coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
whitehat-security/workplans/WHITEHAT-WP-0004-canonical-custody-binding.md
tegwick 5a0eb6b343 Bind WP-0025 receipts to a canonical projection contract 
Railiance's WP-0025 review found the first adapter fail-open: --contract
was optional, receipt_id was not canonical, and target, identities,
resources, UIDs, broker digest and times were unbound. Require the
contract and refuse any receipt that is not the platform canonical form.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
2026-08-22 22:21:34 +02:00

1.6 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated related
WHITEHAT-WP-0004 workplan Bind the WP-0025 adapter to canonical, fail-closed custody receipts infotech whitehat-security finished net-kingdom whitehat-security 2026-08-22 2026-08-22
WHITEHAT-WP-0003
RAILIANCE-WP-0025

WHITEHAT-WP-0004 — canonical custody binding

Goal

Close the Railiance WP-0025 owner review of adapter 1a38080 / HEAD da6f5fb: the consumer discovered the four schemas and its focused tests passed, but it was not fail-closed or canonically bound. A live projection receipt must not admit a plane lease unless it matches a supplied projection contract.

This plan authorizes no engagement, runner, credential, or traffic.

Origin

Platform progress d1fce546 (2026-08-22T20:09:59Z) on RAILIANCE-WP-0025 T03: noncanonical receipt_id, projection_contract_digest not derived from the supplied contract, incomplete resource UIDs accepted, runtime --contract optional, and receipt validation unbound from target, identities, resources, broker digest, times, and canonical receipt id.

Tasks

T01 — Require a contract and bind the receipt canonically

id: WHITEHAT-WP-0004-T01
status: done
priority: high

PlatformCustodyBroker and admit-plane refuse a WP-0025 projection receipt without --contract. Validation derives the contract digest, requires the canonical receipt_id, and binds target, identities, resource names, the three Kubernetes UIDs, broker digest, and projection/expiry times. The focused adapter tests reject each of those fail-open cases.