tegwick
0d62d8107b
The owner workers confirmed the missing identity, substrate window, engagement, and T-06 surface. Emergent accepted only the bounded 0.2.6 review gate, and risk-nexus left RISK-F-0015 open. Assistant: grok Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
126 lines
6 KiB
Markdown
126 lines
6 KiB
Markdown
# Scope
|
||
|
||
## One-liner
|
||
|
||
`whitehat-security` is NetKingdom's authorization-bound offensive-security
|
||
tooling for producing adversarial evidence about security claims.
|
||
|
||
## Core idea
|
||
|
||
The repository turns stated security properties into dated, reproducible attack
|
||
attempts. It remains separate from the systems it tests, reports findings
|
||
without grading their severity, and never treats a passing probe as proof that a
|
||
boundary always holds.
|
||
|
||
## In scope
|
||
|
||
- Attacker models for tenant isolation, credential confinement, noisy-neighbour
|
||
behavior and erasure verification.
|
||
- Differential probes that compare behavior across controlled tenant contexts.
|
||
- Known-bad and known-good fixtures that demonstrate every probe can fail.
|
||
- Rules of engagement, target authorization, engagement records, abort
|
||
controls and evidence minimization.
|
||
- Probe cadence and the resulting assurance/exposure window.
|
||
- Delivery of findings and passing-run evidence to `risk-nexus`.
|
||
|
||
## Out of scope
|
||
|
||
- Fixing defects in target repositories.
|
||
- Assigning severity, disclosure policy or remediation deadlines.
|
||
- Replacing mechanical checks owned by a target repository's CI.
|
||
- Defining the estate's security model or publishing permanent policy.
|
||
- Probing any target without the authorization and engagement records required
|
||
by [the rules of engagement](docs/rules-of-engagement.md).
|
||
- Blocking build-mode delivery without a separately recorded decision.
|
||
|
||
## Safety invariants
|
||
|
||
- The rules of engagement are accepted, but their acceptance authorizes no live
|
||
target. Without a complete approved engagement record, only documentation
|
||
and non-networked fixture design may proceed.
|
||
- No live target is authorized by this scope document.
|
||
- Every live run names its authorization, target, owner, window, technique,
|
||
credential lane, rate ceiling, abort contact and finding destination.
|
||
- A probe stops at the recorded boundary and never follows an adjacent system.
|
||
- Evidence records response shape and counts, never real tenant row values or
|
||
credentials.
|
||
- Findings leave this repository; repairs do not enter it.
|
||
|
||
## Relevant when
|
||
|
||
- A service claims a Tenancy Posture evidence level that requires adversarial
|
||
rather than mechanical evidence.
|
||
- A boundary must be tested using a leaked runtime credential or hostile tenant
|
||
context.
|
||
- The estate needs to know when a probe last ran, what attacker it modeled, and
|
||
whether it was proven against a known-bad fixture.
|
||
|
||
## Not relevant when
|
||
|
||
- A repository needs unit, schema or provisioning tests for its own code.
|
||
- A finding needs triage, severity or disclosure handling; use `risk-nexus`.
|
||
- Permanent policy needs publication; use `policy-nexus`.
|
||
- The desired activity falls outside an approved engagement boundary.
|
||
|
||
## Current state
|
||
|
||
- Repository status: active.
|
||
- Layer: Staff (declared in `INTENT.md`, 2026-09-01). `WHITEHAT-IN-0001` is
|
||
closed.
|
||
- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005` and
|
||
`WHITEHAT-WP-0007`. Residual live Tenancy Posture evidence is
|
||
`WHITEHAT-WP-0006`. Residual live ASM is `WHITEHAT-WP-0008`. Both stay
|
||
`blocked` after the 2026-10-04 recheck and the owner returns the same day.
|
||
T01 still waits on `rapp-postgres` for an ordinary runtime identity. T02
|
||
still waits on an operator substrate window. T03 still waits on
|
||
`access-engine` or a new `audit-core` engagement ID. Live ASM still waits
|
||
on a surface owner, with T-06 on `approval-engine` and a consuming PEP.
|
||
No packet is authorized.
|
||
- `WHITEHAT-WP-0007` triaged Gate House ASM T-01…T-10. Live `asm-tNN`
|
||
registrations remain `pending`. In-process `fixture-asm-t01`…`t10`
|
||
calibrations exist. That work authorized no live probe.
|
||
- `WHITEHAT-WP-0001` T01–T08 are complete for every applicable target.
|
||
`audit-core` has dated E2 pass `WH-ENG-20260822-AUDIT-E2-03`.
|
||
`tenant-engine` E2 and `platform-pg` E3 stay `not_applicable`. `flex-auth`
|
||
E2 and `shared-substrate` P1/P2 stay `pending`. Offline E2, E3 and P1/P2
|
||
harnesses fail known-bad and pass known-good in-process.
|
||
- `-01`, `-02` and `-03` are terminal. A later live run needs a new
|
||
engagement ID, plane admission, and the approvals required by the rules of
|
||
engagement. `WHITEHAT-WP-0006` owns that work and authorizes no packet.
|
||
- `WHITEHAT-WP-0009` is finished. The 0.2.1 record shows WH-KNOW-001 and
|
||
WH-KNOW-002. A local 0.2.3 retest did not reproduce them. `risk-nexus`
|
||
holds open RISK-F-0013, RISK-F-0014 and RISK-F-0015. `emergent-security`
|
||
commit `19e7feb` accepts the scoped review and the two library
|
||
remediations, and leaves provider evidence and the `informed-decision`
|
||
pin reconciliation in blocked EMERGENT-WP-0002. This plan authorizes no
|
||
packet.
|
||
- `WHITEHAT-WP-0010` is finished. It dispositions sealed knowledge 0.2.6,
|
||
digest `8d1d6a9d`, commit `f65d0e64`, from offline probes and the recorded
|
||
28-case corpus. It finds no unsafe effect and both named RISK-F-0015
|
||
routes on the fixture tokens. It does not close that finding, accept
|
||
EMERGENT-WP-0002-T07, or re-pin `informed-decision`. On 2026-10-04
|
||
`emergent-security` commit `9f4530b` accepted only that bounded review
|
||
gate, and `risk-nexus` commit `e1f006b` recorded the observation.
|
||
RISK-F-0015 stays open. It authorizes no packet.
|
||
|
||
## Relationships
|
||
|
||
- Owner and security canon: `net-kingdom`.
|
||
- Finding intake, severity and disclosure: `risk-nexus`.
|
||
- Permanent publication: `policy-nexus`.
|
||
- Initial proposed target owners: `tenant-engine`, `audit-core` and
|
||
`flex-auth`.
|
||
|
||
## Getting oriented
|
||
|
||
1. Read [`INTENT.md`](INTENT.md) for the durable purpose and ownership model.
|
||
2. Read [the rules of engagement](docs/rules-of-engagement.md) before any probe
|
||
design or execution.
|
||
3. Read [`WHITEHAT-WP-0001`](workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md)
|
||
for the finished applicable-target artifacts,
|
||
[`WHITEHAT-WP-0006`](workplans/WHITEHAT-WP-0006-authorized-live-residuals.md)
|
||
for unauthorized live Tenancy Posture residuals, and
|
||
[`WHITEHAT-WP-0007`](workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md)
|
||
for finished ASM T-01…T-10 triage, and
|
||
[`WHITEHAT-WP-0008`](workplans/WHITEHAT-WP-0008-live-asm-residuals.md)
|
||
for unauthorized live ASM residuals.
|