Record Whitehat ASM fixture calibrations

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b

docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md

@@ -0,0 +1,76 @@
+# Conformance review — Whitehat ASM fixture calibrations
+
+**Repository:** gate-house
+**Status:** fixture harness calibrated; live targets pending
+**Date:** 2026-09-02
+**Executor:** whitehat-security
+**Executor revision:** `6f1ca0b`
+**Source:** State Hub message `32926191-4ca1-46ad-8eec-0d499036d66b`
+**Specification:** `asm-assurance-targets.v1`
+**Evidence class:** `fixture`
+**Gate House disposition:** `no_change`
+**Workplan:** GH-WP-0001-T06
+
+## Returned calibration
+
+Whitehat-security created in-process registrations and evidence for Canon T-01
+through T-10:
+
+```text
+targets/fixture-asm-tNN.json
+evidence/offline-asm-tNN-calibration.json
+```
+
+For every test, the Whitehat-owned known-bad fixture loses the specified oracle
+and records a `finding`; the corresponding known-good fixture records `pass`.
+T-08 and T-09 each calibrate two distinct failure shapes. T-06 drives the
+committed secrets-engine consume client at revision `4b4d556` through an
+in-process CAS opener; the other fixtures are Whitehat-owned in-process models
+of their target invariant.
+
+Gate House reproduced the focused suite against Whitehat revision `6f1ca0b`:
+
+```text
+uv run --project /home/worsch/whitehat-security \
+  pytest -p no:cacheprovider tests/test_asm.py tests/test_plane.py tests/test_cli.py
+53 passed in 0.34s
+```
+
+This establishes that each published target has a probe capable of detecting a
+known-bad case. It closes the risk that a probe could report green merely
+because it cannot observe its own oracle.
+
+## Evidence bound
+
+This is harness calibration, not assurance of ten estate systems:
+
+- evidence class is `fixture`;
+- no network, live service, OpenBao instance, credential, packet, or production
+  effect was used;
+- no live `asm-tNN` registration became applicable;
+- no component other than the bounded T-06 consume client was exercised;
+- a fixture `pass` means the probe distinguished its known-good model from its
+  known-bad model, not that the corresponding estate control currently holds.
+
+All live T-01 through T-10 targets remain `pending` / `not_run` until an owner
+names the surface, identities, and window and Whitehat admits a dated
+engagement. `WHITEHAT-WP-0007-T11` preserves that residual.
+
+## Doctrine disposition
+
+`no_change` to `asm-assurance-targets.v1`.
+
+The returned fixture set implements Whitehat-owned attack designs while
+preserving Gate House's invariant and oracle identifiers. No calibration
+exposed an ambiguous, contradictory, or untestable Gate House target. This
+disposition accepts the harness/specification fit only; it does not convert
+fixture outcomes into live conformance.
+
+## Reporting residual
+
+The standalone T-06 return has the required subject and safe evidence
+reference, but its message/artifact pair does not yet express the engagement
+and authorization references required by `conformance-reporting.v1`. Gate
+House requested a reporting-only correction in reply
+`07572202-c855-4235-8289-5a3d9c8f28ae`; no rerun or live target is required.
+

docs/conformance/2026-09-02-whitehat-asm-triage-review.md

@@ -37,8 +37,8 @@ All ten registrations remain `pending`. T-01 through T-10 being triaged does
 not mean they ran, passed, failed, or conform. `WHITEHAT-WP-0007-T11` remains
 `wait` for a target-owner-named surface and a later engagement.
 
-No `[GH-CONFORMANCE]` execution report has returned. Gate House therefore
-continues to record every ASM target as `not_run` for doctrine-review purposes.
+Fixture calibration has now returned for all ten targets. Gate House continues
+to record every live ASM target as `not_run` for doctrine-review purposes.
 
 ## T-06 reassessment
 
@@ -75,5 +75,6 @@ not substituted for that durable return.
 ## Completion effect
 
 The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete.
-The execution portion remains open until Whitehat returns at least one
-known-bad-calibrated outcome under `conformance-reporting.v1`.
+The harness-calibration portion is also substantively complete. The reporting
+portion remains open until Whitehat supplies the missing contract fields for
+the T-06 return.

docs/conformance/README.md

@@ -34,5 +34,12 @@ Coordination reviews:
   class split and routes while requesting reassessment of one stale T-06
   blocker.
 
-No whitehat-security ASM execution report has returned under
-`conformance-reporting.v1`. That target set remains `not_run`, not conformance.
+Fixture calibration reviews:
+
+- [`2026-09-02 — Whitehat ASM T-01–T-10 fixture calibrations`](2026-09-02-whitehat-asm-fixture-calibrations.md):
+  all known-bad fixtures produce findings and known-good fixtures pass; live
+  targets remain `pending` / `not_run`; doctrine disposition `no_change`.
+
+No live whitehat-security ASM execution report has returned under
+`conformance-reporting.v1`. The live target set remains `not_run`, not
+conformance.

history/2026-09-01-conformance-loop-handoff.md

@@ -174,3 +174,11 @@ initial rationale: the emitted audit stream does not drive the in-process
 lockout; it is load-bearing for estate observation. Gate House accepted the
 ruling in reply `0b37297c-9231-4d72-a2dd-66b5ba142031` and corrected its review
 without changing the `no_change` doctrine disposition.
+
+Whitehat-security then completed in-process known-bad/known-good calibration
+for T-01 through T-10 at revision `6f1ca0b` and returned aggregate message
+`32926191-4ca1-46ad-8eec-0d499036d66b`. Gate House reproduced the current
+focused suite (53 passed) and recorded `no_change` to the executable target
+specification. These are fixture harness calibrations, not ten live system
+results; every live `asm-tNN` remains `pending` / `not_run`. Review:
+`docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md`.

workplans/GH-WP-0001-foundation.md

@@ -157,3 +157,7 @@ revision `75deaf0`; Gate House reproduced the focused suite (53 passed). The
 standalone `conformance-reporting.v1` envelope is still pending. Risk Nexus
 registered the qonto residual as `RISK-F-0011` (medium, public, open, no
 escalation) under `RISK-RULING-2026-09-02-A`, closing the finding-intake gate.
+Whitehat revision `6f1ca0b` now calibrates fixture harnesses for T-01 through
+T-10; Gate House reproduced 53/53 focused tests and recorded `no_change` to the
+target specification. Live targets remain `pending` / `not_run`. Review:
+`docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md`.