tegwick
8a97fac17f
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
61 lines
3.9 KiB
Markdown
61 lines
3.9 KiB
Markdown
# Proposed E2 engagements — operator approval package
|
|
|
|
Status: **proposed; sends no traffic**
|
|
|
|
These proposals turn the two remaining E2 acceptance runs into bounded
|
|
operator decisions. They are not active until the operator approves them and
|
|
the target owner acknowledges the identity/fixture design.
|
|
|
|
## WH-ENG-20260821-AUDIT-E2
|
|
|
|
| Field | Proposed value |
|
|
| --- | --- |
|
|
| Target | railiance01 production deployment; `audit-core` namespace; `audit-core.audit-core.svc.cluster.local:8080` |
|
|
| Owner | `audit-core` |
|
|
| Source | dedicated attributed probe pod in an owner-approved ingress namespace |
|
|
| Routes | `POST /v1/events`; `GET /v1/events/{id}`; `GET /v1/events?correlation_id=` |
|
|
| Fixtures | two new synthetic tenants, two scoped reader/sender identities, fixture events only |
|
|
| Credential | temporary ordinary sender tokens; tenant scoped; at most 15-minute validity; no operator/database credential |
|
|
| Technique | E2 owner/attacker/absent differential; read and append/state checks |
|
|
| Ceiling | concurrency 1; 10 HTTP requests/minute; at most 30 total requests |
|
|
| Window | 15 minutes, scheduled after owner acknowledgement; no discovery or saturation |
|
|
| Abort | unexpected/non-fixture data; absent attribution; wrong target/revision; readiness failure; operator/owner stop; p95 over 500 ms or any 5xx attributable to probe |
|
|
| Cleanup | remove only named fixture events where target contract permits; otherwise retain them as explicitly named audit fixtures; revoke both temporary sender tokens |
|
|
| Reporting | all outcomes to `risk-nexus`, without severity |
|
|
|
|
Owner question sent as State Hub message
|
|
`93c3ca5e-34a2-43af-9843-19eef1ef350b`. The current deployment's only ordinary
|
|
sender is wildcard-write/no-read, so the owner must approve temporary scoped
|
|
read identities or a semantically equivalent setup before this can test E2.
|
|
|
|
## WH-ENG-20260821-TENANT-E2
|
|
|
|
| Field | Proposed value |
|
|
| --- | --- |
|
|
| Target | railiance01 production deployment; `tenant-engine` namespace; `tenant-engine.tenant-engine.svc.cluster.local:8090` |
|
|
| Owner | `tenant-engine` |
|
|
| Source | dedicated attributed probe pod admitted through the owner-approved `user-engine` ingress class |
|
|
| Routes | declared tenant read, roles/cache, roles/live, guardrails, role grant, plan, lifecycle, grouping and guardrail routes in `probe-packs/tenant-engine-e2.json` |
|
|
| Fixtures | two new synthetic tenant records and only their grants/plans/guardrails |
|
|
| Credential | ordinary caller identity approved by the owner; no database, owner, superuser or `BYPASSRLS` credential |
|
|
| Technique | E2 owner/attacker/absent differential with before/after state checks |
|
|
| Ceiling | concurrency 1; 10 HTTP requests/minute; at most 60 total requests |
|
|
| Window | 15 minutes, scheduled after owner acknowledgement; no discovery or saturation |
|
|
| Abort | unexpected/non-fixture data; absent attribution; wrong target/revision; readiness failure; operator/owner stop; p95 over 500 ms or any 5xx attributable to probe |
|
|
| Cleanup | delete/retire only the named fixture tenants using the owner-approved lifecycle; if deletion is not a target contract, retain/retire and record that limitation |
|
|
| Reporting | all outcomes to `risk-nexus`, without severity |
|
|
|
|
Owner question sent as State Hub message
|
|
`1d0ca44e-e2d7-4c66-8ee2-aa4af3c80375`. The request `actor` is evaluated by
|
|
flex-auth while network identity is the admitted workload. The owner must name
|
|
the legitimate tenant-A fixture identity/policy; an allow-all authorizer or an
|
|
invented tenant claim is not acceptable evidence.
|
|
|
|
## Explicitly excluded
|
|
|
|
These E2 approvals cover only the two exact named production deployments and
|
|
do not cover any other production target, direct PostgreSQL access, RLS
|
|
probes, schema or role changes, connection/load saturation, recovery, adjacent
|
|
services, real tenant identifiers, or collection of response bodies. E3 and
|
|
P1/P2 each receive a separate approval package after E2 establishes the safe
|
|
execution path.
|