gate-house/docs/conformance/README.md

49 lines
2.2 KiB
Markdown
Raw Normal View History

# Conformance review register
Gate House records doctrine dispositions for returned assurance and posture
reports here. This directory does not hold raw exploit evidence, credential
values, severity decisions, or another repository's remediation tasks.
Normative inputs:
- [`asm-assurance-targets.v1`](../assurance/asm-t01-t10-executable-targets.md);
- [`asm-targets.yaml`](../assurance/asm-targets.yaml);
- [`conformance-reporting.v1`](../contracts/conformance-reporting.md);
- [`posture-findings-return.v1`](../contracts/posture-findings-return.md).
A review record names the external report and safe evidence references, copies
the executor's outcome without changing it, records Gate House's doctrine
disposition, and links every residual to a live owner.
Returned reviews:
- [`2026-09-02 — kings-guard qonto live observation`](2026-09-02-kings-guard-qonto-live-observation.md):
origin-linked advisory observation is staffed for one lane; load-bearing deny
stream completeness remains unknown; doctrine disposition `no_change`.
- [`2026-09-02 — Whitehat T-06 fixture return`](2026-09-02-whitehat-t06-fixture-return.md):
fixture-class approval-replay result `pass`; live `asm-t06` remains
`pending` / `not_run`; doctrine disposition `no_change`.
Fixture-safe candidates and promotions:
- [`2026-09-02 — secrets-engine T-06 approval-consumption candidate`](2026-09-02-secrets-engine-t06-candidate.md):
promoted into Whitehat's fixture-only T-06 calibration; the live target
remains pending.
Coordination reviews:
- [`2026-09-02 — whitehat ASM triage review`](2026-09-02-whitehat-asm-triage-review.md):
all ten targets were triaged; Gate House accepted the class split and routes,
and the T-06 reassessment produced the fixture return above.
Fixture calibration reviews:
- [`2026-09-02 — Whitehat ASM T-01T-10 fixture calibrations`](2026-09-02-whitehat-asm-fixture-calibrations.md):
all known-bad fixtures produce findings and known-good fixtures pass; live
targets remain `pending` / `not_run`; doctrine disposition `no_change`.
No live whitehat-security ASM execution report has returned under
`conformance-reporting.v1`. The live target set remains `not_run`, not
conformance.