coulomb/whitehat-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/evidence/README.md
tegwick 7a2373ae4c State the harness scope and calibrate E4 and R4 offline. 
SCOPE.md now matches the commands that run. E4 and R4 fail known-bad fixtures in process, and the cadence register schedules nothing.

Assistant: grok
Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
2026-10-04 08:54:40 +02:00

1.4 KiB
Raw Blame History

Evidence

This directory stores sanitized run artifacts. offline-calibration.json, offline-e3-calibration.json, offline-e4-calibration.json, offline-r4-calibration.json, offline-capacity-calibration.json, and offline-asm-t01-calibration.json … offline-asm-t10-calibration.json are generated from repository-created fixtures and prove only that the harness distinguishes known-good from known-bad behavior. They are not target assurance. probe-cadence.json is the unscheduled cadence register. WH-ENG-20260822-AUDIT-E2-02-abort.json is an abort record (evidence_class: abort), not an E2 pass or finding. WH-ENG-20260822-AUDIT-E2-03.json is the first authorized target pass; SHA-256 2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593. A pass means only that the attempted attacks did not work.

Before committing target evidence, verify that it contains no response body, credential, database URL, real tenant identifier, or real tenant value. A run-local digest is allowed; it must not be reusable across runs as a data oracle.

2026-10-03-emergent-021-offline-review.json, 2026-10-03-emergent-023-offline-retest.json, 2026-10-04-emergent-026-library-probes.json, and 2026-10-04-emergent-026-corpus-disposition.json are offline knowledge-release reviews. They are not evidence_class: target and they are not queued as target assurance.