From b8facab71741b7a76bb9fc25930ce6a99f216ff1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 12:16:29 +0200 Subject: [PATCH] Schedule 18:00Z custody for acknowledged audit-core E2 Record the owner-acknowledged window, pin the runner invocation including the forged fixture id, and ask railiance-platform to project identities only at window start. No mint, no pod apply, no packets. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb --- SCOPE.md | 8 ++- docs/test-plane.md | 8 +-- engagements/2026-08-22-audit-core-e2.md | 38 ++++++------- engagements/README.md | 6 +-- engagements/runtime/README.md | 9 ++-- .../WH-ENG-20260822-AUDIT-E2-01-invocation.md | 48 +++++++++++++++++ .../runtime/whitehat-e2-audit-20260822.yaml | 53 +++++++++++++++++++ .../WHITEHAT-WP-0001-cross-tenant-evidence.md | 8 +-- 8 files changed, 139 insertions(+), 39 deletions(-) create mode 100644 engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md create mode 100644 engagements/runtime/whitehat-e2-audit-20260822.yaml diff --git a/SCOPE.md b/SCOPE.md index 01d68fd..5c88ab6 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -69,11 +69,9 @@ boundary always holds. - `T01` is complete: the rules of engagement were accepted on 2026-08-21. - `T02` is complete: the per-axis attacker model is recorded in `docs/attacker-model.md`. -- `T03` is in progress: the differential core, audit-core adapter and test - plane admission exist. `tenant-engine` is registered `not_applicable` for - E2. The foundational plane is applied. `WH-ENG-20260822-AUDIT-E2-01` is - operator-approved and awaits target-owner acknowledgement and a connected - custody broker. +- `T03` is in progress: `WH-ENG-20260822-AUDIT-E2-01` is operator-approved + and owner-acknowledged. The window has not started. Custody projection is + scheduled for `18:00Z`; tokens must not be minted early. - `T04` is complete for every applicable E2 probe: generic and audit-core shaped fixtures fail known-bad and pass known-good in-process. - `T05` is in progress: 24-hour cadence, offline evaluator and in-process diff --git a/docs/test-plane.md b/docs/test-plane.md index bb9bf33..8c3a154 100644 --- a/docs/test-plane.md +++ b/docs/test-plane.md @@ -47,7 +47,7 @@ Create `plane/KILL` to abort independently of the runner process. ## Retired identifiers -`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. The -foundational plane is provisioned first. `WH-ENG-20260822-AUDIT-E2-01` is -operator-approved and awaits target-owner acknowledgement. The live custody -broker remains unconnected. +`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. +`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and owner-acknowledged. +The window starts at `2026-08-22T18:00:00Z`. Do not mint the 900s identities +before then. The live custody broker remains unconnected until projection. diff --git a/engagements/2026-08-22-audit-core-e2.md b/engagements/2026-08-22-audit-core-e2.md index 025dc7a..d432432 100644 --- a/engagements/2026-08-22-audit-core-e2.md +++ b/engagements/2026-08-22-audit-core-e2.md @@ -1,26 +1,22 @@ # WH-ENG-20260822-AUDIT-E2-01 -Status: **operator-approved, awaiting target-owner acknowledgement**. -This is not yet authorization to send a packet or project credentials. +Status: **operator-approved and target-owner-acknowledged**. The window has +not started. Credentials must not be minted until window start so the 900s +TTL covers the run and cleanup. -Operator approved `2026-08-22T09:52:55Z` in the coordinating session -(`operator-session-2026-08-22-e2-approval`). Audit-core acknowledgement is -still pending. The cancelled ID `WH-ENG-20260821-AUDIT-E2` remains terminal. - -| Field | Value | +| Gate | State | | --- | --- | -| Target | `audit-core.audit-core.svc.cluster.local:8080` | -| Registration | `targets/audit-core-e2.json` (`applicable`, `live-e2`) | -| Source | pod `whitehat/whitehat-e2-audit` with plane and target labels, SA `whitehat-runner`, no token | -| Image pin | `forgejo.coulomb.social/coulomb/audit-core@sha256:7febc28e8a828dbc245144a38e5728e0fbf496b594dd7591170b450a1265fb10` | -| Identities | two ordinary tenant-scoped `may_read`/`may_write` senders, `source=whitehat-security`, TTL ≤ 900s, mount-only | -| Routes | `GET /readyz`, `POST /v1/events`, `GET /v1/events/{event_id}`, `GET /v1/events?correlation_id=` | -| Ceiling | concurrency 1; 10/min; at most 30 requests | -| Window | 2026-08-22T18:00:00Z–18:15:00Z | -| Cleanup | revoke both leases; delete only named synthetic fixtures; prove cleanup | -| Reporting | `risk-nexus`, no severity | +| Operator approval | `2026-08-22T09:52:55Z` | +| Owner acknowledgement | `2026-08-22T10:04:56Z` at `32afceb` | +| Foundational plane | applied by ops-mason `c26a6e5` | +| Window | `2026-08-22T18:00:00Z`–`18:15:00Z` | +| Image | `sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6` | +| Custody projection | scheduled, not minted | +| Runner pod | not applied | -Offline preflight must fail closed until `target_owner_acknowledged_at` is -set. After acknowledgement, the live custody broker is still unconnected and -must fail closed until two identities are projected. Do not apply -`plane/runner-pod.yaml` before that. +Offline preflight now fails closed with `engagement window has not started`. +At `18:00Z`, `Engagement.load` authorizes the record; `admit-plane` still +fails closed until the live custody broker is connected. + +Invocation, including required `--forged-event whitehat-e2-forged-b-20260822`: +`engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md`. diff --git a/engagements/README.md b/engagements/README.md index 826dcf2..64a29d8 100644 --- a/engagements/README.md +++ b/engagements/README.md @@ -14,7 +14,7 @@ from `whitehat admit-plane`. `WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are cancelled and must not be reused. The pod manifest under `runtime/` is bound to a cancelled ID and must not be applied. -`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and **awaiting -target-owner acknowledgement**. Offline validation must fail closed until -that acknowledgement is recorded and the custody broker is connected. +`WH-ENG-20260822-AUDIT-E2-01` is operator-approved and owner-acknowledged. +Offline validation currently fails closed because the window has not started. +Do not mint the 900s identities until `2026-08-22T18:00:00Z`. diff --git a/engagements/runtime/README.md b/engagements/runtime/README.md index a99a342..bc064db 100644 --- a/engagements/runtime/README.md +++ b/engagements/runtime/README.md @@ -1,4 +1,7 @@ The `audit-core-e2-pod.yaml` manifest is bound to cancelled engagement -`WH-ENG-20260821-AUDIT-E2`. Do not apply it. New live runs use -`plane/runner-pod.yaml` with a new unretired engagement ID after the plane -exists. +`WH-ENG-20260821-AUDIT-E2`. Do not apply it. + +`whitehat-e2-audit-20260822.yaml` is the contract for +`WH-ENG-20260822-AUDIT-E2-01`. Do not apply it until custody has projected +the two mount-only tokens at window start. Invocation details are in +`WH-ENG-20260822-AUDIT-E2-01-invocation.md`. diff --git a/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md new file mode 100644 index 0000000..69a144f --- /dev/null +++ b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md @@ -0,0 +1,48 @@ +# WH-ENG-20260822-AUDIT-E2-01 — invocation (no secrets) + +Do not apply the runner pod and do not mint credentials until the custody +owner projects two mount-only tokens at window start. Minting now would +exhaust the 900-second TTL before `18:00Z`. + +Current time-gate: `validate-engagement` and `admit-plane` fail closed with +`engagement window has not started` until `2026-08-22T18:00:00Z`. After the +window opens, `admit-plane` still fails closed while the live custody broker +is unconnected. + +## Custody projection (railiance-platform) + +Schedule, do not mint early: + +| Handle | Binding | +| --- | --- | +| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822`, `may_read=true`, `may_write=true` | +| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822`, `may_read=true`, `may_write=true` | + +- Secret name `whitehat/whitehat-e2-audit-credentials` (namespace `whitehat`) +- Keys `token-a`, `token-b` only; never the full sender registry +- Issue at `2026-08-22T18:00:00Z`, `expires_at` `2026-08-22T18:15:00Z`, TTL ≤ 900s +- Attended registry reload and cleanup before expiry +- Never return token values to whitehat, State Hub, or chat + +## Runner (inside the admitted pod, after projection) + +``` +python3 - \ + --base-url http://audit-core.audit-core.svc.cluster.local:8080 \ + --engagement-id WH-ENG-20260822-AUDIT-E2-01 \ + --target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \ + --token-a-file /var/run/secrets/whitehat/token-a \ + --token-b-file /var/run/secrets/whitehat/token-b \ + --tenant-a tenant:trial:whitehat-a-20260822 \ + --tenant-b tenant:trial:whitehat-b-20260822 \ + --event-a whitehat-e2-event-a-20260822 \ + --event-b whitehat-e2-event-b-20260822 \ + --absent-event whitehat-e2-absent-20260822 \ + --forged-event whitehat-e2-forged-b-20260822 \ + --correlation whitehat-e2-correlation-20260822 \ + --occurred-at 2026-08-22T18:00:00Z \ + --rate 10 --max-requests 30 --abort-p95-ms 500 +``` + +stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory +and must stay inside `fixture_ids`. diff --git a/engagements/runtime/whitehat-e2-audit-20260822.yaml b/engagements/runtime/whitehat-e2-audit-20260822.yaml new file mode 100644 index 0000000..fd4f6e4 --- /dev/null +++ b/engagements/runtime/whitehat-e2-audit-20260822.yaml @@ -0,0 +1,53 @@ +# CONTRACT ONLY. Do not apply until custody has projected +# whitehat/whitehat-e2-audit-credentials at window start. +# Never reuse WH-ENG-20260821-AUDIT-E2. +apiVersion: v1 +kind: Pod +metadata: + name: whitehat-e2-audit + namespace: whitehat + labels: + app.kubernetes.io/name: whitehat-security + app.kubernetes.io/component: whitehat-probe + whitehat.security/plane: "true" + whitehat.security/target: audit-core + whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-01 +spec: + serviceAccountName: whitehat-runner + automountServiceAccountToken: false + activeDeadlineSeconds: 900 + restartPolicy: Never + securityContext: + runAsNonRoot: true + runAsUser: 10001 + runAsGroup: 10001 + fsGroup: 10001 + seccompProfile: + type: RuntimeDefault + containers: + - name: probe + image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 + imagePullPolicy: IfNotPresent + command: ["sleep", "900"] + resources: + requests: {cpu: 5m, memory: 16Mi} + limits: {cpu: 50m, memory: 64Mi} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + volumeMounts: + - name: credentials + mountPath: /var/run/secrets/whitehat + readOnly: true + volumes: + - name: credentials + secret: + secretName: whitehat-e2-audit-credentials + defaultMode: 0440 + items: + - key: token-a + path: token-a + - key: token-b + path: token-b diff --git a/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md b/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md index 86eb790..48b66f4 100644 --- a/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md +++ b/workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md @@ -160,9 +160,11 @@ artifact, not a deferral); `flex-auth` is pending. The 2026-08-21 production engagement IDs were cancelled without sending a target request and are retired. ops-mason applied the foundational plane on 2026-08-22. The operator approved `WH-ENG-20260822-AUDIT-E2-01` at -2026-08-22T09:52:55Z. Target-owner acknowledgement and the custody broker -remain pending. Offline preflight must fail closed until both exist. Whitehat -will not relabel tenant-engine to finish this task. +2026-08-22T09:52:55Z; audit-core acknowledged at 2026-08-22T10:04:56Z +(`32afceb`) after the fixture/digest correction `1418dac`. Offline preflight +now fails closed because the window has not started. Custody must project two +≤900s identities at `18:00Z`, not earlier. Whitehat will not relabel +tenant-engine to finish this task. ### T04 — Prove the probes fail