Review Whitehat ASM target triage

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b

docs/conformance/2026-09-02-whitehat-asm-triage-review.md

@@ -0,0 +1,73 @@
+# Conformance coordination review — whitehat ASM triage
+
+**Repository:** gate-house
+**Status:** triage accepted; T-06 blocker reassessment pending
+**Date:** 2026-09-02
+**Executor:** whitehat-security
+**Executor workplan:** WHITEHAT-WP-0007
+**Executor triage revision:** `5384f05`
+**Observed repository revision:** `75b79a0`
+**Gate House workplan:** GH-WP-0001-T06
+
+## Returned triage
+
+Whitehat-security promoted `WHITEHAT-IN-0002` into `WHITEHAT-WP-0007` and
+triaged Canon T-01 through T-10. Each test now has:
+
+- an applicability state;
+- an owning surface;
+- a whitehat-owned known-bad design;
+- a named blocker;
+- a conformance and implementation-finding route.
+
+Whitehat also kept ASM separate from its tenancy and capacity attacker models.
+`whitehat-target/v1` now distinguishes:
+
+- `fixture-asm` for in-process known-bad/known-good calibration without a
+  network; and
+- `asm` for a live run against a named revision under a dated engagement.
+
+Gate House accepts the ten-target triage, the class split, and the result
+routes without revising `asm-assurance-targets.v1` or
+`conformance-reporting.v1`.
+
+## Evidence bound
+
+All ten registrations remain `pending`. T-01 through T-10 being triaged does
+not mean they ran, passed, failed, or conform. `WHITEHAT-WP-0007-T11` remains
+`wait` for a target-owner-named surface and a later engagement.
+
+No `[GH-CONFORMANCE]` execution report has returned. Gate House therefore
+continues to record every ASM target as `not_run` for doctrine-review purposes.
+
+## T-06 reassessment
+
+Whitehat's T-06 registration names this blocker:
+
+> No synthetic approval fixture and no admitted consumption contract in this
+> plane.
+
+That statement must be reassessed against evidence supplied before the triage
+revision:
+
+- Gate House candidate message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`;
+- Gate House candidate record at commit `e04a8b7`;
+- secrets-engine implementation revision `3cd9955`;
+- a mock-HTTP approval-consume fixture whose focused suite passed 17/17;
+- Gate House's normative approval-consumption contract.
+
+Gate House does not decide that this evidence is sufficient for admission.
+Whitehat-security owns that decision. Gate House asked Whitehat either to admit
+only T-06 as `fixture-asm` and author its known-bad calibration, or to preserve
+`pending` and name the smallest missing artifact. Review message:
+`418fe53b-4a4b-4ebb-909e-62d206cd005f`.
+
+No live target, credential, approval service, packet, OpenBao call, or effect is
+authorized by this review.
+
+## Completion effect
+
+The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete.
+The execution portion remains open until Whitehat returns at least one
+known-bad-calibrated outcome under `conformance-reporting.v1`.
+

docs/conformance/README.md

@@ -27,5 +27,12 @@ Fixture-safe candidates awaiting independent execution:
   the implementer's focused suite passes, but no whitehat-owned known-bad
   calibration or verdict has returned.
 
+Coordination reviews:
+
+- [`2026-09-02 — whitehat ASM triage review`](2026-09-02-whitehat-asm-triage-review.md):
+  all ten targets are triaged and remain `pending`; Gate House accepted the
+  class split and routes while requesting reassessment of one stale T-06
+  blocker.
+
 No whitehat-security ASM execution report has returned under
 `conformance-reporting.v1`. That target set remains `not_run`, not conformance.