# whitehat-security

NetKingdom's offensive security facility. Automated white hat IT-security,
pen-testing and isolation-probing — pointed at infrastructure we choose,
including our own.

The estate's **adversarial evidence facility**: it attacks our own systems, on
a schedule, to find out whether the security properties they claim are actually
true.

It exists because a repo testing its own boundary grades its own homework. The
probes most worth having are the ones an author would not think to write.

- **Independent in operation.** It does not take a declared posture as true.
  NetKingdom owns both the security canon and this facility, so findings leave
  through `risk-nexus` under separate ownership rather than being resolved here.
- **It finds; it does not fix.** Findings route to `risk-nexus`, which owns
  severity and disclosure. The repo that owns the defect owns the repair.
- **A pass means the attacks we tried did not work** — not that the boundary
  holds. Reports say so.

- Intent: [`INTENT.md`](INTENT.md)
- Scope: [`SCOPE.md`](SCOPE.md)
- Workplans: [`workplans/`](workplans/)
- Attacker model: [`docs/attacker-model.md`](docs/attacker-model.md)
- Rules of engagement (accepted; live targets still require engagement approval):
  [`docs/rules-of-engagement.md`](docs/rules-of-engagement.md)
- Operator runbook: [`docs/operator-runbook.md`](docs/operator-runbook.md)
- Target packs: [`probe-packs/`](probe-packs/)

## Offline calibration

```sh
make check
make fixture-evidence
```

This proves that every current differential probe passes an enforcing fixture
and detects the corresponding missing-tenant-predicate fixture. It sends no
network traffic and is not evidence about a target service. Live execution
requires a current target-specific record based on
[`engagements/template.json`](engagements/template.json).