authorize WH-ENG-20260822-AUDIT-E2-02 at 19:15Z
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de
This commit is contained in:
parent
f8251c5de8
commit
e1f9f81d15
4 changed files with 206 additions and 0 deletions
69
engagements/2026-08-22-audit-core-e2-02.json
Normal file
69
engagements/2026-08-22-audit-core-e2-02.json
Normal file
|
|
@ -0,0 +1,69 @@
|
||||||
|
{
|
||||||
|
"engagement_id": "WH-ENG-20260822-AUDIT-E2-02",
|
||||||
|
"status": "approved",
|
||||||
|
"proposal_at": "2026-08-22T18:36:50Z",
|
||||||
|
"proposal_reason": "Fresh attended retry after WH-ENG-20260822-AUDIT-E2-01 expired with zero packets. The terminal identifier, identities and fixtures are not reused.",
|
||||||
|
"authorization_id": "operator-session-2026-08-22-e2-02-approval",
|
||||||
|
"authorizer": "repository operator and infrastructure owner",
|
||||||
|
"approved_at": "2026-08-22T18:42:50Z",
|
||||||
|
"expires_at": "2026-08-22T19:30:00Z",
|
||||||
|
"target": "http://audit-core.audit-core.svc.cluster.local:8080",
|
||||||
|
"target_id": "audit-core",
|
||||||
|
"target_owner": "audit-core / infrastructure operator",
|
||||||
|
"target_owner_acknowledged_at": "2026-08-22T18:45:39Z",
|
||||||
|
"target_owner_acknowledgement_status": "audit-core accepted the exact -02 identifier, new tenant and event fixtures, two expiring tenant-scoped identities, reviewed target digest, 19:15Z-19:30Z window, abort thresholds, and cleanup obligation after direct review in the attended operator session",
|
||||||
|
"environment": "production",
|
||||||
|
"production_approval": "Explicit operator approval of WH-ENG-20260822-AUDIT-E2-02 in the coordinating session on 2026-08-22",
|
||||||
|
"approval_class": "live-e2",
|
||||||
|
"plane_namespace": "whitehat",
|
||||||
|
"runner_image_digest": "sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
|
||||||
|
"namespace": "whitehat",
|
||||||
|
"source": "dedicated pod whitehat/whitehat-e2-audit, labels whitehat.security/plane=true, whitehat.security/target=audit-core, whitehat.security/engagement=WH-ENG-20260822-AUDIT-E2-02, serviceAccount whitehat-runner, automountServiceAccountToken=false",
|
||||||
|
"source_image": "forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6",
|
||||||
|
"control_plane_scope": [
|
||||||
|
"GET apps/v1 deployment audit-core/audit-core for target revision only",
|
||||||
|
"GET v1 service audit-core/audit-core for target identity only",
|
||||||
|
"CREATE/GET/EXEC/DELETE v1 pod whitehat/whitehat-e2-audit only; EXEC may stream runners/audit_core_e2.py to python3 stdin and invoke no other program",
|
||||||
|
"mount but never GET v1 secret whitehat/whitehat-e2-audit-credentials provisioned by the custody owner",
|
||||||
|
"GET pod log whitehat/whitehat-e2-audit only"
|
||||||
|
],
|
||||||
|
"routes": [
|
||||||
|
"GET /readyz",
|
||||||
|
"POST /v1/events",
|
||||||
|
"GET /v1/events/{event_id}",
|
||||||
|
"GET /v1/events?correlation_id={correlation_id}"
|
||||||
|
],
|
||||||
|
"fixture_ids": [
|
||||||
|
"tenant:trial:whitehat-a-20260822-02", "tenant:trial:whitehat-b-20260822-02",
|
||||||
|
"whitehat-e2-event-a-20260822-02", "whitehat-e2-event-b-20260822-02",
|
||||||
|
"whitehat-e2-absent-20260822-02", "whitehat-e2-forged-b-20260822-02",
|
||||||
|
"whitehat-e2-correlation-20260822-02"
|
||||||
|
],
|
||||||
|
"credential_lane": "audit-core sender registry through its sanctioned custody owner; no credential value retained",
|
||||||
|
"credential_role": "two temporary ordinary tenant-scoped may_read/may_write fixture senders bound to source=whitehat-security",
|
||||||
|
"credential_max_ttl_seconds": 900,
|
||||||
|
"techniques": ["e2-differential"],
|
||||||
|
"prohibited_techniques": [
|
||||||
|
"discovery", "direct-database-access", "saturation", "large-payload",
|
||||||
|
"real-data-collection", "adjacent-service-follow-up",
|
||||||
|
"any control-plane operation outside control_plane_scope"
|
||||||
|
],
|
||||||
|
"rate_limit_per_minute": 10,
|
||||||
|
"max_concurrency": 1,
|
||||||
|
"maximum_requests": 30,
|
||||||
|
"window_start": "2026-08-22T19:15:00Z",
|
||||||
|
"window_end": "2026-08-22T19:30:00Z",
|
||||||
|
"operator_contact": "repository operator in coordinating session",
|
||||||
|
"abort_contact": "repository operator in coordinating session",
|
||||||
|
"abort_thresholds": {
|
||||||
|
"p95_latency_ms": 500,
|
||||||
|
"probe_attributable_5xx": 1,
|
||||||
|
"unexpected_or_non_fixture_data": 1,
|
||||||
|
"missing_attribution": 1
|
||||||
|
},
|
||||||
|
"posture_claim": "implemented E2; currently evidenced E1",
|
||||||
|
"attacker_model": "E2-authenticated-tenant-a",
|
||||||
|
"finding_destination": "risk-nexus",
|
||||||
|
"plane_bundle_digest": "9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035",
|
||||||
|
"target_ingress": "audit-core-whitehat-ingress at audit-core 5b5196e; namespace=whitehat AND whitehat.security/plane=true AND whitehat.security/target=audit-core"
|
||||||
|
}
|
||||||
21
engagements/2026-08-22-audit-core-e2-02.md
Normal file
21
engagements/2026-08-22-audit-core-e2-02.md
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
# WH-ENG-20260822-AUDIT-E2-02
|
||||||
|
|
||||||
|
Status: **approved and waiting**. The engagement is fail-closed until
|
||||||
|
`2026-08-22T19:15:00Z` and until custody reports projection ready.
|
||||||
|
|
||||||
|
| Gate | State |
|
||||||
|
| --- | --- |
|
||||||
|
| Operator approval | `2026-08-22T18:42:50Z` in the coordinating session |
|
||||||
|
| Owner acknowledgement | `2026-08-22T18:45:39Z` after direct artifact review |
|
||||||
|
| Foundational plane | applied by ops-mason `c26a6e5` |
|
||||||
|
| Window | `2026-08-22T19:15:00Z`–`19:30:00Z` |
|
||||||
|
| Image | `sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6` |
|
||||||
|
| Custody projection | pending; do not mint before 19:15Z |
|
||||||
|
| Runner pod | not applied |
|
||||||
|
| Packets | none |
|
||||||
|
|
||||||
|
Offline preflight must fail closed before the window and until the live custody
|
||||||
|
broker confirms the two exact mounted identities.
|
||||||
|
|
||||||
|
Invocation, including required `--forged-event whitehat-e2-forged-b-20260822-02`:
|
||||||
|
`engagements/runtime/WH-ENG-20260822-AUDIT-E2-02-invocation.md`.
|
||||||
|
|
@ -0,0 +1,63 @@
|
||||||
|
# WH-ENG-20260822-AUDIT-E2-02 — invocation (no secrets)
|
||||||
|
|
||||||
|
This engagement is approved for `2026-08-22T19:15:00Z`–`19:30:00Z`. Do not
|
||||||
|
apply the runner before custody reports projection ready, and do not mint
|
||||||
|
before the window opens.
|
||||||
|
|
||||||
|
Current time-gate: `validate-engagement` and `admit-plane` fail closed with
|
||||||
|
`engagement window has not started` until `2026-08-22T19:15:00Z`. After the
|
||||||
|
window opens, `admit-plane` still fails closed while the live custody broker
|
||||||
|
is unconnected.
|
||||||
|
|
||||||
|
## Custody projection (railiance-platform)
|
||||||
|
|
||||||
|
Procedure is implemented at railiance-platform `864cc20`
|
||||||
|
(`docs/audit-core-whitehat-e2-credential-projection.md`). `project` is
|
||||||
|
hard-gated to **19:15Z–19:18Z**. Cleanup must finish before 19:30Z. No mint
|
||||||
|
before the gate.
|
||||||
|
|
||||||
|
| Handle | Binding |
|
||||||
|
| --- | --- |
|
||||||
|
| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822-02`, `may_read=true`, `may_write=true` |
|
||||||
|
| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822-02`, `may_read=true`, `may_write=true` |
|
||||||
|
|
||||||
|
Attended commands, from railiance-platform, after 19:15Z and no later than 19:18Z:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 scripts/audit-core-whitehat-e2-credentials-02.py preflight
|
||||||
|
python3 scripts/audit-core-whitehat-e2-credentials-02.py project \
|
||||||
|
--confirm WH-ENG-20260822-AUDIT-E2-02:attended
|
||||||
|
```
|
||||||
|
|
||||||
|
After that notice, apply the runner contract and the invocation below. Before
|
||||||
|
19:30Z:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 scripts/audit-core-whitehat-e2-credentials-02.py cleanup \
|
||||||
|
--confirm WH-ENG-20260822-AUDIT-E2-02:attended
|
||||||
|
```
|
||||||
|
|
||||||
|
Never return token values to whitehat, State Hub, or chat.
|
||||||
|
|
||||||
|
## Runner (inside the admitted pod, after projection)
|
||||||
|
|
||||||
|
```
|
||||||
|
python3 - \
|
||||||
|
--base-url http://audit-core.audit-core.svc.cluster.local:8080 \
|
||||||
|
--engagement-id WH-ENG-20260822-AUDIT-E2-02 \
|
||||||
|
--target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \
|
||||||
|
--token-a-file /var/run/secrets/whitehat/token-a \
|
||||||
|
--token-b-file /var/run/secrets/whitehat/token-b \
|
||||||
|
--tenant-a tenant:trial:whitehat-a-20260822-02 \
|
||||||
|
--tenant-b tenant:trial:whitehat-b-20260822-02 \
|
||||||
|
--event-a whitehat-e2-event-a-20260822-02 \
|
||||||
|
--event-b whitehat-e2-event-b-20260822-02 \
|
||||||
|
--absent-event whitehat-e2-absent-20260822-02 \
|
||||||
|
--forged-event whitehat-e2-forged-b-20260822-02 \
|
||||||
|
--correlation whitehat-e2-correlation-20260822-02 \
|
||||||
|
--occurred-at 2026-08-22T19:15:00Z \
|
||||||
|
--rate 10 --max-requests 30 --abort-p95-ms 500
|
||||||
|
```
|
||||||
|
|
||||||
|
stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory
|
||||||
|
and must stay inside `fixture_ids`.
|
||||||
53
engagements/runtime/whitehat-e2-audit-20260822-02.yaml
Normal file
53
engagements/runtime/whitehat-e2-audit-20260822-02.yaml
Normal file
|
|
@ -0,0 +1,53 @@
|
||||||
|
# CONTRACT ONLY. Do not apply until custody has projected
|
||||||
|
# whitehat/whitehat-e2-audit-credentials at window start.
|
||||||
|
# Never reuse WH-ENG-20260822-AUDIT-E2-01 or its fixtures.
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: whitehat-e2-audit
|
||||||
|
namespace: whitehat
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: whitehat-security
|
||||||
|
app.kubernetes.io/component: whitehat-probe
|
||||||
|
whitehat.security/plane: "true"
|
||||||
|
whitehat.security/target: audit-core
|
||||||
|
whitehat.security/engagement: WH-ENG-20260822-AUDIT-E2-02
|
||||||
|
spec:
|
||||||
|
serviceAccountName: whitehat-runner
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
activeDeadlineSeconds: 900
|
||||||
|
restartPolicy: Never
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 10001
|
||||||
|
runAsGroup: 10001
|
||||||
|
fsGroup: 10001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
containers:
|
||||||
|
- name: probe
|
||||||
|
image: forgejo.coulomb.social/coulomb/audit-core@sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["sleep", "900"]
|
||||||
|
resources:
|
||||||
|
requests: {cpu: 5m, memory: 16Mi}
|
||||||
|
limits: {cpu: 50m, memory: 64Mi}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop: ["ALL"]
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
volumeMounts:
|
||||||
|
- name: credentials
|
||||||
|
mountPath: /var/run/secrets/whitehat
|
||||||
|
readOnly: true
|
||||||
|
volumes:
|
||||||
|
- name: credentials
|
||||||
|
secret:
|
||||||
|
secretName: whitehat-e2-audit-credentials
|
||||||
|
defaultMode: 0440
|
||||||
|
items:
|
||||||
|
- key: token-a
|
||||||
|
path: token-a
|
||||||
|
- key: token-b
|
||||||
|
path: token-b
|
||||||
Loading…
Add table
Add a link
Reference in a new issue