coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/plane/README.md
tegwick 3295b715c5 Record the audit-core E2-03 target pass and close T03/T07 
Land the sanitized WH-ENG-20260822-AUDIT-E2-03 report, mark the
engagement completed and terminal, and close the applicable E2 harness
and risk-nexus delivery tasks. flex-auth stays pending; tenant-engine
stays not_applicable.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-23 00:42:31 +02:00

2.1 KiB
Raw Permalink Blame History

Governed test plane

This repository does not apply cluster objects, request credentials, or send packets. ops-mason provisions the foundational plane from these files before a fresh engagement is proposed. Cancelled or expired IDs WH-ENG-20260821-AUDIT-E2, WH-ENG-20260821-TENANT-E2, WH-ENG-20260822-AUDIT-E2-01, WH-ENG-20260822-AUDIT-E2-02, and WH-ENG-20260822-AUDIT-E2-03 are terminal.

Ordering

  1. Foundational plane: Namespace whitehat, default-deny NetworkPolicy, audit-core egress NetworkPolicy, ServiceAccount whitehat-runner with automountServiceAccountToken: false.
  2. A new unretired engagement proposal (status: proposed).
  3. Operator approval, then target-owner acknowledgement.
  4. Custody projection of two short-lived identities into the runner mount.
  5. whitehat admit-plane, then a runner pod. Not before.

ops-mason applied step 1 on 2026-08-22 (evidence c26a6e5, bundle digest 9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035). The namespace had zero Pods and zero Secrets at apply. That apply authorizes no runner, credential, engagement or traffic.

Controls

  1. Namespace whitehat, default-deny networking, explicit target egress.
  2. Immutable runner identity with required engagement labels and no standing service-account token.
  3. Custody broker projects two short-lived tenant-scoped identities into the runner mount and revokes them. Values never enter Git, chat, evidence or State Hub.
  4. Pinned runner image digest on the engagement.
  5. Independently usable kill switch: create plane/KILL or set WHITEHAT_KILL_SWITCH=1. Admission fails closed while it is engaged.
  6. Rate watcher and automatic lease cleanup in whitehat_security.plane.

Standing versus live

fixture-e2, fixture-e3 and fixture-capacity are in-process classes already permitted by the rules of engagement. live-e2 still needs a dated engagement, target-owner acknowledgement, the provisioned plane namespace, a pinned digest and a connected custody broker. Live e3 and capacity keep separate approval classes and extra envelope fields.