Reconcile T06 calibration and risk disposition

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
This commit is contained in:
tegwick 2026-09-02 13:10:07 +02:00
parent b3fd044f55
commit 774f69ff80
5 changed files with 66 additions and 26 deletions

View file

@ -117,11 +117,11 @@ Coordination receipts:
no live probe.
Gate House then received a concrete, fixture-safe T-06 candidate from
secrets-engine in message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`. Revision
`3cd9955` implements consume-before-OpenBao; its focused unit suite passed
17/17 at observed repository revision `465c0d7`. This is target-suitability
evidence only. The required whitehat-owned probe, known-bad calibration, and
verdict remain pending. Candidate record:
secrets-engine in message `99bf84bf-18d2-4e63-a7ac-25078e1c72d5`. Its focused
unit suite passed 17/17 in the then-current working tree at observed repository
revision `465c0d7`. Whitehat later corrected the immutable implementation
revision to `4b4d556`; `3cd9955` did not contain the module. This is
target-suitability evidence only. Candidate record:
`docs/conformance/2026-09-02-secrets-engine-t06-candidate.md`.
Coordination receipts for the candidate:
@ -157,3 +157,20 @@ message `418fe53b-4a4b-4ebb-909e-62d206cd005f`: admit T-06 as fixture-only and
author the calibration, or preserve `pending` and name the smallest missing
artifact. Review:
`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`.
Whitehat-security admitted the fixture-only T-06 surface at revision `75deaf0`
and returned a passing known-bad calibration in message
`568d7092-f365-4b30-a5ba-1526b6db6893`. Gate House reproduced its focused
suite (53 passed). The substantive calibration is accepted for review, but the
reply is not yet the standalone `conformance-reporting.v1` envelope required
by the contract; Gate House requested that reporting-only correction in reply
`07572202-c855-4235-8289-5a3d9c8f28ae` without asking for a rerun or live
target.
Risk Nexus registered the qonto completeness residual as `RISK-F-0011` under
`RISK-RULING-2026-09-02-A`: medium, public, open, no escalation, with
qonto-assistant as fix owner. Its source check correctly narrowed Gate House's
initial rationale: the emitted audit stream does not drive the in-process
lockout; it is load-bearing for estate observation. Gate House accepted the
ruling in reply `0b37297c-9231-4d72-a2dd-66b5ba142031` and corrected its review
without changing the `no_change` doctrine disposition.