coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

authorize WH-ENG-20260822-AUDIT-E2-02 at 19:15Z

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
tegwick 2026-08-22 20:49:10 +02:00
parent f8251c5de8
commit e1f9f81d15
4 changed files with 206 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

63
engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md Normal file
View file

@ -0,0 +1,63 @@
# WH-ENG-20260822-AUDIT-E2-02 — invocation (no secrets)
This engagement is approved for `2026-08-22T19:15:00Z`–`19:30:00Z`. Do not
apply the runner before custody reports projection ready, and do not mint
before the window opens.
Current time-gate: `validate-engagement` and `admit-plane` fail closed with
`engagement window has not started` until `2026-08-22T19:15:00Z`. After the
window opens, `admit-plane` still fails closed while the live custody broker
is unconnected.
## Custody projection (railiance-platform)
Procedure is implemented at railiance-platform `864cc20`
(`docs/audit-core-whitehat-e2-credential-projection.md`). `project` is
hard-gated to **19:15Z–19:18Z**. Cleanup must finish before 19:30Z. No mint
before the gate.
| Handle | Binding |
| --- | --- |
| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822-02`, `may_read=true`, `may_write=true` |
| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822-02`, `may_read=true`, `may_write=true` |
Attended commands, from railiance-platform, after 19:15Z and no later than 19:18Z:
```bash
python3 scripts/audit-core-whitehat-e2-credentials-02.py preflight
python3 scripts/audit-core-whitehat-e2-credentials-02.py project \
--confirm WH-ENG-20260822-AUDIT-E2-02:attended
```
After that notice, apply the runner contract and the invocation below. Before
19:30Z:
```bash
python3 scripts/audit-core-whitehat-e2-credentials-02.py cleanup \
--confirm WH-ENG-20260822-AUDIT-E2-02:attended
```
Never return token values to whitehat, State Hub, or chat.
## Runner (inside the admitted pod, after projection)
```
python3 - \
--base-url http://audit-core.audit-core.svc.cluster.local:8080 \
--engagement-id WH-ENG-20260822-AUDIT-E2-02 \
--target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \
--token-a-file /var/run/secrets/whitehat/token-a \
--token-b-file /var/run/secrets/whitehat/token-b \
--tenant-a tenant:trial:whitehat-a-20260822-02 \
--tenant-b tenant:trial:whitehat-b-20260822-02 \
--event-a whitehat-e2-event-a-20260822-02 \
--event-b whitehat-e2-event-b-20260822-02 \
--absent-event whitehat-e2-absent-20260822-02 \
--forged-event whitehat-e2-forged-b-20260822-02 \
--correlation whitehat-e2-correlation-20260822-02 \
--occurred-at 2026-08-22T19:15:00Z \
--rate 10 --max-requests 30 --abort-p95-ms 500
```
stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory
and must stay inside `fixture_ids`.