From e1f9f81d15ead7b9b21e3a588a72940b2901c4d0 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 20:49:10 +0200 Subject: [PATCH] authorize WH-ENG-20260822-AUDIT-E2-02 at 19:15Z Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de --- engagements/2026-08-22-audit-core-e2-02.json | 69 +++++++++++++++++++ engagements/2026-08-22-audit-core-e2-02.md | 21 ++++++ .../WH-ENG-20260822-AUDIT-E2-02-invocation.md | 63 +++++++++++++++++ .../whitehat-e2-audit-20260822-02.yaml | 53 ++++++++++++++ 4 files changed, 206 insertions(+) create mode 100644 engagements/2026-08-22-audit-core-e2-02.json create mode 100644 engagements/2026-08-22-audit-core-e2-02.md create mode 100644 engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md create mode 100644 engagements/runtime/whitehat-e2-audit-20260822-02.yaml diff --git a/engagements/2026-08-22-audit-core-e2-02.json b/engagements/2026-08-22-audit-core-e2-02.json new file mode 100644 index 0000000..5e4621b --- /dev/null +++ b/engagements/2026-08-22-audit-core-e2-02.json @@ -0,0 +1,69 @@ +{ + "engagement_id": "WH-ENG-20260822-AUDIT-E2-02", + "status": "approved", + "proposal_at": "2026-08-22T18:36:50Z", + "proposal_reason": "Fresh attended retry after WH-ENG-20260822-AUDIT-E2-01 expired with zero packets. The terminal identifier, identities and fixtures are not reused.", + "authorization_id": "operator-session-2026-08-22-e2-02-approval", + "authorizer": "repository operator and infrastructure owner", + "approved_at": "2026-08-22T18:42:50Z", + "expires_at": "2026-08-22T19:30:00Z", + "target": "http://audit-core.audit-core.svc.cluster.local:8080", + "target_id": "audit-core", + "target_owner": "audit-core / infrastructure operator", + "target_owner_acknowledged_at": "2026-08-22T18:45:39Z", + "target_owner_acknowledgement_status": "audit-core accepted the exact -02 identifier, new tenant and event fixtures, two expiring tenant-scoped identities, reviewed target digest, 19:15Z-19:30Z window, abort thresholds, and cleanup obligation after direct review in the attended operator session", + "environment": "production", + "production_approval": "Explicit operator approval of WH-ENG-20260822-AUDIT-E2-02 in the coordinating session on 2026-08-22", + "approval_class": "live-e2", + "plane_namespace": "whitehat", + "runner_image_digest": "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6", + "namespace": "whitehat", + "source": "dedicated pod whitehat/whitehat-e2-audit, labels whitehat.security/plane=true, whitehat.security/target=audit-core, whitehat.security/engagement=WH-ENG-20260822-AUDIT-E2-02, serviceAccount whitehat-runner, automountServiceAccountToken=false", + "source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6", + "control_plane_scope": [ + "GET apps/v1 deployment audit-core/audit-core for target revision only", + "GET v1 service audit-core/audit-core for target identity only", + "CREATE/GET/EXEC/DELETE v1 pod whitehat/whitehat-e2-audit only; EXEC may stream runners/audit_core_e2.py to python3 stdin and invoke no other program", + "mount but never GET v1 secret whitehat/whitehat-e2-audit-credentials provisioned by the custody owner", + "GET pod log whitehat/whitehat-e2-audit only" + ], + "routes": [ + "GET /readyz", + "POST /v1/events", + "GET /v1/events/{event_id}", + "GET /v1/events?correlation_id={correlation_id}" + ], + "fixture_ids": [ + "tenant:trial:whitehat-a-20260822-02", "tenant:trial:whitehat-b-20260822-02", + "whitehat-e2-event-a-20260822-02", "whitehat-e2-event-b-20260822-02", + "whitehat-e2-absent-20260822-02", "whitehat-e2-forged-b-20260822-02", + "whitehat-e2-correlation-20260822-02" + ], + "credential_lane": "audit-core sender registry through its sanctioned custody owner; no credential value retained", + "credential_role": "two temporary ordinary tenant-scoped may_read/may_write fixture senders bound to source=whitehat-security", + "credential_max_ttl_seconds": 900, + "techniques": ["e2-differential"], + "prohibited_techniques": [ + "discovery", "direct-database-access", "saturation", "large-payload", + "real-data-collection", "adjacent-service-follow-up", + "any control-plane operation outside control_plane_scope" + ], + "rate_limit_per_minute": 10, + "max_concurrency": 1, + "maximum_requests": 30, + "window_start": "2026-08-22T19:15:00Z", + "window_end": "2026-08-22T19:30:00Z", + "operator_contact": "repository operator in coordinating session", + "abort_contact": "repository operator in coordinating session", + "abort_thresholds": { + "p95_latency_ms": 500, + "probe_attributable_5xx": 1, + "unexpected_or_non_fixture_data": 1, + "missing_attribution": 1 + }, + "posture_claim": "implemented E2; currently evidenced E1", + "attacker_model": "E2-authenticated-tenant-a", + "finding_destination": "risk-nexus", + "plane_bundle_digest": "9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035", + "target_ingress": "audit-core-whitehat-ingress at audit-core 5b5196e; namespace=whitehat AND whitehat.security/plane=true AND whitehat.security/target=audit-core" +} diff --git a/engagements/2026-08-22-audit-core-e2-02.md b/engagements/2026-08-22-audit-core-e2-02.md new file mode 100644 index 0000000..341c546 --- /dev/null +++ b/engagements/2026-08-22-audit-core-e2-02.md @@ -0,0 +1,21 @@ +# WH-ENG-20260822-AUDIT-E2-02 + +Status: **approved and waiting**. The engagement is fail-closed until +`2026-08-22T19:15:00Z` and until custody reports projection ready. + +| Gate | State | +| --- | --- | +| Operator approval | `2026-08-22T18:42:50Z` in the coordinating session | +| Owner acknowledgement | `2026-08-22T18:45:39Z` after direct artifact review | +| Foundational plane | applied by ops-mason `c26a6e5` | +| Window | `2026-08-22T19:15:00Z`–`19:30:00Z` | +| Image | `sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6` | +| Custody projection | pending; do not mint before 19:15Z | +| Runner pod | not applied | +| Packets | none | + +Offline preflight must fail closed before the window and until the live custody +broker confirms the two exact mounted identities. + +Invocation, including required `--forged-event whitehat-e2-forged-b-20260822-02`: +`engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md`. diff --git a/engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md new file mode 100644 index 0000000..1c29b8f --- /dev/null +++ b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md @@ -0,0 +1,63 @@ +# WH-ENG-20260822-AUDIT-E2-02 — invocation (no secrets) + +This engagement is approved for `2026-08-22T19:15:00Z`–`19:30:00Z`. Do not +apply the runner before custody reports projection ready, and do not mint +before the window opens. + +Current time-gate: `validate-engagement` and `admit-plane` fail closed with +`engagement window has not started` until `2026-08-22T19:15:00Z`. After the +window opens, `admit-plane` still fails closed while the live custody broker +is unconnected. + +## Custody projection (railiance-platform) + +Procedure is implemented at railiance-platform `864cc20` +(`docs/audit-core-whitehat-e2-credential-projection.md`). `project` is +hard-gated to **19:15Z–19:18Z**. Cleanup must finish before 19:30Z. No mint +before the gate. + +| Handle | Binding | +| --- | --- | +| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822-02`, `may_read=true`, `may_write=true` | +| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822-02`, `may_read=true`, `may_write=true` | + +Attended commands, from railiance-platform, after 19:15Z and no later than 19:18Z: + +```bash +python3 scripts/audit-core-whitehat-e2-credentials-02.py preflight +python3 scripts/audit-core-whitehat-e2-credentials-02.py project \ + --confirm WH-ENG-20260822-AUDIT-E2-02:attended +``` + +After that notice, apply the runner contract and the invocation below. Before +19:30Z: + +```bash +python3 scripts/audit-core-whitehat-e2-credentials-02.py cleanup \ + --confirm WH-ENG-20260822-AUDIT-E2-02:attended +``` + +Never return token values to whitehat, State Hub, or chat. + +## Runner (inside the admitted pod, after projection) + +``` +python3 - \ + --base-url http://audit-core.audit-core.svc.cluster.local:8080 \ + --engagement-id WH-ENG-20260822-AUDIT-E2-02 \ + --target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \ + --token-a-file /var/run/secrets/whitehat/token-a \ + --token-b-file /var/run/secrets/whitehat/token-b \ + --tenant-a tenant:trial:whitehat-a-20260822-02 \ + --tenant-b tenant:trial:whitehat-b-20260822-02 \ + --event-a whitehat-e2-event-a-20260822-02 \ + --event-b whitehat-e2-event-b-20260822-02 \ + --absent-event whitehat-e2-absent-20260822-02 \ + --forged-event whitehat-e2-forged-b-20260822-02 \ + --correlation whitehat-e2-correlation-20260822-02 \ + --occurred-at 2026-08-22T19:15:00Z \ + --rate 10 --max-requests 30 --abort-p95-ms 500 +``` + +stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory +and must stay inside `fixture_ids`. diff --git a/engagements/runtime/whitehat-e2-audit-20260822-02.yaml b/engagements/runtime/whitehat-e2-audit-20260822-02.yaml new file mode 100644 index 0000000..bbedf9a --- /dev/null +++ b/engagements/runtime/whitehat-e2-audit-20260822-02.yaml @@ -0,0 +1,53 @@ +# CONTRACT ONLY. Do not apply until custody has projected +# whitehat/whitehat-e2-audit-credentials at window start. +# Never reuse WH-ENG-20260822-AUDIT-E2-01 or its fixtures. +apiVersion: v1 +kind: Pod +metadata: + name: whitehat-e2-audit + namespace: whitehat + labels: + app.kubernetes.io/name: whitehat-security + app.kubernetes.io/component: whitehat-probe + whitehat.security/plane: "true" + whitehat.security/target: audit-core + whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-02 +spec: + serviceAccountName: whitehat-runner + automountServiceAccountToken: false + activeDeadlineSeconds: 900 + restartPolicy: Never + securityContext: + runAsNonRoot: true + runAsUser: 10001 + runAsGroup: 10001 + fsGroup: 10001 + seccompProfile: + type: RuntimeDefault + containers: + - name: probe + image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 + imagePullPolicy: IfNotPresent + command: ["sleep", "900"] + resources: + requests: {cpu: 5m, memory: 16Mi} + limits: {cpu: 50m, memory: 64Mi} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + volumeMounts: + - name: credentials + mountPath: /var/run/secrets/whitehat + readOnly: true + volumes: + - name: credentials + secret: + secretName: whitehat-e2-audit-credentials + defaultMode: 0440 + items: + - key: token-a + path: token-a + - key: token-b + path: token-b