coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Build authorization-gated tenancy evidence harness

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
This commit is contained in:
tegwick 2026-08-21 23:53:27 +02:00
parent 2c8e1d41ad
commit beab2a04d1
32 changed files with 1816 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

43
workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md
View file

@ -125,7 +125,7 @@ failure.
```task
id: WHITEHAT-WP-0001-T03
status: todo
status: progress
priority: high
state_hub_task_id: "742561f1-97b6-4fcc-8e06-d18508ddecae"
```
@ -144,11 +144,18 @@ The core technique: run the same request as two tenants and compare.
**Acceptance:** run against `tenant-engine` and `audit-core`, both of which
currently claim `E2`. The artifact is the run record, not a green tick.
Implementation progress, 2026-08-21: `src/whitehat_security/differential.py`
now performs owner/attacker/absent comparisons, detects fixture disclosure and
write-side state change, and persists only sanitized observations. Concrete
route inventories live in `probe-packs/tenant-engine-e2.json` and
`probe-packs/audit-core-e2.json`. The two target runs remain gated on complete
engagement records, owner acknowledgements and executable identity adapters.
### T04 — Prove the probes fail
```task
id: WHITEHAT-WP-0001-T04
status: wait
status: progress
priority: high
state_hub_task_id: "a2afc0f5-3ece-410c-864c-829a8aac30fc"
```
@ -163,11 +170,18 @@ the same discipline applies here and is not optional.
**Acceptance:** every probe in T03 demonstrated failing before any of them is
trusted passing.
Implementation progress, 2026-08-21: five generic read/list/create/update/
delete probes pass the enforcing in-process fixture and all five produce
findings when its tenant predicate is removed. The sanitized artifact is
`evidence/offline-calibration.json`; fourteen tests guard the calibration and
fail-closed authorization behavior. Target-specific probes are not trusted
passing until they receive the same calibration.
### T05 — RLS conformance under attack (the E3 artifact)
```task
id: WHITEHAT-WP-0001-T05
status: wait
status: progress
priority: medium
state_hub_task_id: "6df676e7-bed5-4291-a128-eb6e9844edf2"
```
@ -188,11 +202,18 @@ notices. This repo is that something.
control the interval between runs *is* the exposure window, and ADR-0003 leaves
the number to this repo. Set it, and state the resulting window in the record.
Implementation progress, 2026-08-21: the cadence is fixed at 24 hours plus run
and reporting latency, with event-triggered pre-promotion runs after schema,
role, RLS or security-definer changes. `src/whitehat_security/e3.py` encodes the
seven expected outcomes and keeps the SQL-compromise GUC reset labeled as E3's
documented limit. A live database run still requires its separate authorized
target and window.
### T06 — Noisy-neighbour characterisation (the P1/P2 artifact)
```task
id: WHITEHAT-WP-0001-T06
status: wait
status: progress
priority: medium
state_hub_task_id: "99254ab5-f08e-44c7-8399-be706dc03019"
```
@ -210,11 +231,17 @@ acceptable.
Runs inside a declared window per T01 — on a single-node rail with a six-
consumer connection ceiling, a saturation probe is an outage if run carelessly.
Implementation progress, 2026-08-21: `src/whitehat_security/capacity.py`
records baseline/loaded latency, errors and throughput per consumer, governor
binding, aggressor peak/ceiling and neighbour degradation. No live load has
been generated; the required operator-approved substrate window and ceilings
do not yet exist.
### T07 — Reporting into risk-nexus
```task
id: WHITEHAT-WP-0001-T07
status: wait
status: progress
priority: medium
state_hub_task_id: "54f33288-5361-4b20-8e1f-168866d64644"
```
@ -227,6 +254,12 @@ A **passing** run is also reported. "The attacks we thought of did not work" is
the honest claim, and recording it dated is what lets anyone see how stale the
assurance has become.
Implementation progress, 2026-08-21: `schemas/run-report.schema.json` defines
the minimized evidence contract and `whitehat risk-message` renders both pass
and finding deliveries without severity. Offline calibration is deliberately
not routed as target assurance. Completion awaits the first authorized target
report being delivered to `risk-nexus`.
## Sequencing
T01 gates all. T02 shapes T03/T05/T06. T04 gates trusting any of them. T07 can