85 lines
2.8 KiB
Markdown
85 lines
2.8 KiB
Markdown
---
|
|
id: WHITEHAT-WP-0011
|
|
type: workplan
|
|
title: "State actual scope and calibrate the missing E4 and R4 probes"
|
|
domain: infotech
|
|
repo: whitehat-security
|
|
status: finished
|
|
owner: whitehat-security
|
|
topic_slug: whitehat-security
|
|
created: "2026-10-04"
|
|
updated: "2026-10-04"
|
|
related:
|
|
- WHITEHAT-WP-0006
|
|
- WHITEHAT-WP-0008
|
|
state_hub_workstream_id: "e1122905-23db-52be-adba-2ef1b7e20904"
|
|
---
|
|
|
|
# State actual scope and calibrate the missing E4 and R4 probes
|
|
|
|
`INTENT.md` owns E2, E3, E4, P1/P2, and R4 evidence, plus the cadence that
|
|
sets the exposure window. On 2026-10-04 the repository could calibrate E2,
|
|
E3, P1/P2, and ASM offline, and it had prose for E4 and R4 with no probe.
|
|
`SCOPE.md` described those prose items as capabilities. This plan records
|
|
the comparison, makes the scope match the harness, and adds the two missing
|
|
offline calibrations. It does not reopen `WHITEHAT-WP-0006` or
|
|
`WHITEHAT-WP-0008`. It authorizes no packet, database connection, or load.
|
|
|
|
The live gaps remain the ones those blocked plans already name. They are
|
|
not implementable here until the owner returns change.
|
|
|
|
## T01 — Record scope against intent
|
|
|
|
```task
|
|
id: WHITEHAT-WP-0011-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "ba68f3c7-c3c4-5e1a-ba55-3b8713f7d7e5"
|
|
```
|
|
|
|
`history/2026-10-04T0649Z-scope-against-intent.md` compares each owned intent
|
|
item with the runnable surface. `SCOPE.md` now lists what the commands do
|
|
and what they refuse. The README no longer says the facility attacks systems
|
|
on a schedule.
|
|
|
|
## T02 — Calibrate E4 offline
|
|
|
|
```task
|
|
id: WHITEHAT-WP-0011-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "0fedb314-5e97-5083-a290-246cb5bdf34b"
|
|
```
|
|
|
|
`whitehat e4-fixtures` fails known-bad confinement cases before it trusts a
|
|
known-good pass. Reachability alone stays a pass. A credential refresh
|
|
outside recorded authority aborts. `targets/fixture-e4.json` is applicable
|
|
only as `fixture-e4` and projects no credential. The plane rejects that
|
|
class in a live environment. No live E4 class exists.
|
|
|
|
## T03 — Calibrate R4 offline
|
|
|
|
```task
|
|
id: WHITEHAT-WP-0011-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "9f3b1e15-5338-5c50-bca1-cb40df478f4f"
|
|
```
|
|
|
|
`whitehat r4-fixtures` fails recovered content, readable ciphertext, a
|
|
surviving usable key, and a low-entropy oracle before it trusts a clear
|
|
result. An incomplete copy inventory stays inconclusive. `targets/fixture-r4.json`
|
|
projects no key. `audit-core` is not registered as an R4 target.
|
|
|
|
## T04 — Publish the unscheduled cadence register
|
|
|
|
```task
|
|
id: WHITEHAT-WP-0011-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "9ce7d29b-1137-5b3b-b5aa-f68f7033e7d9"
|
|
```
|
|
|
|
`whitehat cadence` states E2, E3, E4, P1/P2, R4, and ASM T-01…T-10. E3 keeps
|
|
its declared 24h detection window. Every family has `scheduled: false`, and
|
|
`scheduled_live_runs` is false. The register does not start a run.
|