coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile T06 calibration and risk disposition

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
This commit is contained in:
tegwick 2026-09-02 13:10:07 +02:00
parent b3fd044f55
commit 774f69ff80
5 changed files with 66 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md
View file

@ -1,7 +1,7 @@
# Conformance disposition — kings-guard qonto live observation
**Repository:** gate-house
**Status:** reviewed; implementation finding routed to risk-nexus
**Status:** reviewed; implementation finding registered as RISK-F-0011
**Date:** 2026-09-02
**Contract:** `posture-findings-return.v1`
**Source:** State Hub message `23480b81-bc34-4df4-92cc-840fbc8514fd`
@ -33,8 +33,13 @@ signal identifiers, stream completeness, and restrictive direction.
## Finding preserved
The `audit.deny` class is load-bearing because qonto-assistant's escalation loop
branches on it. Its stream completeness is `unknown`:
King's Guard returned `audit.deny` as load-bearing because qonto-assistant's
escalation loop branches on denies. Risk Nexus's current-source check narrowed
that rationale: `DenyEscalationTracker` is in-process on the decision path,
while `AuditLogger.emit` is a parallel record. A missing audit line would not
disable qonto-assistant's local lockout. The emitted stream is nevertheless
load-bearing for estate observation because King's Guard consumes it. Its
stream completeness is `unknown`:
- no heartbeat or emission-cadence declaration is published;
- no reconciliation view was supplied;
@ -79,11 +84,13 @@ Gate House does not create either repository's task. Until each recipient
accepts, revises, or rejects its route, these remain pending residuals rather
than assumed work.
The implementation finding was also routed through risk-nexus in message
`53645a75-0215-4261-a700-f7aedf09e7e8`. Gate House supplied facts and safe
evidence references, assigned no severity, and requested a finding/note record
or an explicit rejection. Risk Nexus owns grading and remediation tracking;
qonto-assistant continues to own any fix.
The implementation finding was routed through risk-nexus in message
`53645a75-0215-4261-a700-f7aedf09e7e8` and registered as `RISK-F-0011` under
`RISK-RULING-2026-09-02-A`: `medium` (`I2` × `L3`), public, open, no
escalation. Risk Nexus owns grading and remediation tracking; qonto-assistant
continues to own any fix. The source-check clarification changes the stated
load-bearing rationale, not Gate House's `no_change` doctrine disposition or
the bounded completeness finding.
## Review triggers

14
docs/conformance/2026-09-02-secrets-engine-t06-candidate.md
View file

@ -5,7 +5,8 @@
**Date:** 2026-09-02
**Canon target:** T-06 — Approval Replay Test
**Implementer:** secrets-engine
**Implementation revision:** `3cd9955` (observed at repository revision `465c0d7`)
**Implementation revision:** `4b4d556`
**Initial observation:** uncommitted working tree at repository revision `465c0d7`
**Source:** State Hub message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`
**Workplan:** GH-WP-0001-T06
@ -26,8 +27,8 @@ secret, credential, approval service, or OpenBao mutation:
- a failed effect does not unconsume the approval;
- the evidence shape contains identifiers and digests, not secret values.
Gate House ran the implementer's focused unit suite as a target-suitability
check:
Gate House initially ran the implementer's focused unit suite against the
then-current working tree at revision `465c0d7` as a target-suitability check:
```text
uv run --project /home/worsch/secrets-engine \
@ -38,6 +39,12 @@ uv run --project /home/worsch/secrets-engine \
This confirms that a bounded fixture surface exists. It is not an offensive
probe, a known-bad calibration, or a conformance verdict.
Whitehat-security later established that `approval_consume.py` first appears
in committed history at `4b4d556`, not at `3cd9955` as Gate House initially
inferred from the surrounding workplan history. Gate House accepts that
correction. The initial test count remains a working-tree suitability check;
the immutable candidate revision is `4b4d556`.
## What whitehat-security must still supply
Whitehat-security owns the probe design and outcome. A conforming return still
@ -60,4 +67,3 @@ This candidate authorizes no live probe and no production OpenBao, credential,
approval, packet, or side effect. Whitehat may accept, revise, reject, or split
the candidate under its own rules of engagement. Gate House specifies only the
invariant, target, oracle, and report shape.

10
docs/conformance/2026-09-02-whitehat-asm-triage-review.md
View file

@ -52,7 +52,7 @@ revision:
- Gate House candidate message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`;
- Gate House candidate record at commit `e04a8b7`;
- secrets-engine implementation revision `3cd9955`;
- secrets-engine implementation revision `4b4d556`;
- a mock-HTTP approval-consume fixture whose focused suite passed 17/17;
- Gate House's normative approval-consumption contract.
@ -65,9 +65,15 @@ only T-06 as `fixture-asm` and author its known-bad calibration, or to preserve
No live target, credential, approval service, packet, OpenBao call, or effect is
authorized by this review.
Whitehat subsequently admitted the fixture-only T-06 surface and returned a
known-bad calibration at revision `75deaf0`. Gate House reproduced the focused
Whitehat suite (53 passed) and accepted Whitehat's correction that the consume
module first entered committed secrets-engine history at `4b4d556`. A formal
`conformance-reporting.v1` envelope remains pending; the triage-thread reply is
not substituted for that durable return.
## Completion effect
The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete.
The execution portion remains open until Whitehat returns at least one
known-bad-calibrated outcome under `conformance-reporting.v1`.

27
history/2026-09-01-conformance-loop-handoff.md
View file

@ -117,11 +117,11 @@ Coordination receipts:
no live probe.
Gate House then received a concrete, fixture-safe T-06 candidate from
secrets-engine in message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`. Revision
`3cd9955` implements consume-before-OpenBao; its focused unit suite passed
17/17 at observed repository revision `465c0d7`. This is target-suitability
evidence only. The required whitehat-owned probe, known-bad calibration, and
verdict remain pending. Candidate record:
secrets-engine in message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`. Its focused
unit suite passed 17/17 in the then-current working tree at observed repository
revision `465c0d7`. Whitehat later corrected the immutable implementation
revision to `4b4d556`; `3cd9955` did not contain the module. This is
target-suitability evidence only. Candidate record:
`docs/conformance/2026-09-02-secrets-engine-t06-candidate.md`.
Coordination receipts for the candidate:
@ -157,3 +157,20 @@ message `418fe53b-4a4b-4ebb-909e-62d206cd005f`: admit T-06 as fixture-only and
author the calibration, or preserve `pending` and name the smallest missing
artifact. Review:
`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`.
Whitehat-security admitted the fixture-only T-06 surface at revision `75deaf0`
and returned a passing known-bad calibration in message
`568d7092-f365-4b30-a5ba-1526b6db6893`. Gate House reproduced its focused
suite (53 passed). The substantive calibration is accepted for review, but the
reply is not yet the standalone `conformance-reporting.v1` envelope required
by the contract; Gate House requested that reporting-only correction in reply
`07572202-c855-4235-8289-5a3d9c8f28ae` without asking for a rerun or live
target.
Risk Nexus registered the qonto completeness residual as `RISK-F-0011` under
`RISK-RULING-2026-09-02-A`: medium, public, open, no escalation, with
qonto-assistant as fix owner. Its source check correctly narrowed Gate House's
initial rationale: the emitted audit stream does not drive the in-process
lockout; it is load-bearing for estate observation. Gate House accepted the
ruling in reply `0b37297c-9231-4d72-a2dd-66b5ba142031` and corrected its review
without changing the `no_change` doctrine disposition.

18
workplans/GH-WP-0001-foundation.md
View file

@ -131,15 +131,14 @@ Progress 2026-09-02 — kings-guard accepted the return-path contract, completed
recorded `no_change`: the lane is staffed, while deny-stream completeness is
unknown pending heartbeat/reconciliation. Review:
`docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md`. The
remaining completion gate is a calibrated whitehat result and a risk-nexus
intake disposition for the routed implementation finding. Gate House
acknowledged the King's Guard return and accepted
remaining completion gate is a contract-complete Whitehat return envelope.
Risk Nexus disposition is complete. Gate House acknowledged the King's Guard
return and accepted
whitehat's probe-ownership correction; whitehat follow-up
`c33c3a72-5bf3-4693-8861-9e9ad37d5908` requests the remaining fixture-safe
calibrated result without authorizing a live probe. A concrete T-06 candidate
is now recorded from secrets-engine revision `3cd9955`; its implementer suite
passes 17/17, while independent known-bad calibration and verdict remain
pending. Candidate:
is now recorded from secrets-engine revision `4b4d556`; its implementer suite
passed 17/17 in the initially observed working tree. Candidate:
`docs/conformance/2026-09-02-secrets-engine-t06-candidate.md`. The bounded
candidate was handed to whitehat-security in message
`cc19a1c4-2acf-448d-b90f-e9843a57a7d4`. Whitehat subsequently opened
@ -152,4 +151,9 @@ Gate House accepted the triage, class split, and result routes without contract
revision. All targets remain `pending`; T-06's blocker is under reassessment
against the supplied secrets-engine fixture candidate via message
`418fe53b-4a4b-4ebb-909e-62d206cd005f`. Review:
`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`.
`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`. Whitehat then
admitted fixture-only T-06 and returned a passing known-bad calibration at
revision `75deaf0`; Gate House reproduced the focused suite (53 passed). The
standalone `conformance-reporting.v1` envelope is still pending. Risk Nexus
registered the qonto residual as `RISK-F-0011` (medium, public, open, no
escalation) under `RISK-RULING-2026-09-02-A`, closing the finding-intake gate.