feat(audit): publish structured HardeningKitty JSON #2

2026-10-29T08:04:30Z

pcosson commented

2026-10-29 08:04:30 +00:00

Diagnostic

The reference setup.py changes audit publication from independent metrics and 16 findings shards to a single structured JSON value. The current updater and package integrity checks are newer and safer than the older reference updater; they are retained rather than replaced.

Changes

Publish one native JSON document under hardeningkitty/hardeningkitty, with complete control details, category and summary counts, privacy opt-in for observed values, sanitized ERROR documents, and a 2 MiB fail-closed limit.
Keep controls canonical and make the priority list a compact index; bump package version to 0.9.11-0 and minimum agent version to WAPT 2.6.
Add an escaped Mustache Console template and document its separate Console-side installation.
Keep offline install integrity verification, SYSTEM/Admin ACL handling, and the pinned updater flow.

Validation

waptpython -m unittest discover -s tests -v: 42 tests passed, including synthetic 407-control JSON, template contract, install verification, updater idempotency, and synthetic WAPT ZIP inspection.
wapt-get update-package-sources .: passed using already verified vendor assets; no download and no build/sign/upload.
waptpython tools/package_verify.py --source .: passed (148 manifested files).
git diff --check: passed.
Gitleaks: no leaks found.
Synthetic 500-control JSON measured 264171 bytes without observed values and 335670 bytes with opt-in; both within 2 MiB.

Limits and follow-up

No real WAPT .wapt was built or signed, and no Windows agent audit was run. The ZIP test constructs and verifies a synthetic archive. The Mustache template was checked statically, not rendered in WAPT Console; the referenced template documentation is WAPT 2.7, so Console 2.6 rendering still needs qualification. No package publication, merge, or deployment.

## Diagnostic The reference setup.py changes audit publication from independent metrics and 16 findings shards to a single structured JSON value. The current updater and package integrity checks are newer and safer than the older reference updater; they are retained rather than replaced. ## Changes - Publish one native JSON document under hardeningkitty/hardeningkitty, with complete control details, category and summary counts, privacy opt-in for observed values, sanitized ERROR documents, and a 2 MiB fail-closed limit. - Keep controls canonical and make the priority list a compact index; bump package version to 0.9.11-0 and minimum agent version to WAPT 2.6. - Add an escaped Mustache Console template and document its separate Console-side installation. - Keep offline install integrity verification, SYSTEM/Admin ACL handling, and the pinned updater flow. ## Validation - `waptpython -m unittest discover -s tests -v`: 42 tests passed, including synthetic 407-control JSON, template contract, install verification, updater idempotency, and synthetic WAPT ZIP inspection. - `wapt-get update-package-sources .`: passed using already verified vendor assets; no download and no build/sign/upload. - `waptpython tools/package_verify.py --source .`: passed (148 manifested files). - `git diff --check`: passed. - Gitleaks: no leaks found. - Synthetic 500-control JSON measured 264171 bytes without observed values and 335670 bytes with opt-in; both within 2 MiB. ## Limits and follow-up No real WAPT `.wapt` was built or signed, and no Windows agent audit was run. The ZIP test constructs and verifies a synthetic archive. The Mustache template was checked statically, not rendered in WAPT Console; the referenced template documentation is WAPT 2.7, so Console 2.6 rendering still needs qualification. No package publication, merge, or deployment.

pcosson added 1 commit 2026-10-29 08:04:30 +00:00

feat(audit): publish structured HardeningKitty JSON f60d102233

pcosson merged commit 3468108e10 into main

2026-10-29 09:11:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: paquets-publics/comi-audit-secu#2