whitehat-security/workplans/WHITEHAT-WP-0012-ia-classification-and-v-observations.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
WHITEHAT-WP-0012	workplan	Classify I and A, calibrate V observations, and name the live E4, R4, and V requirements	infotech	whitehat-security	blocked	whitehat-security	whitehat-security	2026-10-04	2026-10-04	WHITEHAT-WP-0006 WHITEHAT-WP-0008 WHITEHAT-WP-0011	b37d8173-48da-5981-8d5c-63dc27e0223d

Classify I and A, calibrate V observations, and name the live residuals

history/2026-10-04T0649Z-scope-against-intent.md left four items off a workplan: the identity, authorization, and availability axes; a live E4 or R4 target; a risk-nexus filing client; and any change to conformance_state. Live E2, E3, P1/P2, and ASM stay on blocked WHITEHAT-WP-0006 and WHITEHAT-WP-0008. This plan does not reopen them. Offline E4 and R4 calibration stays on finished WHITEHAT-WP-0011.

The local work is the classification record and an in-process availability judge. The live work cannot start. No scanned service declares current E: 4. No owner has named an R4 copy inventory. No operator has approved a failure-injection exercise. This plan authorizes no packet, database connection, load, or failure injection.

Refused as tasks

These gaps stay closed as boundaries. They are not wait tasks.

• A risk-nexus filing client. Delivery stays the local outbox. whitehat deliver does not file findings or assign severity. A writer in this repository would cross that ownership boundary.
• conformance_state. It stays blocked-clean in INTENT.md. The v0.8 flip remains held under gate-house GH-WP-0004. This plan does not edit INTENT.md.

T01 — Record that I and A evidence is mechanical

id: WHITEHAT-WP-0012-T01
status: done
priority: high
state_hub_task_id: "9062f1aa-a38a-5afb-a456-b10dfc4fed02"

Tenancy Posture v0.1 §13 classifies I2, I3, A2, A3, and A4 evidence as Mechanical. It belongs in the declaring service's CI. docs/attacker-model.md §8 now says this repository does not build an adversarial I or A probe, and whitehat cadence has no I or A family. A run under that model must not claim I or A evidence. No probe was added.

The same section records that §13 classifies the live E4 artifact as Mechanical, and that V1 is a mechanical exercise. Those sentences do not authorize a demonstration.

T02 — Calibrate V2, V3, and V4 observation shapes offline

id: WHITEHAT-WP-0012-T02
status: done
priority: high
state_hub_task_id: "06a85360-3469-5f02-806c-bfea9ab50ba3"

whitehat v-fixtures judges a supplied observation. A V2 claim that is only a restart, a claim with no failure injected, and a claim whose failure kind does not match the level are findings. Missing RTO/RPO, a missing operation name, and a missing shared failure domain stay inconclusive. V1 stays inconclusive. Known-good shapes are trusted only after those known-bad cases hold. targets/fixture-v.json is applicable only as fixture-v and projects no credential. The plane rejects that class outside environment=fixture. The command injects no failure and makes no cluster call.

T03 — Live E4 demonstration

id: WHITEHAT-WP-0012-T03
status: wait
priority: medium
needs_human: true
blocking_reason: "Rechecked 2026-10-04: no tenancy.yaml declares E: 4, and apps-pg stays E4-unreachable at E: 0. vergabe-teilnahme is the closest P3-shaped name and does not qualify; its pilot is still a shared apps-pg database. An owner must still name a real per-tenant credential and substrate. This task authorizes no connection. See engagements/2026-10-04-guessed-live-inputs.md."
state_hub_task_id: "b8f4e3c4-59a1-5522-be46-5ab1984cee73"

Blocked on an owner this repository cannot name. Tenancy Posture Decision 5.5 records apps-pg as E4 unreachable because the consumer shares one credential. E4 is reachable only at P3 or above. The offline calibration on WHITEHAT-WP-0011 is not that demonstration. Do not open a connection to finish this task, and do not invent the declaring service.

T04 — Live R4 exercise

id: WHITEHAT-WP-0012-T04
status: wait
priority: medium
needs_human: true
blocking_reason: "Rechecked 2026-10-04: no service has a complete R4 inventory. audit-core stays R2. rapp-postgres ADR-0002 names one WAL stream and one base backup and is not an inventory of derived copies. An owner must still name the route and the inventory. This task authorizes no store access. See engagements/2026-10-04-guessed-live-inputs.md."
state_hub_task_id: "acc22db7-f7c9-5860-9174-6e60773bfd95"

Blocked on an owner this repository cannot name. audit-core remains an R2 target. The offline calibration on WHITEHAT-WP-0011 does not erase a retained copy. Do not open a store to finish this task.

T05 — Live V2, V3, or V4 exercise

id: WHITEHAT-WP-0012-T05
status: wait
priority: medium
needs_human: true
blocking_reason: "Rechecked 2026-10-04: no tenancy.yaml declares V above 1. audit-core V1 for accepting an audit event is a restart and is not V2. No failure domain, RTO, or RPO was guessed. An operator must still approve the exercise. This task authorizes no failure injection. See engagements/2026-10-04-guessed-live-inputs.md."
state_hub_task_id: "3893b7b1-70dc-5f98-a359-42b08a28fc28"

Blocked on an operator record. Decision 4.6 says V is end-to-end and names the operation; the delivering service owns the declaration. Rules of engagement §1 require separate operator approval for a recovery probe, and §4 prohibits denial-of-service outside an approved window. No repository has published that approval. The in-process judge does not substitute for it. Do not terminate an instance, remove a failure domain, or make a region unavailable to finish this task.

Dependencies owned elsewhere

Nothing further is local. T03, T04, and T05 stay wait, and this plan stays blocked. Whitehat does not edit the owner repositories and does not message a guessed owner.

1. An owner publishes a service that actually has a per-tenant credential and a separate per-tenant substrate before T03 can start. The mechanical E4 demonstration then still needs a complete engagement. A 2026-10-04 read of the canon and the declaring tenancy.yaml files found no current E: 4. vergabe-teilnahme is the closest P3-shaped name and does not qualify.
2. An owner publishes the R4 route and a complete copy inventory before T04 can start. audit-core is not that owner. rapp-postgres ADR-0002 is the closest backup text and is not that inventory.
3. An operator publishes the failure-injection approval before T05 can start. The approval names the delivering service, operation, failure domain, RTO, RPO, window, and abort contact. No declaration above V1 was found.

The guessed fields and the rejected candidates are in engagements/2026-10-04-guessed-live-inputs.md.

WHITEHAT-WP-0006 still owns live E3, P1/P2, and the remaining E2. WHITEHAT-WP-0008 still owns live ASM. Those requirements are unchanged.