whitehat-security/workplans/WHITEHAT-WP-0011-scope-capability-gaps.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
WHITEHAT-WP-0011	workplan	State actual scope and calibrate the missing E4 and R4 probes	infotech	whitehat-security	finished	whitehat-security	whitehat-security	2026-10-04	2026-10-04	WHITEHAT-WP-0006 WHITEHAT-WP-0008	e1122905-23db-52be-adba-2ef1b7e20904

State actual scope and calibrate the missing E4 and R4 probes

INTENT.md owns E2, E3, E4, P1/P2, and R4 evidence, plus the cadence that sets the exposure window. On 2026-10-04 the repository could calibrate E2, E3, P1/P2, and ASM offline, and it had prose for E4 and R4 with no probe. SCOPE.md described those prose items as capabilities. This plan records the comparison, makes the scope match the harness, and adds the two missing offline calibrations. It does not reopen WHITEHAT-WP-0006 or WHITEHAT-WP-0008. It authorizes no packet, database connection, or load.

The live gaps remain the ones those blocked plans already name. They are not implementable here until the owner returns change.

T01 — Record scope against intent

id: WHITEHAT-WP-0011-T01
status: done
priority: high
state_hub_task_id: "ba68f3c7-c3c4-5e1a-ba55-3b8713f7d7e5"

history/2026-10-04T0649Z-scope-against-intent.md compares each owned intent item with the runnable surface. SCOPE.md now lists what the commands do and what they refuse. The README no longer says the facility attacks systems on a schedule.

T02 — Calibrate E4 offline

id: WHITEHAT-WP-0011-T02
status: done
priority: high
state_hub_task_id: "0fedb314-5e97-5083-a290-246cb5bdf34b"

whitehat e4-fixtures fails known-bad confinement cases before it trusts a known-good pass. Reachability alone stays a pass. A credential refresh outside recorded authority aborts. targets/fixture-e4.json is applicable only as fixture-e4 and projects no credential. The plane rejects that class in a live environment. No live E4 class exists.

T03 — Calibrate R4 offline

id: WHITEHAT-WP-0011-T03
status: done
priority: high
state_hub_task_id: "9f3b1e15-5338-5c50-bca1-cb40df478f4f"

whitehat r4-fixtures fails recovered content, readable ciphertext, a surviving usable key, and a low-entropy oracle before it trusts a clear result. An incomplete copy inventory stays inconclusive. targets/fixture-r4.json projects no key. audit-core is not registered as an R4 target.

T04 — Publish the unscheduled cadence register

id: WHITEHAT-WP-0011-T04
status: done
priority: medium
state_hub_task_id: "9ce7d29b-1137-5b3b-b5aa-f68f7033e7d9"

whitehat cadence states E2, E3, E4, P1/P2, R4, and ASM T-01…T-10. E3 keeps its declared 24h detection window. Every family has scheduled: false, and scheduled_live_runs is false. The register does not start a run.