coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/docs/test-plane.md
tegwick 7e83a66573 Admit E3 and capacity on the test plane 
Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-22 09:40:27 +02:00

2.2 KiB
Raw Blame History

Governed test plane

This is the missing control from the 2026-08-22 cutoff. It is a fail-closed admission path, not a standing authorization to probe.

What the plane is

A live E2 run is admitted only when every item below is true:

  1. The target is registered in targets/ with applicability: applicable.
  2. Known-bad calibration for that target has already failed in-process.
  3. The engagement is complete, in window, owner-acknowledged, and not a retired ID.
  4. approval_class matches the registration (fixture-e2 / live-e2 / fixture-e3 / e3 / fixture-capacity / capacity).
  5. The runner namespace is whitehat, the image digest is pinned, and engagement labels are present. Live E3 also names a database. Live capacity also names an aggressor_ceiling.
  6. The custody broker projected the registered number of identity handles (two for E2, one runtime for E3, none for capacity fixtures). Credential values are not returned to the operator or agent. Live classes fail closed while the custody broker is unconnected.
  7. The kill switch is clear.
  8. The rate watcher is attached. Cleanup revokes the lease.

If any item is false, whitehat admit-plane exits 2 and no identity is requested.

What the plane is not

  • Not authorization. Rules of engagement §1 still apply.
  • Not a packet. Manifests in plane/ are a contract for ops-mason.
  • Not a secret broker. UnconnectedCustodyBroker is the default for every non-fixture environment and raises before any custody call.
  • Not a way to finish tenant-engine E2. That target is not_applicable.

Operator commands

PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json
PYTHONPATH=src python3 -m whitehat_security.cli kill-switch
PYTHONPATH=src python3 -m whitehat_security.cli deliver evidence/<run>.json --outbox outbox

Create plane/KILL to abort independently of the runner process.

Retired identifiers

WH-ENG-20260821-AUDIT-E2 and WH-ENG-20260821-TENANT-E2 are terminal. A new live run needs a new ID after the cluster plane exists and the custody broker can project identities without exposing values.