diff --git a/docs/conformance/2026-09-02-whitehat-asm-triage-review.md b/docs/conformance/2026-09-02-whitehat-asm-triage-review.md new file mode 100644 index 0000000..5993acd --- /dev/null +++ b/docs/conformance/2026-09-02-whitehat-asm-triage-review.md @@ -0,0 +1,73 @@ +# Conformance coordination review — whitehat ASM triage + +**Repository:** gate-house +**Status:** triage accepted; T-06 blocker reassessment pending +**Date:** 2026-09-02 +**Executor:** whitehat-security +**Executor workplan:** WHITEHAT-WP-0007 +**Executor triage revision:** `5384f05` +**Observed repository revision:** `75b79a0` +**Gate House workplan:** GH-WP-0001-T06 + +## Returned triage + +Whitehat-security promoted `WHITEHAT-IN-0002` into `WHITEHAT-WP-0007` and +triaged Canon T-01 through T-10. Each test now has: + +- an applicability state; +- an owning surface; +- a whitehat-owned known-bad design; +- a named blocker; +- a conformance and implementation-finding route. + +Whitehat also kept ASM separate from its tenancy and capacity attacker models. +`whitehat-target/v1` now distinguishes: + +- `fixture-asm` for in-process known-bad/known-good calibration without a + network; and +- `asm` for a live run against a named revision under a dated engagement. + +Gate House accepts the ten-target triage, the class split, and the result +routes without revising `asm-assurance-targets.v1` or +`conformance-reporting.v1`. + +## Evidence bound + +All ten registrations remain `pending`. T-01 through T-10 being triaged does +not mean they ran, passed, failed, or conform. `WHITEHAT-WP-0007-T11` remains +`wait` for a target-owner-named surface and a later engagement. + +No `[GH-CONFORMANCE]` execution report has returned. Gate House therefore +continues to record every ASM target as `not_run` for doctrine-review purposes. + +## T-06 reassessment + +Whitehat's T-06 registration names this blocker: + +> No synthetic approval fixture and no admitted consumption contract in this +> plane. + +That statement must be reassessed against evidence supplied before the triage +revision: + +- Gate House candidate message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`; +- Gate House candidate record at commit `e04a8b7`; +- secrets-engine implementation revision `3cd9955`; +- a mock-HTTP approval-consume fixture whose focused suite passed 17/17; +- Gate House's normative approval-consumption contract. + +Gate House does not decide that this evidence is sufficient for admission. +Whitehat-security owns that decision. Gate House asked Whitehat either to admit +only T-06 as `fixture-asm` and author its known-bad calibration, or to preserve +`pending` and name the smallest missing artifact. Review message: +`418fe53b-4a4b-4ebb-909e-62d206cd005f`. + +No live target, credential, approval service, packet, OpenBao call, or effect is +authorized by this review. + +## Completion effect + +The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete. +The execution portion remains open until Whitehat returns at least one +known-bad-calibrated outcome under `conformance-reporting.v1`. + diff --git a/docs/conformance/README.md b/docs/conformance/README.md index d9c12bb..34f0706 100644 --- a/docs/conformance/README.md +++ b/docs/conformance/README.md @@ -27,5 +27,12 @@ Fixture-safe candidates awaiting independent execution: the implementer's focused suite passes, but no whitehat-owned known-bad calibration or verdict has returned. +Coordination reviews: + +- [`2026-09-02 — whitehat ASM triage review`](2026-09-02-whitehat-asm-triage-review.md): + all ten targets are triaged and remain `pending`; Gate House accepted the + class split and routes while requesting reassessment of one stale T-06 + blocker. + No whitehat-security ASM execution report has returned under `conformance-reporting.v1`. That target set remains `not_run`, not conformance. diff --git a/history/2026-09-01-conformance-loop-handoff.md b/history/2026-09-01-conformance-loop-handoff.md index 16d7f2a..77f7381 100644 --- a/history/2026-09-01-conformance-loop-handoff.md +++ b/history/2026-09-01-conformance-loop-handoff.md @@ -143,3 +143,17 @@ required risk-nexus path in message `53645a75-0215-4261-a700-f7aedf09e7e8`. The route leaves severity and finding-versus-note classification to risk-nexus and leaves remediation with qonto-assistant. A resulting risk record or explicit rejection is pending. + +Whitehat-security subsequently promoted and closed `WHITEHAT-IN-0002` into +`WHITEHAT-WP-0007` at triage revision `5384f05`. T-01 through T-10 have +individual registrations, known-bad designs, blockers, and result routes. Gate +House accepted the triage and Whitehat's `fixture-asm` / `asm` class split +without revising either Gate House contract. All ten registrations remain +`pending`, so no conformance result exists. + +The T-06 blocker did not account for the already-supplied secrets-engine +candidate. Gate House requested a Whitehat-owned sufficiency decision in +message `418fe53b-4a4b-4ebb-909e-62d206cd005f`: admit T-06 as fixture-only and +author the calibration, or preserve `pending` and name the smallest missing +artifact. Review: +`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`. diff --git a/workplans/GH-WP-0001-foundation.md b/workplans/GH-WP-0001-foundation.md index afb26ad..c14f8d8 100644 --- a/workplans/GH-WP-0001-foundation.md +++ b/workplans/GH-WP-0001-foundation.md @@ -146,4 +146,10 @@ candidate was handed to whitehat-security in message `WHITEHAT-IN-0002`; Gate House accepted that intake without contract revision, while preserving that it is not a result. The qonto completeness finding was routed to risk-nexus in message `53645a75-0215-4261-a700-f7aedf09e7e8` for -grading and remediation tracking. +grading and remediation tracking. Whitehat then promoted its intake into +`WHITEHAT-WP-0007` at revision `5384f05` and completed the ten-target triage. +Gate House accepted the triage, class split, and result routes without contract +revision. All targets remain `pending`; T-06's blocker is under reassessment +against the supplied secrets-engine fixture candidate via message +`418fe53b-4a4b-4ebb-909e-62d206cd005f`. Review: +`docs/conformance/2026-09-02-whitehat-asm-triage-review.md`.