coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/docs/target-applicability.md
tegwick 95129d7a35 Add governed test plane and close T04/T08 
Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-22 00:44:21 +02:00

2.4 KiB
Raw Permalink Blame History

Target applicability for WHITEHAT-WP-0001

Status: encoded in targets/, 2026-08-22

The E2 attacker model requires an authenticated identity that is legitimately authorized for tenant A and not tenant B. A target name alone is insufficient; the target must expose a boundary where that identity exists. Machine-readable records live in targets/. The test plane will not admit a not_applicable or pending target.

audit-core — applicable

audit-core binds each sender token to allowed sources, tenant set, read and write capabilities at one application choke point. Two distinct ordinary sender identities scoped one per fixture tenant instantiate the model without operator or database privilege. Its event-id, correlation and append routes therefore form a valid E2 differential.

The target owner reviewed the route and identity design on 2026-08-21. Formal acknowledgement and value-safe provisioning remain required by WH-ENG-20260821-AUDIT-E2; no target traffic is permitted while its target_owner_acknowledged_at is empty.

tenant-engine — E2 applicability not established

The original workplan named tenant-engine because its declaration said an E2 mechanism was implemented. Cold review of the actual contract shows that this does not supply the attacker identity T03 assumes:

  • tenancy.yaml declares current E1/A0, not E2, and says inbound actor/tenant values are not verified.
  • The flex-auth policy registers the platform-wide tenant-engine service subject for administrative actions. It is not a tenant-A subject and is deliberately allowed to address tenant B.
  • Tenant registry enumeration is the service's function and is an explicit placement exception. Cross-tenant access by its authorized platform operator is not a tenant-boundary failure.
  • Substituting an unregistered actor would test caller authorization (A), not E2. Substituting the all-tenant service actor would give the modeled attacker authority it is supposed not to hold.

Therefore no production packet is sent under WH-ENG-20260821-TENANT-E2 until the target owner names a real authenticated tenant-A identity with no tenant-B authority. If none exists, the honest artifact is not applicable, and the workplan acceptance must stop naming tenant-engine as though it claimed an exercisable E2 boundary. Its existing A/I gaps remain target-owned; whitehat must not relabel them to make this plan finish.