diff --git a/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md index 69a144f..e4b4db5 100644 --- a/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md +++ b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-01-invocation.md @@ -11,18 +11,33 @@ is unconnected. ## Custody projection (railiance-platform) -Schedule, do not mint early: +Procedure is implemented at railiance-platform `864cc20` +(`docs/audit-core-whitehat-e2-credential-projection.md`). `project` is +hard-gated to **18:00Z–18:03Z**. Cleanup must finish before 18:15Z. No mint +before the gate. | Handle | Binding | | --- | --- | | token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822`, `may_read=true`, `may_write=true` | | token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822`, `may_read=true`, `may_write=true` | -- Secret name `whitehat/whitehat-e2-audit-credentials` (namespace `whitehat`) -- Keys `token-a`, `token-b` only; never the full sender registry -- Issue at `2026-08-22T18:00:00Z`, `expires_at` `2026-08-22T18:15:00Z`, TTL ≤ 900s -- Attended registry reload and cleanup before expiry -- Never return token values to whitehat, State Hub, or chat +Attended commands, from railiance-platform, after 18:00Z and no later than 18:03Z: + +```bash +python3 scripts/audit-core-whitehat-e2-credentials.py preflight +python3 scripts/audit-core-whitehat-e2-credentials.py project \ + --confirm WH-ENG-20260822-AUDIT-E2-01:attended +``` + +After that notice, apply the runner contract and the invocation below. Before +18:15Z: + +```bash +python3 scripts/audit-core-whitehat-e2-credentials.py cleanup \ + --confirm WH-ENG-20260822-AUDIT-E2-01:attended +``` + +Never return token values to whitehat, State Hub, or chat. ## Runner (inside the admitted pod, after projection)