Review Whitehat ASM target triage

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b

docs/conformance/2026-09-02-whitehat-asm-triage-review.md

@@ -0,0 +1,73 @@
+# Conformance coordination review — whitehat ASM triage
+
+**Repository:** gate-house
+**Status:** triage accepted; T-06 blocker reassessment pending
+**Date:** 2026-09-02
+**Executor:** whitehat-security
+**Executor workplan:** WHITEHAT-WP-0007
+**Executor triage revision:** `5384f05`
+**Observed repository revision:** `75b79a0`
+**Gate House workplan:** GH-WP-0001-T06
+
+## Returned triage
+
+Whitehat-security promoted `WHITEHAT-IN-0002` into `WHITEHAT-WP-0007` and
+triaged Canon T-01 through T-10. Each test now has:
+
+- an applicability state;
+- an owning surface;
+- a whitehat-owned known-bad design;
+- a named blocker;
+- a conformance and implementation-finding route.
+
+Whitehat also kept ASM separate from its tenancy and capacity attacker models.
+`whitehat-target/v1` now distinguishes:
+
+- `fixture-asm` for in-process known-bad/known-good calibration without a
+  network; and
+- `asm` for a live run against a named revision under a dated engagement.
+
+Gate House accepts the ten-target triage, the class split, and the result
+routes without revising `asm-assurance-targets.v1` or
+`conformance-reporting.v1`.
+
+## Evidence bound
+
+All ten registrations remain `pending`. T-01 through T-10 being triaged does
+not mean they ran, passed, failed, or conform. `WHITEHAT-WP-0007-T11` remains
+`wait` for a target-owner-named surface and a later engagement.
+
+No `[GH-CONFORMANCE]` execution report has returned. Gate House therefore
+continues to record every ASM target as `not_run` for doctrine-review purposes.
+
+## T-06 reassessment
+
+Whitehat's T-06 registration names this blocker:
+
+> No synthetic approval fixture and no admitted consumption contract in this
+> plane.
+
+That statement must be reassessed against evidence supplied before the triage
+revision:
+
+- Gate House candidate message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`;
+- Gate House candidate record at commit `e04a8b7`;
+- secrets-engine implementation revision `3cd9955`;
+- a mock-HTTP approval-consume fixture whose focused suite passed 17/17;
+- Gate House's normative approval-consumption contract.
+
+Gate House does not decide that this evidence is sufficient for admission.
+Whitehat-security owns that decision. Gate House asked Whitehat either to admit
+only T-06 as `fixture-asm` and author its known-bad calibration, or to preserve
+`pending` and name the smallest missing artifact. Review message:
+`418fe53b-4a4b-4ebb-909e-62d206cd005f`.
+
+No live target, credential, approval service, packet, OpenBao call, or effect is
+authorized by this review.
+
+## Completion effect
+
+The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete.
+The execution portion remains open until Whitehat returns at least one
+known-bad-calibrated outcome under `conformance-reporting.v1`.
+

docs/conformance/README.md

@@ -27,5 +27,12 @@ Fixture-safe candidates awaiting independent execution:
   the implementer's focused suite passes, but no whitehat-owned known-bad
   calibration or verdict has returned.
 
+Coordination reviews:
+
+- [`2026-09-02 — whitehat ASM triage review`](2026-09-02-whitehat-asm-triage-review.md):
+  all ten targets are triaged and remain `pending`; Gate House accepted the
+  class split and routes while requesting reassessment of one stale T-06
+  blocker.
+
 No whitehat-security ASM execution report has returned under
 `conformance-reporting.v1`. That target set remains `not_run`, not conformance.

history/2026-09-01-conformance-loop-handoff.md

@@ -143,3 +143,17 @@ required risk-nexus path in message
 `53645a75-0215-4261-a700-f7aedf09e7e8`. The route leaves severity and
 finding-versus-note classification to risk-nexus and leaves remediation with
 qonto-assistant. A resulting risk record or explicit rejection is pending.
+
+Whitehat-security subsequently promoted and closed `WHITEHAT-IN-0002` into
+`WHITEHAT-WP-0007` at triage revision `5384f05`. T-01 through T-10 have
+individual registrations, known-bad designs, blockers, and result routes. Gate
+House accepted the triage and Whitehat's `fixture-asm` / `asm` class split
+without revising either Gate House contract. All ten registrations remain
+`pending`, so no conformance result exists.
+
+The T-06 blocker did not account for the already-supplied secrets-engine
+candidate. Gate House requested a Whitehat-owned sufficiency decision in
+message `418fe53b-4a4b-4ebb-909e-62d206cd005f`: admit T-06 as fixture-only and
+author the calibration, or preserve `pending` and name the smallest missing
+artifact. Review:
+`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`.

workplans/GH-WP-0001-foundation.md

@@ -146,4 +146,10 @@ candidate was handed to whitehat-security in message
 `WHITEHAT-IN-0002`; Gate House accepted that intake without contract revision,
 while preserving that it is not a result. The qonto completeness finding was
 routed to risk-nexus in message `53645a75-0215-4261-a700-f7aedf09e7e8` for
-grading and remediation tracking.
+grading and remediation tracking. Whitehat then promoted its intake into
+`WHITEHAT-WP-0007` at revision `5384f05` and completed the ten-target triage.
+Gate House accepted the triage, class split, and result routes without contract
+revision. All targets remain `pending`; T-06's blocker is under reassessment
+against the supplied secrets-engine fixture candidate via message
+`418fe53b-4a4b-4ebb-909e-62d206cd005f`. Review:
+`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`.