Updated by fix-consistency on 2026-08-23:
- update .custodian-brief.md for whitehat-security
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Land the sanitized WH-ENG-20260822-AUDIT-E2-03 report, mark the
engagement completed and terminal, and close the applicable E2 harness
and risk-nexus delivery tasks. flex-auth stays pending; tenant-engine
stays not_applicable.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Platform reproduced a recanonicalized projection receipt with a
substituted all-zero broker digest on the operational path. WP-0025
admission now requires --broker-receipt, threads it through
broker_from_receipt, and refuses unless the digest matches exactly.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Railiance's WP-0025 review found the first adapter fail-open: --contract
was optional, receipt_id was not canonical, and target, identities,
resources, UIDs, broker digest and times were unbound. Require the
contract and refuse any receipt that is not the platform canonical form.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Implement src/whitehat_security/platform_custody.py and focused tests
against the four custody schemas. Live admission still fails closed
without a value-safe projection receipt. No new engagement or traffic.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Meantime polish while live E2 waits on a new trial. Example receipts carry
handles only. admit-plane --receipt is tested. Aborts can be queued without
being target assurance.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
WH-ENG-20260822-AUDIT-E2-02 projected and then aborted: admit-plane had no
receipt adapter, so the runner sent zero packets. Consume custody receipts
as handles only, keep unconnected admission fail-closed, and retire -02.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
The retry record is distinct from the expired -01 identifiers and is only
authorized inside 19:15Z-19:30Z.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
The 18:00Z-18:15Z window ended with no projection-ready notice and zero
packets. Mark the identifier terminal. Record platform-pg E3 as not
applicable for an ordinary runtime conformance-view identity.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Record the owner-acknowledged window, pin the runner invocation including
the forged fixture id, and ask railiance-platform to project identities
only at window start. No mint, no pod apply, no packets.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Align plane ordering with Mason's apply, record the fresh audit-core
engagement as proposed, and keep offline admission fail-closed until
operator approval and owner acknowledgement exist.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Updated by fix-consistency on 2026-08-22:
- update .custodian-brief.md for whitehat-security
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Updated by fix-consistency on 2026-08-22:
- update .custodian-brief.md for whitehat-security
Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
Operator decision: whitehat is a NetKingdom facility, framed offensively -
offence is how you find out, and a control is believed until someone tries it.
Our own estate is one target among those we choose, not the only one.
I had argued for the-custodian on independence grounds. The counter-argument is
better: offensive security is security work and belongs with the security repo.
The residual tension is real and recorded rather than argued away - NetKingdom
now owns both the Tenancy Posture framework and the facility that tests
conformance to it, which is NetKingdom assessing NetKingdom. The mitigation is
that findings leave for risk-nexus under separate ownership rather than being
resolved in place. Proportionate, not perfect, and worth revisiting if
conformance findings start getting quietly closed.
The reframe changes what this repo must guard against, and that is the
substantial part of this commit. A facility that can be pointed at
infrastructure we do not own is the single thing that could turn this repo from
an asset into a liability, so the targeting rule is structural rather than
cultural.
No target without recorded authorization from whoever is responsible for it.
Own estate in build mode has standing authorization; production needs its own,
because the blast radius differs and so does the decision; anything we do not
own needs written per-engagement authorization recorded here before a packet is
sent.
Three non-authorizations written down because each is a way teams talk
themselves into it: a commercial relationship with the target, the target being
publicly reachable, and believing the owner would obviously be fine with it.
Unauthorized probing is criminal in most jurisdictions regardless of intent,
and a white-hat facility that gets this wrong is an attacker with better
paperwork.
Two consequences. The authorization record is part of the finding - a report
that cannot name what it ran under is not a finding, it is an incident. And
scope creep during an engagement is prohibited: a probe that discovers an
adjacent system stops at the boundary, because following the interesting thing
is how an authorized test becomes an unauthorized one.
Findings routing now forks. Our estate goes to risk-nexus and on to the owning
repo. Any other target goes to that infrastructure's responsible party on the
engagement's agreed terms, with risk-nexus still recording that it happened.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
