tegwick
7a2373ae4c
SCOPE.md now matches the commands that run. E4 and R4 fail known-bad fixtures in process, and the cadence register schedules nothing. Assistant: grok Assistant-Session: 01a10450-dda4-7253-91a9-b8dccb2f0173
47 lines
2.2 KiB
Markdown
47 lines
2.2 KiB
Markdown
# whitehat-security
|
|
|
|
NetKingdom's offensive security facility. It calibrates adversarial probes
|
|
offline and admits a live run only under a complete engagement record. No
|
|
live target is authorized by the repository itself.
|
|
|
|
The estate's **adversarial evidence facility**: it can test whether a claimed
|
|
boundary holds, and today that capability is the offline harness plus one
|
|
terminal historical audit-core E2 pass. It does not run on a schedule.
|
|
|
|
It exists because a repo testing its own boundary grades its own homework. The
|
|
probes most worth having are the ones an author would not think to write.
|
|
|
|
- **Independent in operation.** It does not take a declared posture as true.
|
|
NetKingdom owns both the security canon and this facility, so findings leave
|
|
through `risk-nexus` under separate ownership rather than being resolved here.
|
|
- **It finds; it does not fix.** Findings route to `risk-nexus`, which owns
|
|
severity and disclosure. The repo that owns the defect owns the repair.
|
|
- **A pass means the attacks we tried did not work** — not that the boundary
|
|
holds. Reports say so.
|
|
|
|
- Intent: [`INTENT.md`](INTENT.md)
|
|
- Scope: [`SCOPE.md`](SCOPE.md)
|
|
- Workplans: [`workplans/`](workplans/)
|
|
- Attacker model: [`docs/attacker-model.md`](docs/attacker-model.md)
|
|
- Rules of engagement (accepted; live targets still require engagement approval):
|
|
[`docs/rules-of-engagement.md`](docs/rules-of-engagement.md)
|
|
- Operator runbook: [`docs/operator-runbook.md`](docs/operator-runbook.md)
|
|
- Session cutoff and redesign handoff:
|
|
[`docs/session-cutoff-2026-08-22.md`](docs/session-cutoff-2026-08-22.md)
|
|
- Governed test plane: [`docs/test-plane.md`](docs/test-plane.md)
|
|
- Target registrations: [`targets/`](targets/)
|
|
- Target packs: [`probe-packs/`](probe-packs/)
|
|
|
|
## Offline calibration
|
|
|
|
```sh
|
|
make check
|
|
make fixture-evidence
|
|
```
|
|
|
|
This proves that every current differential probe, including the audit-core
|
|
shaped pack, passes an enforcing fixture and detects the corresponding
|
|
missing-tenant-predicate fixture. It sends no network traffic and is not
|
|
evidence about a target service. Live execution requires a current
|
|
target-specific record, a registered applicable target, and plane admission.
|
|
See [`docs/test-plane.md`](docs/test-plane.md).
|