tegwick
eebcc39a12
WHITEHAT-WP-0012 records that identity and authorization evidence belongs in the declaring service's CI, and adds an in-process V2/V3/V4 observation judge that injects no failure. Live E4, R4, and V stay wait on an unnamed owner or operator, so the plan is blocked. No packet is authorized. Assistant: grok Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
27 lines
1.4 KiB
Markdown
27 lines
1.4 KiB
Markdown
# Evidence
|
|
|
|
This directory stores sanitized run artifacts. `offline-calibration.json`,
|
|
`offline-e3-calibration.json`, `offline-e4-calibration.json`,
|
|
`offline-r4-calibration.json`, `offline-v-calibration.json`,
|
|
`offline-capacity-calibration.json`, and
|
|
`offline-asm-t01-calibration.json` … `offline-asm-t10-calibration.json` are
|
|
generated from repository-created fixtures and prove only that the harness
|
|
distinguishes known-good from known-bad behavior. They are not target
|
|
assurance. `probe-cadence.json` is the unscheduled cadence register. `WH-ENG-20260822-AUDIT-E2-02-abort.json`
|
|
is an abort record (`evidence_class: abort`), not an E2 pass or finding.
|
|
`WH-ENG-20260822-AUDIT-E2-03.json` is the first authorized target pass; SHA-256
|
|
`2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593`. A pass
|
|
means only that the attempted attacks did not work.
|
|
|
|
Before committing target evidence, verify that it contains no response body,
|
|
credential, database URL, real tenant identifier, or real tenant value. A
|
|
run-local digest is allowed; it must not be reusable across runs as a data
|
|
oracle.
|
|
|
|
`2026-10-03-emergent-021-offline-review.json`,
|
|
`2026-10-03-emergent-023-offline-retest.json`,
|
|
`2026-10-04-emergent-026-library-probes.json`, and
|
|
`2026-10-04-emergent-026-corpus-disposition.json` are offline knowledge-release
|
|
reviews. They are not `evidence_class: target` and they are not queued as
|
|
target assurance.
|
|
|