# WH-ENG-20260822-AUDIT-E2-01 — invocation (no secrets)

Do not apply the runner pod and do not mint credentials until the custody
owner projects two mount-only tokens at window start. Minting now would
exhaust the 900-second TTL before `18:00Z`.

Current time-gate: `validate-engagement` and `admit-plane` fail closed with
`engagement window has not started` until `2026-08-22T18:00:00Z`. After the
window opens, `admit-plane` still fails closed while the live custody broker
is unconnected.

## Custody projection (railiance-platform)

Schedule, do not mint early:

| Handle | Binding |
| --- | --- |
| token-a | `source=whitehat-security`, tenant `tenant:trial:whitehat-a-20260822`, `may_read=true`, `may_write=true` |
| token-b | `source=whitehat-security`, tenant `tenant:trial:whitehat-b-20260822`, `may_read=true`, `may_write=true` |

- Secret name `whitehat/whitehat-e2-audit-credentials` (namespace `whitehat`)
- Keys `token-a`, `token-b` only; never the full sender registry
- Issue at `2026-08-22T18:00:00Z`, `expires_at` `2026-08-22T18:15:00Z`, TTL ≤ 900s
- Attended registry reload and cleanup before expiry
- Never return token values to whitehat, State Hub, or chat

## Runner (inside the admitted pod, after projection)

```
python3 - \
  --base-url http://audit-core.audit-core.svc.cluster.local:8080 \
  --engagement-id WH-ENG-20260822-AUDIT-E2-01 \
  --target-revision sha256:c2fe39a0185b99be3fc0cb14d2de69772b8e66e20490097c9d11d90cc39719a6 \
  --token-a-file /var/run/secrets/whitehat/token-a \
  --token-b-file /var/run/secrets/whitehat/token-b \
  --tenant-a tenant:trial:whitehat-a-20260822 \
  --tenant-b tenant:trial:whitehat-b-20260822 \
  --event-a whitehat-e2-event-a-20260822 \
  --event-b whitehat-e2-event-b-20260822 \
  --absent-event whitehat-e2-absent-20260822 \
  --forged-event whitehat-e2-forged-b-20260822 \
  --correlation whitehat-e2-correlation-20260822 \
  --occurred-at 2026-08-22T18:00:00Z \
  --rate 10 --max-requests 30 --abort-p95-ms 500
```

stdin is `runners/audit_core_e2.py`. The forged event argument is mandatory
and must stay inside `fixture_ids`.