From 774f69ff80e13a09e15924ab57068ef8660f6dee Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 2 Sep 2026 13:10:07 +0200 Subject: [PATCH] Reconcile T06 calibration and risk disposition Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b --- ...9-02-kings-guard-qonto-live-observation.md | 23 ++++++++++------ ...2026-09-02-secrets-engine-t06-candidate.md | 14 +++++++--- .../2026-09-02-whitehat-asm-triage-review.md | 10 +++++-- .../2026-09-01-conformance-loop-handoff.md | 27 +++++++++++++++---- workplans/GH-WP-0001-foundation.md | 18 ++++++++----- 5 files changed, 66 insertions(+), 26 deletions(-) diff --git a/docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md b/docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md index 20fa55d..6ccaee4 100644 --- a/docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md +++ b/docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md @@ -1,7 +1,7 @@ # Conformance disposition — kings-guard qonto live observation **Repository:** gate-house -**Status:** reviewed; implementation finding routed to risk-nexus +**Status:** reviewed; implementation finding registered as RISK-F-0011 **Date:** 2026-09-02 **Contract:** `posture-findings-return.v1` **Source:** State Hub message `23480b81-bc34-4df4-92cc-840fbc8514fd` @@ -33,8 +33,13 @@ signal identifiers, stream completeness, and restrictive direction. ## Finding preserved -The `audit.deny` class is load-bearing because qonto-assistant's escalation loop -branches on it. Its stream completeness is `unknown`: +King's Guard returned `audit.deny` as load-bearing because qonto-assistant's +escalation loop branches on denies. Risk Nexus's current-source check narrowed +that rationale: `DenyEscalationTracker` is in-process on the decision path, +while `AuditLogger.emit` is a parallel record. A missing audit line would not +disable qonto-assistant's local lockout. The emitted stream is nevertheless +load-bearing for estate observation because King's Guard consumes it. Its +stream completeness is `unknown`: - no heartbeat or emission-cadence declaration is published; - no reconciliation view was supplied; @@ -79,11 +84,13 @@ Gate House does not create either repository's task. Until each recipient accepts, revises, or rejects its route, these remain pending residuals rather than assumed work. -The implementation finding was also routed through risk-nexus in message -`53645a75-0215-4261-a700-f7aedf09e7e8`. Gate House supplied facts and safe -evidence references, assigned no severity, and requested a finding/note record -or an explicit rejection. Risk Nexus owns grading and remediation tracking; -qonto-assistant continues to own any fix. +The implementation finding was routed through risk-nexus in message +`53645a75-0215-4261-a700-f7aedf09e7e8` and registered as `RISK-F-0011` under +`RISK-RULING-2026-09-02-A`: `medium` (`I2` × `L3`), public, open, no +escalation. Risk Nexus owns grading and remediation tracking; qonto-assistant +continues to own any fix. The source-check clarification changes the stated +load-bearing rationale, not Gate House's `no_change` doctrine disposition or +the bounded completeness finding. ## Review triggers diff --git a/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md b/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md index ec53af8..8b24499 100644 --- a/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md +++ b/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md @@ -5,7 +5,8 @@ **Date:** 2026-09-02 **Canon target:** T-06 — Approval Replay Test **Implementer:** secrets-engine -**Implementation revision:** `3cd9955` (observed at repository revision `465c0d7`) +**Implementation revision:** `4b4d556` +**Initial observation:** uncommitted working tree at repository revision `465c0d7` **Source:** State Hub message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5` **Workplan:** GH-WP-0001-T06 @@ -26,8 +27,8 @@ secret, credential, approval service, or OpenBao mutation: - a failed effect does not unconsume the approval; - the evidence shape contains identifiers and digests, not secret values. -Gate House ran the implementer's focused unit suite as a target-suitability -check: +Gate House initially ran the implementer's focused unit suite against the +then-current working tree at revision `465c0d7` as a target-suitability check: ```text uv run --project /home/worsch/secrets-engine \ @@ -38,6 +39,12 @@ uv run --project /home/worsch/secrets-engine \ This confirms that a bounded fixture surface exists. It is not an offensive probe, a known-bad calibration, or a conformance verdict. +Whitehat-security later established that `approval_consume.py` first appears +in committed history at `4b4d556`, not at `3cd9955` as Gate House initially +inferred from the surrounding workplan history. Gate House accepts that +correction. The initial test count remains a working-tree suitability check; +the immutable candidate revision is `4b4d556`. + ## What whitehat-security must still supply Whitehat-security owns the probe design and outcome. A conforming return still @@ -60,4 +67,3 @@ This candidate authorizes no live probe and no production OpenBao, credential, approval, packet, or side effect. Whitehat may accept, revise, reject, or split the candidate under its own rules of engagement. Gate House specifies only the invariant, target, oracle, and report shape. - diff --git a/docs/conformance/2026-09-02-whitehat-asm-triage-review.md b/docs/conformance/2026-09-02-whitehat-asm-triage-review.md index 5993acd..ebe011e 100644 --- a/docs/conformance/2026-09-02-whitehat-asm-triage-review.md +++ b/docs/conformance/2026-09-02-whitehat-asm-triage-review.md @@ -52,7 +52,7 @@ revision: - Gate House candidate message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`; - Gate House candidate record at commit `e04a8b7`; -- secrets-engine implementation revision `3cd9955`; +- secrets-engine implementation revision `4b4d556`; - a mock-HTTP approval-consume fixture whose focused suite passed 17/17; - Gate House's normative approval-consumption contract. @@ -65,9 +65,15 @@ only T-06 as `fixture-asm` and author its known-bad calibration, or to preserve No live target, credential, approval service, packet, OpenBao call, or effect is authorized by this review. +Whitehat subsequently admitted the fixture-only T-06 surface and returned a +known-bad calibration at revision `75deaf0`. Gate House reproduced the focused +Whitehat suite (53 passed) and accepted Whitehat's correction that the consume +module first entered committed secrets-engine history at `4b4d556`. A formal +`conformance-reporting.v1` envelope remains pending; the triage-thread reply is +not substituted for that durable return. + ## Completion effect The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete. The execution portion remains open until Whitehat returns at least one known-bad-calibrated outcome under `conformance-reporting.v1`. - diff --git a/history/2026-09-01-conformance-loop-handoff.md b/history/2026-09-01-conformance-loop-handoff.md index 77f7381..8a0c40d 100644 --- a/history/2026-09-01-conformance-loop-handoff.md +++ b/history/2026-09-01-conformance-loop-handoff.md @@ -117,11 +117,11 @@ Coordination receipts: no live probe. Gate House then received a concrete, fixture-safe T-06 candidate from -secrets-engine in message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`. Revision -`3cd9955` implements consume-before-OpenBao; its focused unit suite passed -17/17 at observed repository revision `465c0d7`. This is target-suitability -evidence only. The required whitehat-owned probe, known-bad calibration, and -verdict remain pending. Candidate record: +secrets-engine in message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`. Its focused +unit suite passed 17/17 in the then-current working tree at observed repository +revision `465c0d7`. Whitehat later corrected the immutable implementation +revision to `4b4d556`; `3cd9955` did not contain the module. This is +target-suitability evidence only. Candidate record: `docs/conformance/2026-09-02-secrets-engine-t06-candidate.md`. Coordination receipts for the candidate: @@ -157,3 +157,20 @@ message `418fe53b-4a4b-4ebb-909e-62d206cd005f`: admit T-06 as fixture-only and author the calibration, or preserve `pending` and name the smallest missing artifact. Review: `docs/conformance/2026-09-02-whitehat-asm-triage-review.md`. + +Whitehat-security admitted the fixture-only T-06 surface at revision `75deaf0` +and returned a passing known-bad calibration in message +`568d7092-f365-4b30-a5ba-1526b6db6893`. Gate House reproduced its focused +suite (53 passed). The substantive calibration is accepted for review, but the +reply is not yet the standalone `conformance-reporting.v1` envelope required +by the contract; Gate House requested that reporting-only correction in reply +`07572202-c855-4235-8289-5a3d9c8f28ae` without asking for a rerun or live +target. + +Risk Nexus registered the qonto completeness residual as `RISK-F-0011` under +`RISK-RULING-2026-09-02-A`: medium, public, open, no escalation, with +qonto-assistant as fix owner. Its source check correctly narrowed Gate House's +initial rationale: the emitted audit stream does not drive the in-process +lockout; it is load-bearing for estate observation. Gate House accepted the +ruling in reply `0b37297c-9231-4d72-a2dd-66b5ba142031` and corrected its review +without changing the `no_change` doctrine disposition. diff --git a/workplans/GH-WP-0001-foundation.md b/workplans/GH-WP-0001-foundation.md index c14f8d8..f8d19be 100644 --- a/workplans/GH-WP-0001-foundation.md +++ b/workplans/GH-WP-0001-foundation.md @@ -131,15 +131,14 @@ Progress 2026-09-02 — kings-guard accepted the return-path contract, completed recorded `no_change`: the lane is staffed, while deny-stream completeness is unknown pending heartbeat/reconciliation. Review: `docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md`. The -remaining completion gate is a calibrated whitehat result and a risk-nexus -intake disposition for the routed implementation finding. Gate House -acknowledged the King's Guard return and accepted +remaining completion gate is a contract-complete Whitehat return envelope. +Risk Nexus disposition is complete. Gate House acknowledged the King's Guard +return and accepted whitehat's probe-ownership correction; whitehat follow-up `c33c3a72-5bf3-4693-8861-9e9ad37d5908` requests the remaining fixture-safe calibrated result without authorizing a live probe. A concrete T-06 candidate -is now recorded from secrets-engine revision `3cd9955`; its implementer suite -passes 17/17, while independent known-bad calibration and verdict remain -pending. Candidate: +is now recorded from secrets-engine revision `4b4d556`; its implementer suite +passed 17/17 in the initially observed working tree. Candidate: `docs/conformance/2026-09-02-secrets-engine-t06-candidate.md`. The bounded candidate was handed to whitehat-security in message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`. Whitehat subsequently opened @@ -152,4 +151,9 @@ Gate House accepted the triage, class split, and result routes without contract revision. All targets remain `pending`; T-06's blocker is under reassessment against the supplied secrets-engine fixture candidate via message `418fe53b-4a4b-4ebb-909e-62d206cd005f`. Review: -`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`. +`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`. Whitehat then +admitted fixture-only T-06 and returned a passing known-bad calibration at +revision `75deaf0`; Gate House reproduced the focused suite (53 passed). The +standalone `conformance-reporting.v1` envelope is still pending. Risk Nexus +registered the qonto residual as `RISK-F-0011` (medium, public, open, no +escalation) under `RISK-RULING-2026-09-02-A`, closing the finding-intake gate.