tegwick b7306ddc7e Record the rapp-postgres file grant that still leaves live E3 blocked.

Commit 8d4106f grants SELECT to isolation_probe_app and leaves that role NOLOGIN. platform-pg stays not_applicable until a promotion, a broker LOGIN receipt, and a complete engagement exist. No connection was opened.

Assistant: grok
Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173

2026-10-04 12:09:58 +02:00

5.7 KiB

Raw Blame History

Guessed inputs for the blocked live residuals — 2026-10-04

Status: proposed; sends no traffic

These are educated guesses for the inputs named by WHITEHAT-WP-0006, WHITEHAT-WP-0008, and WHITEHAT-WP-0012. A guess is not operator approval, target-owner acknowledgement, or an engagement id. Engagement.load is not pointed at this file. No packet, database connection, load, or failure injection is authorized.

Evidenced means an owner-repo file says it. Guessed means the closest candidate, and the candidate still fails the task's bar where the table says so. Unknown means no number was written down, and none was invented.

WHITEHAT-WP-0006-T01 — live E3

The morning read of rapp-postgres 11c1d489 found the explicit grant on the migration role only. Reply 69cc7304-e366-47a3-b2f1-f00fc9abf09e then reported commit 8d4106f. That commit is still present at 0374403: the renderer grants SELECT to both isolation_probe_migrate and isolation_probe_app, and the runtime role stays NOLOGIN, NOBYPASSRLS, and NOSUPERUSER. The owner says this is file-only. platform-pg stays not_applicable until an authorized promotion and an ordinary runtime LOGIN receipt exist.

Field	Value	Mark
Database	`isolation_probe` on `platform-pg`	evidenced
Schema and view	`isolation_probe.rls_conformance`	evidenced
Runtime role	`isolation_probe_app`, `NOLOGIN`, `NOBYPASSRLS`, `NOSUPERUSER`	evidenced
File grant	`SELECT` to migration and runtime	evidenced at `8d4106f`
Deployed LOGIN receipt	none	evidenced absence
Statement timeout	`2s`	evidenced
Namespace	`databases`	evidenced
Live workload has enabled the template	no	evidenced

A connectable identity would still be a short-lived LOGIN INHERIT member of isolation_probe_app, confirmed by the railiance-platform broker. RAPP-POSTGRES-WP-0007 T02 stays wait for this repository's complete engagement. This file does not create that engagement.

WHITEHAT-WP-0006-T02 — live P1/P2

No file is an approved substrate window. the-custodian already said it would not draft one. Probe allowance, aggressor consumer, headroom threshold, and abort numbers are unknown. They are not filled in here.

Evidenced bounds a future window would have to stay inside, from rapp-postgres ADR-0004, are a 14-connection quota per consumer and an enforced cell of four consumers on platform-pg. Those are admission estimates. They are not a probe allowance and they do not name an aggressor. The fixture ceiling 10 in the offline capacity calibration is not a live allowance.

WHITEHAT-WP-0006-T03 — remaining E2

Read from access-engine 257a83e9. No checked-in subject is tenant A with no tenant-B authority. The closest fixture, cross-tenant-deny in examples/user-engine/policy_fixtures.yaml, does not qualify: subject admin carries tenant-admin and is denied because the request tenant differs, not because the identity has no tenant-B grant. It is not the engagement identity.

Field	Value	Mark
Decision route	`POST /v1/check`	evidenced
Audience	`flex-auth`	evidenced
Caller binding name	`user-engine`	evidenced, not a secret
Service DNS	`flex-auth-user-engine.flex-auth.svc.cluster.local:8080`	guessed for the subject-tenant pin only
Tenant-A identity	none	evidenced absence

audit-core 28b567e is a consistency sync after 1149273. It does not mint a new engagement id. WH-ENG-20260822-AUDIT-E2-01, -02, and -03 stay terminal.

WHITEHAT-WP-0008-T01 — one live ASM test

The guessed first test is T-06. The other nine Canon tests have no named component revision and non-secret identity class together. This guess does not admit them, and it does not admit T-06.

Field	Value	Mark
Component	`approval-engine`	evidenced
Deployed image	`sha256:251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49`	evidenced in `deploy/approval-engine.yaml`
Source of that image	`be1a388a848cf59e9ff3a5420f88a70ca0a52e7e`	evidenced
Checkout HEAD	`1044a5f36d3d9dc9ca031e48f486fd0f122c5cf5`	evidenced, and it is not the deployed image
Routes	`GET /v1/approvals/{id}/claim`, `POST /v1/approvals/{id}/consume`	evidenced
Identity class	`principal_type=service`, client name `secrets-engine-approval`, audience `approval-engine`	evidenced as a registration class, not a leased credential
Fixture technique	`asm-assurance`	evidenced
Consuming PEP	absent	evidenced. `APPROVAL-WP-0002-T05` stays wait. `secrets-engine` `approval_consume.py` remains the in-process module, not the live surface

Window, abort contact, and engagement id are unknown. They are not invented.

WHITEHAT-WP-0012-T03 — live E4

No tenancy.yaml declares current E: 4. apps-pg remains E4-unreachable: shared credential, current E: 0. The closest named P3-shaped application is vergabe-teilnahme, and it does not qualify. Its pilot still uses a shared apps-pg database and role. It is not registered as an E4 target.

WHITEHAT-WP-0012-T04 — live R4

No service has a complete copy inventory. audit-core stays R2 and is not the owner. The closest incomplete text is rapp-postgres ADR-0002: one WAL stream, one base backup, and an erasure horizon. It does not list derived copies and it does not name an R4 route. It is not an R4 inventory.

WHITEHAT-WP-0012-T05 — live V2, V3, or V4

No tenancy.yaml declares V above 1. audit-core documents V1 for the operation "accept an audit event" and says V2 is not reachable while platform-pg has one instance. A restart is not V2. No failure domain, RTO, or RPO is guessed, and no instance is a candidate for termination.

5.7 KiB Raw Blame History