve the window. See engagements/2026-10-04-guessed-live-inputs.md." ``` Blocked on an operator record. Rechecked 2026-10-04: no approved substrate @@ -80,7 +80,7 @@ flavor: residual priority: medium state_hub_task_id: "414a7f68-b838-5ceb-8123-932c56a2b55b" blocked_on: message-from:access-engine -blocking_reason: "access-engine must confirm a tenant-A identity with no tenant-B authority for the flex-auth target, or audit-core must approve a later run under a new engagement ID. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal." +blocking_reason: "access-engine 257a83e9 still has no tenant-A identity with no tenant-B authority. The closest fixture, cross-tenant-deny, does not qualify and is not the engagement identity. audit-core 28b567e does not mint a new engagement id. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal. See engagements/2026-10-04-guessed-live-inputs.md." ``` Blocked on `access-engine` (the `flex-auth` target; hub slug `access-engine`). @@ -127,3 +127,12 @@ Owner returns the same day confirm the gaps. The tasks stay `wait`. - `audit-core` `14c8a0c6-815f-4e73-a6c6-c50d7d4d0af3`, commit `1149273`: the August 22 engagement IDs stay terminal. No new engagement ID was minted and no run was approved. + +## Educated guesses — 2026-10-04 + +[`engagements/2026-10-04-guessed-live-inputs.md`](../engagements/2026-10-04-guessed-live-inputs.md) +names the fields that owner files already support. T01's database, view, +runtime role, and `2s` timeout are evidenced, and the missing grant is still +the one `SELECT` held by `isolation_probe_migrate`. T02's probe numbers stay +unknown. T03's closest fixture does not qualify as the tenant-A identity. +The tasks stay `wait`. The guesses authorize no connection and no load. diff --git a/workplans/WHITEHAT-WP-0008-live-asm-residuals.md b/workplans/WHITEHAT-WP-0008-live-asm-residuals.md index 7ddee94..65aa0cd 100644 --- a/workplans/WHITEHAT-WP-0008-live-asm-residuals.md +++ b/workplans/WHITEHAT-WP-0008-live-asm-residuals.md @@ -45,7 +45,7 @@ flavor: residual priority: medium state_hub_task_id: "1faabcb7-b3d5-5d52-ae73-95d2e3338c5c" blocked_on: message-from:approval-engine -blocking_reason: "A surface owner must name, for one Canon test_id, the component revision, identities, window, and technique. T-06 still needs approval-engine and a consuming PEP. secrets-engine 4b4d556 is not that surface. One owner return admits only that test_id, and only after a complete engagement and plane admission." +blocking_reason: "Guessed first test is T-06 on approval-engine image sha256:251941a5, source be1a388a, not checkout HEAD 1044a5f. Routes are claim and consume. The identity class is service, client secrets-engine-approval. No consuming PEP exists, and window, abort contact, and engagement id are still unapproved. secrets-engine approval_consume stays the in-process module. See engagements/2026-10-04-guessed-live-inputs.md." ``` Blocked until a target owner names, for a specific Canon `test_id`, the @@ -90,3 +90,15 @@ Owner returns the same day name no live surface. T01 stays `wait`. The secrets-engine client at `4b4d556` is still not that surface. - `access-engine` `ec96e1ba-27bd-4faa-8773-55ffeaba095c`: ASM T-01, T-03, T-04, T-06, T-07, and T-08 stay pending. The reply names no Canon registration. + +## Educated guess — 2026-10-04 + +The first test to ask for is T-06, on the deployed `approval-engine` image +`sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49` +(source `be1a388a`), not checkout HEAD `1044a5f`. The routes are claim and +consume. The identity class is `service`. `APPROVAL-WP-0002-T05` is still +`wait`, so no consuming PEP is named. Window, abort contact, and engagement +id stay unapproved. The other nine tests are worse guesses because they lack +that pair of revision and identity class. Details are in +[`engagements/2026-10-04-guessed-live-inputs.md`](../engagements/2026-10-04-guessed-live-inputs.md). +T01 stays `wait`. This guess authorizes no packet. diff --git a/workplans/WHITEHAT-WP-0012-ia-classification-and-v-observations.md b/workplans/WHITEHAT-WP-0012-ia-classification-and-v-observations.md index c64045b..3bdfdeb 100644 --- a/workplans/WHITEHAT-WP-0012-ia-classification-and-v-observations.md +++ b/workplans/WHITEHAT-WP-0012-ia-classification-and-v-observations.md @@ -86,7 +86,7 @@ id: WHITEHAT-WP-0012-T03 status: wait priority: medium needs_human: true -blocking_reason: "No scanned service declares current E: 4, and apps-pg is recorded as E4 unreachable. An owner must name a service that has a per-tenant credential and a separate per-tenant substrate, the credential class (never the value), the other tenant's substrate, the window, the abort contact, and a complete engagement. Tenancy Posture §13 classifies that demonstration as Mechanical. This task authorizes no connection attempt." +blocking_reason: "Rechecked 2026-10-04: no tenancy.yaml declares E: 4, and apps-pg stays E4-unreachable at E: 0. vergabe-teilnahme is the closest P3-shaped name and does not qualify; its pilot is still a shared apps-pg database. An owner must still name a real per-tenant credential and substrate. This task authorizes no connection. See engagements/2026-10-04-guessed-live-inputs.md." state_hub_task_id: "b8f4e3c4-59a1-5522-be46-5ab1984cee73" ``` @@ -103,7 +103,7 @@ id: WHITEHAT-WP-0012-T04 status: wait priority: medium needs_human: true -blocking_reason: "R4 evidence is Adversarial. An owner must name the route (horizon-elapsed or key-destroyed), a complete copy inventory covering live data, backups, and derived copies, the erasure horizon, the window, the abort contact, and a complete engagement. audit-core targets R2 and is not this owner. This task authorizes no store access." +blocking_reason: "Rechecked 2026-10-04: no service has a complete R4 inventory. audit-core stays R2. rapp-postgres ADR-0002 names one WAL stream and one base backup and is not an inventory of derived copies. An owner must still name the route and the inventory. This task authorizes no store access. See engagements/2026-10-04-guessed-live-inputs.md." state_hub_task_id: "acc22db7-f7c9-5860-9174-6e60773bfd95" ``` @@ -118,7 +118,7 @@ id: WHITEHAT-WP-0012-T05 status: wait priority: medium needs_human: true -blocking_reason: "V2, V3, and V4 are Adversarial and failure-injected. An operator must name the delivering service, the operation the claim covers, the failure domain, the RTO and RPO, the window, the abort contact, and give the separate approval the rules of engagement §1 require for a recovery probe. V1 stays a mechanical exercise in the declaring service. This task authorizes no failure injection." +blocking_reason: "Rechecked 2026-10-04: no tenancy.yaml declares V above 1. audit-core V1 for accepting an audit event is a restart and is not V2. No failure domain, RTO, or RPO was guessed. An operator must still approve the exercise. This task authorizes no failure injection. See engagements/2026-10-04-guessed-live-inputs.md." state_hub_task_id: "3893b7b1-70dc-5f98-a359-42b08a28fc28" ``` @@ -138,13 +138,18 @@ a guessed owner. 1. An owner publishes a service that actually has a per-tenant credential and a separate per-tenant substrate before T03 can start. The mechanical E4 - demonstration then still needs a complete engagement. No such service is - declared in the scanned standard. + demonstration then still needs a complete engagement. A 2026-10-04 read of + the canon and the declaring `tenancy.yaml` files found no current `E: 4`. + `vergabe-teilnahme` is the closest P3-shaped name and does not qualify. 2. An owner publishes the R4 route and a complete copy inventory before T04 - can start. `audit-core` is not that owner. + can start. `audit-core` is not that owner. `rapp-postgres` ADR-0002 is the + closest backup text and is not that inventory. 3. An operator publishes the failure-injection approval before T05 can start. The approval names the delivering service, operation, failure domain, - RTO, RPO, window, and abort contact. + RTO, RPO, window, and abort contact. No declaration above V1 was found. + +The guessed fields and the rejected candidates are in +[`engagements/2026-10-04-guessed-live-inputs.md`](../engagements/2026-10-04-guessed-live-inputs.md). `WHITEHAT-WP-0006` still owns live E3, P1/P2, and the remaining E2. `WHITEHAT-WP-0008` still owns live ASM. Those requirements are unchanged.