Schedule 18:00Z custody for acknowledged audit-core E2
Record the owner-acknowledged window, pin the runner invocation including the forged fixture id, and ask railiance-platform to project identities only at window start. No mint, no pod apply, no packets. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
This commit is contained in:
parent
32afceb68e
commit
b8facab717
8 changed files with 139 additions and 39 deletions
8
SCOPE.md
8
SCOPE.md
|
|
@ -69,11 +69,9 @@ boundary always holds.
|
|||
- `T01` is complete: the rules of engagement were accepted on 2026-08-21.
|
||||
- `T02` is complete: the per-axis attacker model is recorded in
|
||||
`docs/attacker-model.md`.
|
||||
- `T03` is in progress: the differential core, audit-core adapter and test
|
||||
plane admission exist. `tenant-engine` is registered `not_applicable` for
|
||||
E2. The foundational plane is applied. `WH-ENG-20260822-AUDIT-E2-01` is
|
||||
operator-approved and awaits target-owner acknowledgement and a connected
|
||||
custody broker.
|
||||
- `T03` is in progress: `WH-ENG-20260822-AUDIT-E2-01` is operator-approved
|
||||
and owner-acknowledged. The window has not started. Custody projection is
|
||||
scheduled for `18:00Z`; tokens must not be minted early.
|
||||
- `T04` is complete for every applicable E2 probe: generic and audit-core
|
||||
shaped fixtures fail known-bad and pass known-good in-process.
|
||||
- `T05` is in progress: 24-hour cadence, offline evaluator and in-process
|
||||
|
|
|
|||
|
|
@ -47,7 +47,7 @@ Create `plane/KILL` to abort independently of the runner process.
|
|||
|
||||
## Retired identifiers
|
||||
|
||||
`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. The
|
||||
foundational plane is provisioned first. `WH-ENG-20260822-AUDIT-E2-01` is
|
||||
operator-approved and awaits target-owner acknowledgement. The live custody
|
||||
broker remains unconnected.
|
||||
`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal.
|
||||
`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and owner-acknowledged.
|
||||
The window starts at `2026-08-22T18:00:00Z`. Do not mint the 900s identities
|
||||
before then. The live custody broker remains unconnected until projection.
|
||||
|
|
|
|||
|
|
@ -1,26 +1,22 @@
|
|||
# WH-ENG-20260822-AUDIT-E2-01
|
||||
|
||||
Status: **operator-approved, awaiting target-owner acknowledgement**.
|
||||
This is not yet authorization to send a packet or project credentials.
|
||||
Status: **operator-approved and target-owner-acknowledged**. The window has
|
||||
not started. Credentials must not be minted until window start so the 900s
|
||||
TTL covers the run and cleanup.
|
||||
|
||||
Operator approved `2026-08-22T09:52:55Z` in the coordinating session
|
||||
(`operator-session-2026-08-22-e2-approval`). Audit-core acknowledgement is
|
||||
still pending. The cancelled ID `WH-ENG-20260821-AUDIT-E2` remains terminal.
|
||||
|
||||
| Field | Value |
|
||||
| Gate | State |
|
||||
| --- | --- |
|
||||
| Target | `audit-core.audit-core.svc.cluster.local:8080` |
|
||||
| Registration | `targets/audit-core-e2.json` (`applicable`, `live-e2`) |
|
||||
| Source | pod `whitehat/whitehat-e2-audit` with plane and target labels, SA `whitehat-runner`, no token |
|
||||
| Image pin | `forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10` |
|
||||
| Identities | two ordinary tenant-scoped `may_read`/`may_write` senders, `source=whitehat-security`, TTL ≤ 900s, mount-only |
|
||||
| Routes | `GET /readyz`, `POST /v1/events`, `GET /v1/events/{event_id}`, `GET /v1/events?correlation_id=` |
|
||||
| Ceiling | concurrency 1; 10/min; at most 30 requests |
|
||||
| Window | 2026-08-22T18:00:00Z–18:15:00Z |
|
||||
| Cleanup | revoke both leases; delete only named synthetic fixtures; prove cleanup |
|
||||
| Reporting | `risk-nexus`, no severity |
|
||||
| Operator approval | `2026-08-22T09:52:55Z` |
|
||||
| Owner acknowledgement | `2026-08-22T10:04:56Z` at `32afceb` |
|
||||
| Foundational plane | applied by ops-mason `c26a6e5` |
|
||||
| Window | `2026-08-22T18:00:00Z`–`18:15:00Z` |
|
||||
| Image | `sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6` |
|
||||
| Custody projection | scheduled, not minted |
|
||||
| Runner pod | not applied |
|
||||
|
||||
Offline preflight must fail closed until `target_owner_acknowledged_at` is
|
||||
set. After acknowledgement, the live custody broker is still unconnected and
|
||||
must fail closed until two identities are projected. Do not apply
|
||||
`plane/runner-pod.yaml` before that.
|
||||
Offline preflight now fails closed with `engagement window has not started`.
|
||||
At `18:00Z`, `Engagement.load` authorizes the record; `admit-plane` still
|
||||
fails closed until the live custody broker is connected.
|
||||
|
||||
Invocation, including required `--forged-event whitehat-e2-forged-b-20260822`:
|
||||
`engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md`.
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ from `whitehat admit-plane`. `WH-ENG-20260821-AUDIT-E2` and
|
|||
`WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod
|
||||
manifest under `runtime/` is bound to a cancelled ID and must not be applied.
|
||||
|
||||
`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and **awaiting
|
||||
target-owner acknowledgement**. Offline validation must fail closed until
|
||||
that acknowledgement is recorded and the custody broker is connected.
|
||||
`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and owner-acknowledged.
|
||||
Offline validation currently fails closed because the window has not started.
|
||||
Do not mint the 900s identities until `2026-08-22T18:00:00Z`.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
The `audit-core-e2-pod.yaml` manifest is bound to cancelled engagement
|
||||
`WH-ENG-20260821-AUDIT-E2`. Do not apply it. New live runs use
|
||||
`plane/runner-pod.yaml` with a new unretired engagement ID after the plane
|
||||
exists.
|
||||
`WH-ENG-20260821-AUDIT-E2`. Do not apply it.
|
||||
|
||||
`whitehat-e2-audit-20260822.yaml` is the contract for
|
||||
`WH-ENG-20260822-AUDIT-E2-01`. Do not apply it until custody has projected
|
||||
the two mount-only tokens at window start. Invocation details are in
|
||||
`WH-ENG-20260822-AUDIT-E2-01-invocation.md`.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,48 @@
|
|||
# WH-ENG-20260822-AUDIT-E2-01 — invocation (no secrets)
|
||||
|
||||
Do not apply the runner pod and do not mint credentials until the custody
|
||||
owner projects two mount-only tokens at window start. Minting now would
|
||||
exhaust the 900-second TTL before `18:00Z`.
|
||||
|
||||
Current time-gate: `validate-engagement` and `admit-plane` fail closed with
|
||||
`engagement window has not started` until `2026-08-22T18:00:00Z`. After the
|
||||
window opens, `admit-plane` still fails closed while the live custody broker
|
||||
is unconnected.
|
||||
|
||||
## Custody projection (railiance-platform)
|
||||
|
||||
Schedule, do not mint early:
|
||||
|
||||
| Handle | Binding |
|
||||
| --- | --- |
|
||||
| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822`, `may_read=true`, `may_write=true` |
|
||||
| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822`, `may_read=true`, `may_write=true` |
|
||||
|
||||
- Secret name `whitehat/whitehat-e2-audit-credentials` (namespace `whitehat`)
|
||||
- Keys `token-a`, `token-b` only; never the full sender registry
|
||||
- Issue at `2026-08-22T18:00:00Z`, `expires_at` `2026-08-22T18:15:00Z`, TTL ≤ 900s
|
||||
- Attended registry reload and cleanup before expiry
|
||||
- Never return token values to whitehat, State Hub, or chat
|
||||
|
||||
## Runner (inside the admitted pod, after projection)
|
||||
|
||||
```
|
||||
python3 - \
|
||||
--base-url http://audit-core.audit-core.svc.cluster.local:8080 \
|
||||
--engagement-id WH-ENG-20260822-AUDIT-E2-01 \
|
||||
--target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \
|
||||
--token-a-file /var/run/secrets/whitehat/token-a \
|
||||
--token-b-file /var/run/secrets/whitehat/token-b \
|
||||
--tenant-a tenant:trial:whitehat-a-20260822 \
|
||||
--tenant-b tenant:trial:whitehat-b-20260822 \
|
||||
--event-a whitehat-e2-event-a-20260822 \
|
||||
--event-b whitehat-e2-event-b-20260822 \
|
||||
--absent-event whitehat-e2-absent-20260822 \
|
||||
--forged-event whitehat-e2-forged-b-20260822 \
|
||||
--correlation whitehat-e2-correlation-20260822 \
|
||||
--occurred-at 2026-08-22T18:00:00Z \
|
||||
--rate 10 --max-requests 30 --abort-p95-ms 500
|
||||
```
|
||||
|
||||
stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory
|
||||
and must stay inside `fixture_ids`.
|
||||
53
engagements/runtime/whitehat-e2-audit-20260822.yaml
Normal file
53
engagements/runtime/whitehat-e2-audit-20260822.yaml
Normal file
|
|
@ -0,0 +1,53 @@
|
|||
# CONTRACT ONLY. Do not apply until custody has projected
|
||||
# whitehat/whitehat-e2-audit-credentials at window start.
|
||||
# Never reuse WH-ENG-20260821-AUDIT-E2.
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: whitehat-e2-audit
|
||||
namespace: whitehat
|
||||
labels:
|
||||
app.kubernetes.io/name: whitehat-security
|
||||
app.kubernetes.io/component: whitehat-probe
|
||||
whitehat.security/plane: "true"
|
||||
whitehat.security/target: audit-core
|
||||
whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-01
|
||||
spec:
|
||||
serviceAccountName: whitehat-runner
|
||||
automountServiceAccountToken: false
|
||||
activeDeadlineSeconds: 900
|
||||
restartPolicy: Never
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
fsGroup: 10001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: probe
|
||||
image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["sleep", "900"]
|
||||
resources:
|
||||
requests: {cpu: 5m, memory: 16Mi}
|
||||
limits: {cpu: 50m, memory: 64Mi}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- name: credentials
|
||||
mountPath: /var/run/secrets/whitehat
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: credentials
|
||||
secret:
|
||||
secretName: whitehat-e2-audit-credentials
|
||||
defaultMode: 0440
|
||||
items:
|
||||
- key: token-a
|
||||
path: token-a
|
||||
- key: token-b
|
||||
path: token-b
|
||||
|
|
@ -160,9 +160,11 @@ artifact, not a deferral); `flex-auth` is pending.
|
|||
The 2026-08-21 production engagement IDs were cancelled without sending a
|
||||
target request and are retired. ops-mason applied the foundational plane on
|
||||
2026-08-22. The operator approved `WH-ENG-20260822-AUDIT-E2-01` at
|
||||
2026-08-22T09:52:55Z. Target-owner acknowledgement and the custody broker
|
||||
remain pending. Offline preflight must fail closed until both exist. Whitehat
|
||||
will not relabel tenant-engine to finish this task.
|
||||
2026-08-22T09:52:55Z; audit-core acknowledged at 2026-08-22T10:04:56Z
|
||||
(`32afceb`) after the fixture/digest correction `1418dac`. Offline preflight
|
||||
now fails closed because the window has not started. Custody must project two
|
||||
≤900s identities at `18:00Z`, not earlier. Whitehat will not relabel
|
||||
tenant-engine to finish this task.
|
||||
|
||||
### T04 — Prove the probes fail
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue