diff --git a/SCOPE.md b/SCOPE.md index 592b958..aad32b4 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -125,8 +125,10 @@ a complete engagement record already exists. No live target is authorized. `WHITEHAT-WP-0011`. - Residual live Tenancy Posture evidence is `WHITEHAT-WP-0006`. Residual live ASM is `WHITEHAT-WP-0008`. Both stay `blocked` after the 2026-10-04 - owner returns. T01 still waits on `rapp-postgres` for an ordinary runtime - identity. T02 still waits on an operator substrate window. T03 still waits + owner returns. T01 now has the file grant from `rapp-postgres` `8d4106f` + and still waits on an authorized promotion, a `railiance-platform` runtime + `LOGIN` receipt, and a complete engagement. T02 still waits on an operator + substrate window. T03 still waits on `access-engine` or a new `audit-core` engagement ID. Live ASM still waits on a surface owner, with T-06 on `approval-engine` and a consuming PEP. No packet is authorized. diff --git a/engagements/2026-10-04-guessed-live-inputs.md b/engagements/2026-10-04-guessed-live-inputs.md index 82e17ab..0c3c069 100644 --- a/engagements/2026-10-04-guessed-live-inputs.md +++ b/engagements/2026-10-04-guessed-live-inputs.md @@ -14,25 +14,30 @@ so. Unknown means no number was written down, and none was invented. ## WHITEHAT-WP-0006-T01 — live E3 -Read from `rapp-postgres` `11c1d489`. The explicit grant is still -migration-only. `platform-pg` stays `not_applicable` until that grant changes -and a human approves a connection. +The morning read of `rapp-postgres` `11c1d489` found the explicit grant on +the migration role only. Reply `69cc7304-e366-47a3-b2f1-f00fc9abf09e` then +reported commit `8d4106f`. That commit is still present at `0374403`: the +renderer grants `SELECT` to both `isolation_probe_migrate` and +`isolation_probe_app`, and the runtime role stays `NOLOGIN`, `NOBYPASSRLS`, +and `NOSUPERUSER`. The owner says this is file-only. `platform-pg` stays +`not_applicable` until an authorized promotion and an ordinary runtime +`LOGIN` receipt exist. | Field | Value | Mark | | --- | --- | --- | | Database | `isolation_probe` on `platform-pg` | evidenced | | Schema and view | `isolation_probe.rls_conformance` | evidenced | -| Runtime role | `isolation_probe_app`, `NOBYPASSRLS`, `NOLOGIN` | evidenced | -| Migration role that can read the view | `isolation_probe_migrate` | evidenced | +| Runtime role | `isolation_probe_app`, `NOLOGIN`, `NOBYPASSRLS`, `NOSUPERUSER` | evidenced | +| File grant | `SELECT` to migration and runtime | evidenced at `8d4106f` | +| Deployed LOGIN receipt | none | evidenced absence | | Statement timeout | `2s` | evidenced | | Namespace | `databases` | evidenced | | Live workload has enabled the template | no | evidenced | -The smallest owner change is one `GRANT SELECT` on that view to -`isolation_probe_app` inside `scripts/render_consumers.py`. It does not create -a login. A connectable identity would be a short-lived `LOGIN INHERIT` member -of that role. No OpenBao role for this probe is declared in that repo. This -repository does not make that grant. +A connectable identity would still be a short-lived `LOGIN INHERIT` member +of `isolation_probe_app`, confirmed by the `railiance-platform` broker. +`RAPP-POSTGRES-WP-0007` T02 stays `wait` for this repository's complete +engagement. This file does not create that engagement. ## WHITEHAT-WP-0006-T02 — live P1/P2 diff --git a/targets/README.md b/targets/README.md index 73a431d..02cc44a 100644 --- a/targets/README.md +++ b/targets/README.md @@ -10,7 +10,7 @@ honest applicability record the test plane admits against. | `tenant-engine` | not_applicable | No tenant-A identity without tenant-B authority. | | `flex-auth` | pending | Initial envelope; owner has not confirmed the attacker identity. | | `fixture-e3` | applicable | In-process E3 evaluator. One runtime identity, no `BYPASSRLS`. | -| `platform-pg` | not_applicable | No ordinary runtime identity can read the conformance view. | +| `platform-pg` | not_applicable | Renderer grants SELECT to `isolation_probe_app`, which is NOLOGIN. No runtime LOGIN receipt exists. | | `fixture-capacity` | applicable | In-process P1/P2 evaluator. Generates no load. | | `fixture-e4` | applicable | In-process E4 evaluator. Projects no credential. No live E4 target. | | `fixture-r4` | applicable | In-process R4 evaluator. Opens no store. No live R4 target. | diff --git a/targets/platform-pg-e3.json b/targets/platform-pg-e3.json index c11528b..23b60b5 100644 --- a/targets/platform-pg-e3.json +++ b/targets/platform-pg-e3.json @@ -4,7 +4,7 @@ "posture_claim": "E3", "attacker_model": "E3-A omitted-predicate accident; E3-B documented SQL-compromise limit", "applicability": "not_applicable", - "applicability_reason": "rapp-postgres 2026-08-22: the only E3 apparatus consumer is isolation-probe. Ordinary runtime group isolation_probe_app is NOBYPASSRLS, but SELECT on isolation_probe.rls_conformance is granted only to isolation_probe_migrate. No live workload has enabled the template. An ordinary runtime identity that can exercise the conformance view does not exist. Do not open a database connection.", + "applicability_reason": "rapp-postgres 8d4106f, still present at 0374403, grants SELECT on isolation_probe.rls_conformance to isolation_probe_app and keeps that role NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The change is file-only. No authorized promotion and no ordinary runtime LOGIN receipt exist, so no connectable identity can exercise the view. Do not open a database connection.", "approval_classes": ["e3"], "routes": [], "identities": { diff --git a/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md b/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md index 6240ee1..7122ca6 100644 --- a/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md +++ b/workplans/WHITEHAT-WP-0006-authorized-live-residuals.md @@ -45,15 +45,19 @@ status: wait flavor: residual priority: medium state_hub_task_id: "ed82ecb5-e9b9-57e2-a010-5531763f7c4e" -blocked_on: message-from:rapp-postgres -blocking_reason: "Guessed 2026-10-04 from rapp-postgres 11c1d489: database isolation_probe on platform-pg, view isolation_probe.rls_conformance, runtime role isolation_probe_app is NOBYPASSRLS and NOLOGIN, and SELECT is still granted only to isolation_probe_migrate. A human must approve that one grant and a short-lived login member, then a complete engagement must name the window, rate ceiling, abort contact, and finding destination. The guess is not approval. See engagements/2026-10-04-guessed-live-inputs.md." +needs_human: true +blocked_on: message-from:railiance-platform +blocking_reason: "rapp-postgres 8d4106f, still present at 0374403, grants SELECT on isolation_probe.rls_conformance to isolation_probe_app and keeps that role NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The change is file-only. platform-pg stays not_applicable until an authorized promotion, a railiance-platform broker receipt for an ordinary runtime LOGIN member, and a complete engagement naming the database, window, rate ceiling, abort contact, and finding destination. No connection was opened." ``` -Blocked on `rapp-postgres`. Rechecked 2026-10-04: `consumers/isolation-probe.yaml` -still names runtime `isolation_probe_app` and migration `isolation_probe_migrate`, -and `scripts/render_consumers.py` still grants `SELECT` on `rls_conformance` to -the migration role only. `platform-pg` stays `not_applicable` until an ordinary -runtime identity exists. Do not open a database connection to finish this task. +Blocked on a founder approval, a `railiance-platform` broker receipt, and a +complete engagement. `rapp-postgres` `69cc7304-e366-47a3-b2f1-f00fc9abf09e` +reports that `8d4106f` grants `SELECT` on `isolation_probe.rls_conformance` +to runtime `isolation_probe_app` after the view is created, and enforces +`NOBYPASSRLS` `NOSUPERUSER`. That commit is still present at `0374403`. The +role remains `NOLOGIN`. `RAPP-POSTGRES-WP-0007` stays blocked: its T01 is +done and its T02 and T03 stay `wait`. `platform-pg` stays `not_applicable`. +Do not open a database connection to finish this task. ### T02 — Live P1/P2 against a bounded substrate window @@ -100,8 +104,10 @@ are independent. Offline fixture work stays on `WHITEHAT-WP-0001`. Nothing local can proceed. The tasks stay `wait` and this plan stays `blocked`. Whitehat does not edit the owner repositories. -1. `rapp-postgres` publishes the ordinary runtime identity for T01. The - current isolation-probe template does not. +1. `rapp-postgres` `8d4106f` grants the file `SELECT` for T01. What remains + is an authorized promotion, a `railiance-platform` broker receipt for an + ordinary runtime `LOGIN` member, and a complete engagement. The role is + still `NOLOGIN`. 2. An operator publishes the substrate window for T02. No repository has it. 3. `access-engine` confirms the flex-auth tenant-A identity for T03, or `audit-core` approves a new engagement ID. The August 22 audit-core IDs @@ -131,8 +137,8 @@ Owner returns the same day confirm the gaps. The tasks stay `wait`. ## Educated guesses — 2026-10-04 [`engagements/2026-10-04-guessed-live-inputs.md`](../engagements/2026-10-04-guessed-live-inputs.md) -names the fields that owner files already support. T01's database, view, -runtime role, and `2s` timeout are evidenced, and the missing grant is still -the one `SELECT` held by `isolation_probe_migrate`. T02's probe numbers stay -unknown. T03's closest fixture does not qualify as the tenant-A identity. +names the fields that owner files already support. Later the same day, +`rapp-postgres` `8d4106f` added the runtime `SELECT`. T01 still has no +`LOGIN` receipt and no engagement. T02's probe numbers stay unknown. T03's +closest fixture does not qualify as the tenant-A identity. The tasks stay `wait`. The guesses authorize no connection and no load.