authorize WH-ENG-20260822-AUDIT-E2-02 at 19:15Z

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
2026-08-22 20:49:10 +02:00 · 2026-08-22 20:49:10 +02:00 · e1f9f81d15
commit e1f9f81d15
parent f8251c5de8
4 changed files with 206 additions and 0 deletions
--- a/engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md
+++ b/engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md
@ -0,0 +1,63 @@
+# WH-ENG-20260822-AUDIT-E2-02 — invocation (no secrets)
+
+This engagement is approved for `2026-08-22T19:15:00Z`–`19:30:00Z`. Do not
+apply the runner before custody reports projection ready, and do not mint
+before the window opens.
+
+Current time-gate: `validate-engagement` and `admit-plane` fail closed with
+`engagement window has not started` until `2026-08-22T19:15:00Z`. After the
+window opens, `admit-plane` still fails closed while the live custody broker
+is unconnected.
+
+## Custody projection (railiance-platform)
+
+Procedure is implemented at railiance-platform `864cc20`
+(`docs/audit-core-whitehat-e2-credential-projection.md`). `project` is
+hard-gated to **19:15Z–19:18Z**. Cleanup must finish before 19:30Z. No mint
+before the gate.
+
+| Handle | Binding |
+| --- | --- |
+| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822-02`, `may_read=true`, `may_write=true` |
+| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822-02`, `may_read=true`, `may_write=true` |
+
+Attended commands, from railiance-platform, after 19:15Z and no later than 19:18Z:
+
+```bash
+python3 scripts/audit-core-whitehat-e2-credentials-02.py preflight
+python3 scripts/audit-core-whitehat-e2-credentials-02.py project \
+  --confirm WH-ENG-20260822-AUDIT-E2-02:attended
+```
+
+After that notice, apply the runner contract and the invocation below. Before
+19:30Z:
+
+```bash
+python3 scripts/audit-core-whitehat-e2-credentials-02.py cleanup \
+  --confirm WH-ENG-20260822-AUDIT-E2-02:attended
+```
+
+Never return token values to whitehat, State Hub, or chat.
+
+## Runner (inside the admitted pod, after projection)
+
+```
+python3 - \
+  --base-url http://audit-core.audit-core.svc.cluster.local:8080 \
+  --engagement-id WH-ENG-20260822-AUDIT-E2-02 \
+  --target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \
+  --token-a-file /var/run/secrets/whitehat/token-a \
+  --token-b-file /var/run/secrets/whitehat/token-b \
+  --tenant-a tenant:trial:whitehat-a-20260822-02 \
+  --tenant-b tenant:trial:whitehat-b-20260822-02 \
+  --event-a whitehat-e2-event-a-20260822-02 \
+  --event-b whitehat-e2-event-b-20260822-02 \
+  --absent-event whitehat-e2-absent-20260822-02 \
+  --forged-event whitehat-e2-forged-b-20260822-02 \
+  --correlation whitehat-e2-correlation-20260822-02 \
+  --occurred-at 2026-08-22T19:15:00Z \
+  --rate 10 --max-requests 30 --abort-p95-ms 500
+```
+
+stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory
+and must stay inside `fixture_ids`.
--- a/engagements/runtime/whitehat-e2-audit-20260822-02.yaml
+++ b/engagements/runtime/whitehat-e2-audit-20260822-02.yaml
@ -0,0 +1,53 @@
+# CONTRACT ONLY. Do not apply until custody has projected
+# whitehat/whitehat-e2-audit-credentials at window start.
+# Never reuse WH-ENG-20260822-AUDIT-E2-01 or its fixtures.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: whitehat-e2-audit
+  namespace: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+    app.kubernetes.io/component: whitehat-probe
+    whitehat.security/plane: "true"
+    whitehat.security/target: audit-core
+    whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-02
+spec:
+  serviceAccountName: whitehat-runner
+  automountServiceAccountToken: false
+  activeDeadlineSeconds: 900
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: probe
+      image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
+      imagePullPolicy: IfNotPresent
+      command: ["sleep", "900"]
+      resources:
+        requests: {cpu: 5m, memory: 16Mi}
+        limits: {cpu: 50m, memory: 64Mi}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        readOnlyRootFilesystem: true
+      volumeMounts:
+        - name: credentials
+          mountPath: /var/run/secrets/whitehat
+          readOnly: true
+  volumes:
+    - name: credentials
+      secret:
+        secretName: whitehat-e2-audit-credentials
+        defaultMode: 0440
+        items:
+          - key: token-a
+            path: token-a
+          - key: token-b
+            path: token-b