tegwick
5384f051d2
Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto E2, E3, or capacity. Register all ten Canon tests as pending with named blockers, known-bad designs, and result routes. Add a value-safe conformance-message renderer. Authorizes no probe. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
102 lines
4.5 KiB
Markdown
102 lines
4.5 KiB
Markdown
# Scope
|
||
|
||
## One-liner
|
||
|
||
`whitehat-security` is NetKingdom's authorization-bound offensive-security
|
||
tooling for producing adversarial evidence about security claims.
|
||
|
||
## Core idea
|
||
|
||
The repository turns stated security properties into dated, reproducible attack
|
||
attempts. It remains separate from the systems it tests, reports findings
|
||
without grading their severity, and never treats a passing probe as proof that a
|
||
boundary always holds.
|
||
|
||
## In scope
|
||
|
||
- Attacker models for tenant isolation, credential confinement, noisy-neighbour
|
||
behavior and erasure verification.
|
||
- Differential probes that compare behavior across controlled tenant contexts.
|
||
- Known-bad and known-good fixtures that demonstrate every probe can fail.
|
||
- Rules of engagement, target authorization, engagement records, abort
|
||
controls and evidence minimization.
|
||
- Probe cadence and the resulting assurance/exposure window.
|
||
- Delivery of findings and passing-run evidence to `risk-nexus`.
|
||
|
||
## Out of scope
|
||
|
||
- Fixing defects in target repositories.
|
||
- Assigning severity, disclosure policy or remediation deadlines.
|
||
- Replacing mechanical checks owned by a target repository's CI.
|
||
- Defining the estate's security model or publishing permanent policy.
|
||
- Probing any target without the authorization and engagement records required
|
||
by [the rules of engagement](docs/rules-of-engagement.md).
|
||
- Blocking build-mode delivery without a separately recorded decision.
|
||
|
||
## Safety invariants
|
||
|
||
- The rules of engagement are accepted, but their acceptance authorizes no live
|
||
target. Without a complete approved engagement record, only documentation
|
||
and non-networked fixture design may proceed.
|
||
- No live target is authorized by this scope document.
|
||
- Every live run names its authorization, target, owner, window, technique,
|
||
credential lane, rate ceiling, abort contact and finding destination.
|
||
- A probe stops at the recorded boundary and never follows an adjacent system.
|
||
- Evidence records response shape and counts, never real tenant row values or
|
||
credentials.
|
||
- Findings leave this repository; repairs do not enter it.
|
||
|
||
## Relevant when
|
||
|
||
- A service claims a Tenancy Posture evidence level that requires adversarial
|
||
rather than mechanical evidence.
|
||
- A boundary must be tested using a leaked runtime credential or hostile tenant
|
||
context.
|
||
- The estate needs to know when a probe last ran, what attacker it modeled, and
|
||
whether it was proven against a known-bad fixture.
|
||
|
||
## Not relevant when
|
||
|
||
- A repository needs unit, schema or provisioning tests for its own code.
|
||
- A finding needs triage, severity or disclosure handling; use `risk-nexus`.
|
||
- Permanent policy needs publication; use `policy-nexus`.
|
||
- The desired activity falls outside an approved engagement boundary.
|
||
|
||
## Current state
|
||
|
||
- Repository status: active.
|
||
- Layer: Staff (declared in `INTENT.md`, 2026-09-01). `WHITEHAT-IN-0001` is
|
||
closed.
|
||
- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005`. Residual live
|
||
Tenancy Posture evidence is owned by `WHITEHAT-WP-0006` and is blocked on
|
||
authorization.
|
||
- Active: `WHITEHAT-WP-0007` triages Gate House ASM T-01…T-10. All ten
|
||
registrations are `pending`. That work authorizes no probe.
|
||
- `WHITEHAT-WP-0001` T01–T08 are complete for every applicable target.
|
||
`audit-core` has dated E2 pass `WH-ENG-20260822-AUDIT-E2-03`.
|
||
`tenant-engine` E2 and `platform-pg` E3 stay `not_applicable`. `flex-auth`
|
||
E2 and `shared-substrate` P1/P2 stay `pending`. Offline E2, E3 and P1/P2
|
||
harnesses fail known-bad and pass known-good in-process.
|
||
- `-01`, `-02` and `-03` are terminal. A later live run needs a new
|
||
engagement ID, plane admission, and the approvals required by the rules of
|
||
engagement. `WHITEHAT-WP-0006` owns that work and authorizes no packet.
|
||
|
||
## Relationships
|
||
|
||
- Owner and security canon: `net-kingdom`.
|
||
- Finding intake, severity and disclosure: `risk-nexus`.
|
||
- Permanent publication: `policy-nexus`.
|
||
- Initial proposed target owners: `tenant-engine`, `audit-core` and
|
||
`flex-auth`.
|
||
|
||
## Getting oriented
|
||
|
||
1. Read [`INTENT.md`](INTENT.md) for the durable purpose and ownership model.
|
||
2. Read [the rules of engagement](docs/rules-of-engagement.md) before any probe
|
||
design or execution.
|
||
3. Read [`WHITEHAT-WP-0001`](workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md)
|
||
for the finished applicable-target artifacts,
|
||
[`WHITEHAT-WP-0006`](workplans/WHITEHAT-WP-0006-authorized-live-residuals.md)
|
||
for unauthorized live Tenancy Posture residuals, and
|
||
[`WHITEHAT-WP-0007`](workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md)
|
||
for ASM T-01…T-10 triage.
|