coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/docs/test-plane.md
tegwick 461554a749 Record operator approval of WH-ENG-20260822-AUDIT-E2-01 
Owner acknowledgement remains pending. Offline admission stays fail-closed.
No credentials requested and no packets sent.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-22 11:54:09 +02:00

2.3 KiB
Raw Blame History

Governed test plane

This is the missing control from the 2026-08-22 cutoff. It is a fail-closed admission path, not a standing authorization to probe.

What the plane is

A live E2 run is admitted only when every item below is true:

  1. The target is registered in targets/ with applicability: applicable.
  2. Known-bad calibration for that target has already failed in-process.
  3. The engagement is complete, in window, owner-acknowledged, and not a retired ID.
  4. approval_class matches the registration (fixture-e2 / live-e2 / fixture-e3 / e3 / fixture-capacity / capacity).
  5. The runner namespace is whitehat, the image digest is pinned, and engagement labels are present. Live E3 also names a database. Live capacity also names an aggressor_ceiling.
  6. The custody broker projected the registered number of identity handles (two for E2, one runtime for E3, none for capacity fixtures). Credential values are not returned to the operator or agent. Live classes fail closed while the custody broker is unconnected.
  7. The kill switch is clear.
  8. The rate watcher is attached. Cleanup revokes the lease.

If any item is false, whitehat admit-plane exits 2 and no identity is requested.

What the plane is not

  • Not authorization. Rules of engagement §1 still apply.
  • Not a packet. Manifests in plane/ are a contract for ops-mason.
  • Not a secret broker. UnconnectedCustodyBroker is the default for every non-fixture environment and raises before any custody call.
  • Not a way to finish tenant-engine E2. That target is not_applicable.

Operator commands

PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json
PYTHONPATH=src python3 -m whitehat_security.cli kill-switch
PYTHONPATH=src python3 -m whitehat_security.cli deliver evidence/<run>.json --outbox outbox

Create plane/KILL to abort independently of the runner process.

Retired identifiers

WH-ENG-20260821-AUDIT-E2 and WH-ENG-20260821-TENANT-E2 are terminal. The foundational plane is provisioned first. WH-ENG-20260822-AUDIT-E2-01 is operator-approved and awaits target-owner acknowledgement. The live custody broker remains unconnected.