coulomb/whitehat-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the rapp-postgres file grant that still leaves live E3 blocked.

Browse source 
Commit 8d4106f grants SELECT to isolation_probe_app and leaves that role NOLOGIN. platform-pg stays not_applicable until a promotion, a broker LOGIN receipt, and a complete engagement exist. No connection was opened.

Assistant: grok
Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
This commit is contained in:
tegwick 2026-10-04 12:09:58 +02:00
parent 415ee77c14
commit b7306ddc7e
5 changed files with 40 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

6
SCOPE.md
View file

@ -125,8 +125,10 @@ a complete engagement record already exists. No live target is authorized.
`WHITEHAT-WP-0011`.
- Residual live Tenancy Posture evidence is `WHITEHAT-WP-0006`. Residual
live ASM is `WHITEHAT-WP-0008`. Both stay `blocked` after the 2026-10-04
owner returns. T01 still waits on `rapp-postgres` for an ordinary runtime
identity. T02 still waits on an operator substrate window. T03 still waits
owner returns. T01 now has the file grant from `rapp-postgres` `8d4106f`
and still waits on an authorized promotion, a `railiance-platform` runtime
`LOGIN` receipt, and a complete engagement. T02 still waits on an operator
substrate window. T03 still waits
on `access-engine` or a new `audit-core` engagement ID. Live ASM still
waits on a surface owner, with T-06 on `approval-engine` and a consuming
PEP. No packet is authorized.

25
engagements/2026-10-04-guessed-live-inputs.md
View file

@ -14,25 +14,30 @@ so. Unknown means no number was written down, and none was invented.
## WHITEHAT-WP-0006-T01 — live E3
Read from `rapp-postgres` `11c1d489`. The explicit grant is still
migration-only. `platform-pg` stays `not_applicable` until that grant changes
and a human approves a connection.
The morning read of `rapp-postgres` `11c1d489` found the explicit grant on
the migration role only. Reply `69cc7304-e366-47a3-b2f1-f00fc9abf09e` then
reported commit `8d4106f`. That commit is still present at `0374403`: the
renderer grants `SELECT` to both `isolation_probe_migrate` and
`isolation_probe_app`, and the runtime role stays `NOLOGIN`, `NOBYPASSRLS`,
and `NOSUPERUSER`. The owner says this is file-only. `platform-pg` stays
`not_applicable` until an authorized promotion and an ordinary runtime
`LOGIN` receipt exist.
| Field | Value | Mark |
| --- | --- | --- |
| Database | `isolation_probe` on `platform-pg` | evidenced |
| Schema and view | `isolation_probe.rls_conformance` | evidenced |
| Runtime role | `isolation_probe_app`, `NOBYPASSRLS`, `NOLOGIN` | evidenced |
| Migration role that can read the view | `isolation_probe_migrate` | evidenced |
| Runtime role | `isolation_probe_app`, `NOLOGIN`, `NOBYPASSRLS`, `NOSUPERUSER` | evidenced |
| File grant | `SELECT` to migration and runtime | evidenced at `8d4106f` |
| Deployed LOGIN receipt | none | evidenced absence |
| Statement timeout | `2s` | evidenced |
| Namespace | `databases` | evidenced |
| Live workload has enabled the template | no | evidenced |
The smallest owner change is one `GRANT SELECT` on that view to
`isolation_probe_app` inside `scripts/render_consumers.py`. It does not create
a login. A connectable identity would be a short-lived `LOGIN INHERIT` member
of that role. No OpenBao role for this probe is declared in that repo. This
repository does not make that grant.
A connectable identity would still be a short-lived `LOGIN INHERIT` member
of `isolation_probe_app`, confirmed by the `railiance-platform` broker.
`RAPP-POSTGRES-WP-0007` T02 stays `wait` for this repository's complete
engagement. This file does not create that engagement.
## WHITEHAT-WP-0006-T02 — live P1/P2

2
targets/README.md
View file

@ -10,7 +10,7 @@ honest applicability record the test plane admits against.
| `tenant-engine` | not_applicable | No tenant-A identity without tenant-B authority. |
| `flex-auth` | pending | Initial envelope; owner has not confirmed the attacker identity. |
| `fixture-e3` | applicable | In-process E3 evaluator. One runtime identity, no `BYPASSRLS`. |
| `platform-pg` | not_applicable | No ordinary runtime identity can read the conformance view. |
| `platform-pg` | not_applicable | Renderer grants SELECT to `isolation_probe_app`, which is NOLOGIN. No runtime LOGIN receipt exists. |
| `fixture-capacity` | applicable | In-process P1/P2 evaluator. Generates no load. |
| `fixture-e4` | applicable | In-process E4 evaluator. Projects no credential. No live E4 target. |
| `fixture-r4` | applicable | In-process R4 evaluator. Opens no store. No live R4 target. |

2
targets/platform-pg-e3.json
View file

@ -4,7 +4,7 @@
"posture_claim": "E3",
"attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit",
"applicability": "not_applicable",
"applicability_reason": "rapp-postgres 2026-08-22: the only E3 apparatus consumer is isolation-probe. Ordinary runtime group isolation_probe_app is NOBYPASSRLS, but SELECT on isolation_probe.rls_conformance is granted only to isolation_probe_migrate. No live workload has enabled the template. An ordinary runtime identity that can exercise the conformance view does not exist. Do not open a database connection.",
"applicability_reason": "rapp-postgres 8d4106f, still present at 0374403, grants SELECT on isolation_probe.rls_conformance to isolation_probe_app and keeps that role NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The change is file-only. No authorized promotion and no ordinary runtime LOGIN receipt exist, so no connectable identity can exercise the view. Do not open a database connection.",
"approval_classes": ["e3"],
"routes": [],
"identities": {

32
workplans/WHITEHAT-WP-0006-authorized-live-residuals.md
View file

@ -45,15 +45,19 @@ status: wait
flavor: residual
priority: medium
state_hub_task_id: "ed82ecb5-e9b9-57e2-a010-5531763f7c4e"
blocked_on: message-from:rapp-postgres
blocking_reason: "Guessed 2026-10-04 from rapp-postgres 11c1d489: database isolation_probe on platform-pg, view isolation_probe.rls_conformance, runtime role isolation_probe_app is NOBYPASSRLS and NOLOGIN, and SELECT is still granted only to isolation_probe_migrate. A human must approve that one grant and a short-lived login member, then a complete engagement must name the window, rate ceiling, abort contact, and finding destination. The guess is not approval. See engagements/2026-10-04-guessed-live-inputs.md."
needs_human: true
blocked_on: message-from:railiance-platform
blocking_reason: "rapp-postgres 8d4106f, still present at 0374403, grants SELECT on isolation_probe.rls_conformance to isolation_probe_app and keeps that role NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The change is file-only. platform-pg stays not_applicable until an authorized promotion, a railiance-platform broker receipt for an ordinary runtime LOGIN member, and a complete engagement naming the database, window, rate ceiling, abort contact, and finding destination. No connection was opened."
```
Blocked on `rapp-postgres`. Rechecked 2026-10-04: `consumers/isolation-probe.yaml`
still names runtime `isolation_probe_app` and migration `isolation_probe_migrate`,
and `scripts/render_consumers.py` still grants `SELECT` on `rls_conformance` to
the migration role only. `platform-pg` stays `not_applicable` until an ordinary
runtime identity exists. Do not open a database connection to finish this task.
Blocked on a founder approval, a `railiance-platform` broker receipt, and a
complete engagement. `rapp-postgres` `69cc7304-e366-47a3-b2f1-f00fc9abf09e`
reports that `8d4106f` grants `SELECT` on `isolation_probe.rls_conformance`
to runtime `isolation_probe_app` after the view is created, and enforces
`NOBYPASSRLS` `NOSUPERUSER`. That commit is still present at `0374403`. The
role remains `NOLOGIN`. `RAPP-POSTGRES-WP-0007` stays blocked: its T01 is
done and its T02 and T03 stay `wait`. `platform-pg` stays `not_applicable`.
Do not open a database connection to finish this task.
### T02 — Live P1/P2 against a bounded substrate window
@ -100,8 +104,10 @@ are independent. Offline fixture work stays on `WHITEHAT-WP-0001`.
Nothing local can proceed. The tasks stay `wait` and this plan stays
`blocked`. Whitehat does not edit the owner repositories.
1. `rapp-postgres` publishes the ordinary runtime identity for T01. The
current isolation-probe template does not.
1. `rapp-postgres` `8d4106f` grants the file `SELECT` for T01. What remains
is an authorized promotion, a `railiance-platform` broker receipt for an
ordinary runtime `LOGIN` member, and a complete engagement. The role is
still `NOLOGIN`.
2. An operator publishes the substrate window for T02. No repository has it.
3. `access-engine` confirms the flex-auth tenant-A identity for T03, or
`audit-core` approves a new engagement ID. The August 22 audit-core IDs
@ -131,8 +137,8 @@ Owner returns the same day confirm the gaps. The tasks stay `wait`.
## Educated guesses — 2026-10-04
[`engagements/2026-10-04-guessed-live-inputs.md`](../engagements/2026-10-04-guessed-live-inputs.md)
names the fields that owner files already support. T01's database, view,
runtime role, and `2s` timeout are evidenced, and the missing grant is still
the one `SELECT` held by `isolation_probe_migrate`. T02's probe numbers stay
unknown. T03's closest fixture does not qualify as the tenant-A identity.
names the fields that owner files already support. Later the same day,
`rapp-postgres` `8d4106f` added the runtime `SELECT`. T01 still has no
`LOGIN` receipt and no engagement. T02's probe numbers stay unknown. T03's
closest fixture does not qualify as the tenant-A identity.
The tasks stay `wait`. The guesses authorize no connection and no load.