coulomb/whitehat-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record the rapp-postgres file grant that still leaves live E3 blocked.

Browse source 
Commit 8d4106f grants SELECT to isolation_probe_app and leaves that role NOLOGIN. platform-pg stays not_applicable until a promotion, a broker LOGIN receipt, and a complete engagement exist. No connection was opened.

Assistant: grok
Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
This commit is contained in:
tegwick 2026-10-04 12:09:58 +02:00
parent 415ee77c14
commit b7306ddc7e
5 changed files with 40 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

32
workplans/WHITEHAT-WP-0006-authorized-live-residuals.md
View file

@ -45,15 +45,19 @@ status: wait
flavor: residual
priority: medium
state_hub_task_id: "ed82ecb5-e9b9-57e2-a010-5531763f7c4e"
blocked_on: message-from:rapp-postgres
blocking_reason: "Guessed 2026-10-04 from rapp-postgres 11c1d489: database isolation_probe on platform-pg, view isolation_probe.rls_conformance, runtime role isolation_probe_app is NOBYPASSRLS and NOLOGIN, and SELECT is still granted only to isolation_probe_migrate. A human must approve that one grant and a short-lived login member, then a complete engagement must name the window, rate ceiling, abort contact, and finding destination. The guess is not approval. See engagements/2026-10-04-guessed-live-inputs.md."
needs_human: true
blocked_on: message-from:railiance-platform
blocking_reason: "rapp-postgres 8d4106f, still present at 0374403, grants SELECT on isolation_probe.rls_conformance to isolation_probe_app and keeps that role NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The change is file-only. platform-pg stays not_applicable until an authorized promotion, a railiance-platform broker receipt for an ordinary runtime LOGIN member, and a complete engagement naming the database, window, rate ceiling, abort contact, and finding destination. No connection was opened."
```
Blocked on `rapp-postgres`. Rechecked 2026-10-04: `consumers/isolation-probe.yaml`
still names runtime `isolation_probe_app` and migration `isolation_probe_migrate`,
and `scripts/render_consumers.py` still grants `SELECT` on `rls_conformance` to
the migration role only. `platform-pg` stays `not_applicable` until an ordinary
runtime identity exists. Do not open a database connection to finish this task.
Blocked on a founder approval, a `railiance-platform` broker receipt, and a
complete engagement. `rapp-postgres` `69cc7304-e366-47a3-b2f1-f00fc9abf09e`
reports that `8d4106f` grants `SELECT` on `isolation_probe.rls_conformance`
to runtime `isolation_probe_app` after the view is created, and enforces
`NOBYPASSRLS` `NOSUPERUSER`. That commit is still present at `0374403`. The
role remains `NOLOGIN`. `RAPP-POSTGRES-WP-0007` stays blocked: its T01 is
done and its T02 and T03 stay `wait`. `platform-pg` stays `not_applicable`.
Do not open a database connection to finish this task.
### T02 — Live P1/P2 against a bounded substrate window
@ -100,8 +104,10 @@ are independent. Offline fixture work stays on `WHITEHAT-WP-0001`.
Nothing local can proceed. The tasks stay `wait` and this plan stays
`blocked`. Whitehat does not edit the owner repositories.
1. `rapp-postgres` publishes the ordinary runtime identity for T01. The
current isolation-probe template does not.
1. `rapp-postgres` `8d4106f` grants the file `SELECT` for T01. What remains
is an authorized promotion, a `railiance-platform` broker receipt for an
ordinary runtime `LOGIN` member, and a complete engagement. The role is
still `NOLOGIN`.
2. An operator publishes the substrate window for T02. No repository has it.
3. `access-engine` confirms the flex-auth tenant-A identity for T03, or
`audit-core` approves a new engagement ID. The August 22 audit-core IDs
@ -131,8 +137,8 @@ Owner returns the same day confirm the gaps. The tasks stay `wait`.
## Educated guesses — 2026-10-04
[`engagements/2026-10-04-guessed-live-inputs.md`](../engagements/2026-10-04-guessed-live-inputs.md)
names the fields that owner files already support. T01's database, view,
runtime role, and `2s` timeout are evidenced, and the missing grant is still
the one `SELECT` held by `isolation_probe_migrate`. T02's probe numbers stay
unknown. T03's closest fixture does not qualify as the tenant-A identity.
names the fields that owner files already support. Later the same day,
`rapp-postgres` `8d4106f` added the runtime `SELECT`. T01 still has no
`LOGIN` receipt and no engagement. T02's probe numbers stay unknown. T03's
closest fixture does not qualify as the tenant-A identity.
The tasks stay `wait`. The guesses authorize no connection and no load.