tegwick
a61d7df925
Finished custody-adapter plans were quality-debt-open without a DoD assessment. Index WHITEHAT-IN-0001 as closed. Assistant: grok Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
74 lines
2.4 KiB
Markdown
74 lines
2.4 KiB
Markdown
---
|
||
id: WHITEHAT-WP-0005
|
||
type: workplan
|
||
title: "Require a WP-0025 broker receipt at plane admission"
|
||
domain: infotech
|
||
repo: whitehat-security
|
||
status: finished
|
||
owner: net-kingdom
|
||
topic_slug: whitehat-security
|
||
created: "2026-08-22"
|
||
updated: "2026-09-01"
|
||
related:
|
||
- WHITEHAT-WP-0004
|
||
- RAILIANCE-WP-0025
|
||
state_hub_workstream_id: "d37a91f7-7002-53bc-a23d-d60f91c10a59"
|
||
quality_dod: DoD-Ok
|
||
quality_dod_at: "2026-09-01"
|
||
quality_dod_by: grok
|
||
quality_dod_note: "T01–T02 done; broker receipt required at admit-plane and runner reports bind cleanup. Authorizes no traffic."
|
||
---
|
||
|
||
# WHITEHAT-WP-0005 — broker receipt admission
|
||
|
||
## Goal
|
||
|
||
Close the remaining WP-0025 operational binding from platform review
|
||
`cb6620f` / `5a0eb6b`: a projection receipt must not admit a plane lease
|
||
unless the caller also supplies the broker-readiness receipt whose digest
|
||
equals `broker_receipt_digest`.
|
||
|
||
This plan authorizes no engagement, runner, credential, or traffic.
|
||
|
||
## Origin
|
||
|
||
Platform progress at 2026-08-22T20:26:00Z: `PlatformCustodyBroker` checks
|
||
the broker digest only when optional `broker=` is supplied;
|
||
`broker_from_receipt` / `admit-plane` expose no broker-receipt input. A
|
||
recanonicalized projection receipt with a substituted all-zero broker
|
||
digest was accepted on the operational constructor path.
|
||
|
||
## Tasks
|
||
|
||
### T01 — Required `--broker-receipt` and CLI fail-closed coverage
|
||
|
||
```task
|
||
id: WHITEHAT-WP-0005-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "a6209f8a-b767-5ce8-8842-c9e454977f83"
|
||
```
|
||
|
||
Add required `--broker-receipt` for WP-0025 admission, pass it through
|
||
`broker_from_receipt`, and require exact digest equality. CLI tests cover
|
||
a missing broker receipt and a mismatched recanonicalized digest.
|
||
|
||
### T02 — Bind runner authorization and final report to cleanup
|
||
|
||
```task
|
||
id: WHITEHAT-WP-0005-T02
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "a3255581-af7d-5a9c-bc46-b9fe980fb326"
|
||
```
|
||
|
||
|
||
Fresh-run setup found two remaining operational misbindings. The audit-core
|
||
runner hard-coded the authorization id from the original 2026-08-21 attempt,
|
||
and its sanitized report could only say credential cleanup was pending.
|
||
|
||
The runner now requires `--authorization-id` and carries that exact value into
|
||
the report. `finalize-report` validates the WP-0025 projection contract,
|
||
projection receipt, and cleanup receipt, binds their engagement, target, image,
|
||
lease, and canonical receipt id to the runner report, and only then records
|
||
custody revocation as complete. Mismatched reports fail closed.
|