tegwick
5384f051d2
Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto E2, E3, or capacity. Register all ten Canon tests as pending with named blockers, known-bad designs, and result routes. Add a value-safe conformance-message renderer. Authorizes no probe. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
88 lines
3.4 KiB
Python
88 lines
3.4 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
from .engagement import AuthorizationError
|
|
from .model import RunReport
|
|
|
|
|
|
def write_report(report: RunReport, output: str | Path) -> None:
|
|
path = Path(output)
|
|
path.parent.mkdir(parents=True, exist_ok=True)
|
|
path.write_text(json.dumps(report.as_dict(), indent=2, sort_keys=True) + "\n", encoding="utf-8")
|
|
|
|
|
|
def risk_nexus_message(report: RunReport) -> str:
|
|
lines = [
|
|
f"Whitehat run `{report.run_id}`: **{report.outcome}**",
|
|
"",
|
|
f"- evidence class: `{report.evidence_class}`",
|
|
f"- target: `{report.target}` at `{report.target_revision}`",
|
|
f"- posture/model: `{report.posture_claim}` / `{report.attacker_model}`",
|
|
f"- engagement/authorization: `{report.engagement_id}` / `{report.authorization_id}`",
|
|
f"- attempted operations: {report.attempted_operations}",
|
|
f"- interval: {report.started_at} to {report.ended_at}",
|
|
"",
|
|
report.assurance_statement,
|
|
]
|
|
if report.outcome == "finding":
|
|
lines.extend(["", "Reporter supplies facts only; risk-nexus owns severity and disclosure."])
|
|
if report.evidence_class == "abort":
|
|
lines.extend(["", "This is an abort record, not target assurance."])
|
|
return "\n".join(lines) + "\n"
|
|
|
|
|
|
def conformance_message(
|
|
report: RunReport,
|
|
*,
|
|
specification: str,
|
|
test_id: str,
|
|
component: str | None = None,
|
|
invariant_ids: list[str] | None = None,
|
|
) -> str:
|
|
"""Render a value-safe Gate House conformance envelope. Does not send it."""
|
|
target = component or report.target
|
|
subject = (
|
|
f"[GH-CONFORMANCE] {test_id} {report.outcome} "
|
|
f"{target}@{report.target_revision}"
|
|
)
|
|
lines = [
|
|
f"Subject: {subject}",
|
|
"",
|
|
f"- specification: `{specification}` test `{test_id}`",
|
|
f"- report/run: `{report.run_id}`",
|
|
f"- engagement/authorization: `{report.engagement_id}` / `{report.authorization_id}`",
|
|
f"- target: `{target}` at `{report.target_revision}`",
|
|
f"- environment/class: `{report.evidence_class}`",
|
|
f"- outcome: `{report.outcome}`",
|
|
f"- attempted operations: {report.attempted_operations}",
|
|
f"- interval: {report.started_at} to {report.ended_at}",
|
|
]
|
|
if invariant_ids:
|
|
lines.append("- invariants: " + ", ".join(f"`{item}`" for item in invariant_ids))
|
|
lines.extend([
|
|
"",
|
|
report.assurance_statement,
|
|
"",
|
|
"Implementation findings route to risk-nexus. This envelope is the "
|
|
"doctrine-return copy only. It contains no credential, response body, "
|
|
"or severity.",
|
|
])
|
|
if report.evidence_class == "fixture":
|
|
lines.extend(["", "Fixture calibration is not target assurance."])
|
|
return "\n".join(lines) + "\n"
|
|
|
|
|
|
def queue_risk_nexus(report: RunReport, outbox: str | Path) -> Path:
|
|
"""Persist a delivery artifact. Fixture calibration is not target assurance."""
|
|
if report.evidence_class == "fixture":
|
|
raise AuthorizationError("fixture evidence is not delivered as target assurance")
|
|
if report.evidence_class not in {"target", "abort"}:
|
|
raise AuthorizationError("unsupported evidence class for delivery")
|
|
directory = Path(outbox)
|
|
directory.mkdir(parents=True, exist_ok=True)
|
|
path = directory / f"{report.run_id}.md"
|
|
path.write_text(risk_nexus_message(report), encoding="utf-8")
|
|
return path
|
|
|