tegwick
95129d7a35
Encode fail-closed admission, target registrations, and a credential broker that never returns secret values. Calibrate audit-core shaped probes in-process. Send no packets and request no live credentials. Assistant: grok Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb
49 lines
2.4 KiB
Markdown
49 lines
2.4 KiB
Markdown
# Target applicability for WHITEHAT-WP-0001
|
|
|
|
Status: encoded in `targets/`, 2026-08-22
|
|
|
|
The E2 attacker model requires an authenticated identity that is legitimately
|
|
authorized for tenant A and not tenant B. A target name alone is insufficient;
|
|
the target must expose a boundary where that identity exists. Machine-readable
|
|
records live in [`targets/`](../targets/README.md). The test plane will not
|
|
admit a `not_applicable` or `pending` target.
|
|
|
|
## audit-core — applicable
|
|
|
|
`audit-core` binds each sender token to allowed sources, tenant set, read and
|
|
write capabilities at one application choke point. Two distinct ordinary
|
|
sender identities scoped one per fixture tenant instantiate the model without
|
|
operator or database privilege. Its event-id, correlation and append routes
|
|
therefore form a valid E2 differential.
|
|
|
|
The target owner reviewed the route and identity design on 2026-08-21. Formal
|
|
acknowledgement and value-safe provisioning remain required by
|
|
`WH-ENG-20260821-AUDIT-E2`; no target traffic is permitted while its
|
|
`target_owner_acknowledged_at` is empty.
|
|
|
|
## tenant-engine — E2 applicability not established
|
|
|
|
The original workplan named `tenant-engine` because its declaration said an E2
|
|
mechanism was implemented. Cold review of the actual contract shows that this
|
|
does not supply the attacker identity T03 assumes:
|
|
|
|
- `tenancy.yaml` declares current E1/A0, not E2, and says inbound actor/tenant
|
|
values are not verified.
|
|
- The flex-auth policy registers the platform-wide `tenant-engine` service
|
|
subject for administrative actions. It is not a tenant-A subject and is
|
|
deliberately allowed to address tenant B.
|
|
- Tenant registry enumeration is the service's function and is an explicit
|
|
placement exception. Cross-tenant access by its authorized platform operator
|
|
is not a tenant-boundary failure.
|
|
- Substituting an unregistered actor would test caller authorization (A), not
|
|
E2. Substituting the all-tenant service actor would give the modeled attacker
|
|
authority it is supposed not to hold.
|
|
|
|
Therefore no production packet is sent under
|
|
`WH-ENG-20260821-TENANT-E2` until the target owner names a real authenticated
|
|
tenant-A identity with no tenant-B authority. If none exists, the honest
|
|
artifact is `not applicable`, and the workplan acceptance must stop naming
|
|
tenant-engine as though it claimed an exercisable E2 boundary. Its existing
|
|
A/I gaps remain target-owned; whitehat must not relabel them to make this plan
|
|
finish.
|
|
|