diff --git a/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md b/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md index 8b24499..9c50f10 100644 --- a/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md +++ b/docs/conformance/2026-09-02-secrets-engine-t06-candidate.md @@ -1,7 +1,7 @@ # Conformance candidate — secrets-engine approval consumption **Repository:** gate-house -**Status:** candidate; not executed by whitehat-security +**Status:** promoted into Whitehat fixture calibration; live target pending **Date:** 2026-09-02 **Canon target:** T-06 — Approval Replay Test **Implementer:** secrets-engine @@ -45,18 +45,15 @@ inferred from the surrounding workplan history. Gate House accepts that correction. The initial test count remains a working-tree suitability check; the immutable candidate revision is `4b4d556`. -## What whitehat-security must still supply +## Whitehat return -Whitehat-security owns the probe design and outcome. A conforming return still -requires all of the following under `conformance-reporting.v1`: +Whitehat-security supplied the fixture-only probe, known-bad calibration, and +contract-complete return under `conformance-reporting.v1`: -1. independently identify the exact target revision and fixture boundary; -2. author a known-bad fixture that disables at least one replay protection, - such as different-digest conflict or atomic single-use consumption; -3. demonstrate that the known-bad fixture accepts a prohibited replay or loses - the T-06 oracle; -4. run the same probe against the unmodified candidate; -5. return `pass`, `fail`, `blocked`, or `not_run` with safe evidence references. +- Whitehat evidence revision `75deaf0`; +- return message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`; +- final Gate House review + `docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`. The existing implementer tests may be reused as setup evidence but must not be reported as independent Whitehat evidence. diff --git a/docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md b/docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md index b39ff30..f83b540 100644 --- a/docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md +++ b/docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md @@ -66,11 +66,9 @@ exposed an ambiguous, contradictory, or untestable Gate House target. This disposition accepts the harness/specification fit only; it does not convert fixture outcomes into live conformance. -## Reporting residual - -The standalone T-06 return has the required subject and safe evidence -reference, but its message/artifact pair does not yet express the engagement -and authorization references required by `conformance-reporting.v1`. Gate -House requested a reporting-only correction in reply -`07572202-c855-4235-8289-5a3d9c8f28ae`; no rerun or live target is required. +## Reporting closure +Whitehat supplied the complete T-06 envelope, including engagement and +authorization references, in message +`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`. Final review: +`docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`. diff --git a/docs/conformance/2026-09-02-whitehat-asm-triage-review.md b/docs/conformance/2026-09-02-whitehat-asm-triage-review.md index 2e4e098..f6a2a1d 100644 --- a/docs/conformance/2026-09-02-whitehat-asm-triage-review.md +++ b/docs/conformance/2026-09-02-whitehat-asm-triage-review.md @@ -68,13 +68,12 @@ authorized by this review. Whitehat subsequently admitted the fixture-only T-06 surface and returned a known-bad calibration at revision `75deaf0`. Gate House reproduced the focused Whitehat suite (53 passed) and accepted Whitehat's correction that the consume -module first entered committed secrets-engine history at `4b4d556`. A formal -`conformance-reporting.v1` envelope remains pending; the triage-thread reply is -not substituted for that durable return. +module first entered committed secrets-engine history at `4b4d556`. Whitehat +then supplied the formal `conformance-reporting.v1` envelope in message +`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`. ## Completion effect The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete. -The harness-calibration portion is also substantively complete. The reporting -portion remains open until Whitehat supplies the missing contract fields for -the T-06 return. +The harness-calibration and reporting portions are complete. Live execution +remains separate residual work under `WHITEHAT-WP-0008`. diff --git a/docs/conformance/2026-09-02-whitehat-t06-fixture-return.md b/docs/conformance/2026-09-02-whitehat-t06-fixture-return.md new file mode 100644 index 0000000..efeb355 --- /dev/null +++ b/docs/conformance/2026-09-02-whitehat-t06-fixture-return.md @@ -0,0 +1,83 @@ +# Conformance disposition — Whitehat T-06 fixture return + +**Repository:** gate-house +**Status:** review complete; live target remains pending +**Date:** 2026-09-02 +**Contract:** `conformance-reporting.v1` +**Source:** State Hub message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82` +**Executor:** whitehat-security +**Executor evidence revision:** `75deaf0` +**Report/run:** `asm-t06-calibration-2026-09-02T08:10:37.814145Z` +**Target:** secrets-engine `4b4d556d6264a5da933f7e14aae0fe27ba1f4300` +**Environment:** fixture +**Outcome:** `pass` +**Gate House disposition:** `no_change` +**Workplan:** GH-WP-0001-T06 + +## Returned result + +Whitehat-security returned a contract-complete fixture result for Canon T-06, +Approval Replay Test, against `secrets_engine.approval_consume`: + +- specification `asm-assurance-targets.v1`, test `T-06`; +- invariant identifiers `A-04`, `A-07`, `A-13`, and `A-15`; +- engagement `fixture-asm-t06`; +- authorization `docs/rules-of-engagement.md v0.2 §1`, the accepted offline + fixture authorization; +- known-bad and evidence reference + `evidence/offline-asm-t06-calibration.json@75deaf0`; +- fixture registration `targets/fixture-asm-t06.json`. + +The Whitehat-owned known-bad CAS disables different-digest conflict. The +prohibited replay is accepted and reaches the OpenBao-call oracle, producing a +`finding`. The same probe against the enforcing in-process CAS rejects the +different-digest replay with zero OpenBao calls. Exact first use and +same-digest retry remain accepted as the contract requires. + +Gate House reproduced Whitehat's focused suite at the later aggregate fixture +revision `6f1ca0b`: 53 tests passed. Gate House copies Whitehat's result without +regrading it: `pass` for the recorded fixture run. + +## Assurance bound + +The returned assurance statement is bounded to the recorded attacks and +conditions. This is not proof that the control always holds. + +Specifically: + +- the run is offline fixture evidence; +- no network, live approval-engine, OpenBao instance, reusable credential, + packet, or production effect was used; +- the consume client first entered committed secrets-engine history at + `4b4d556`; the earlier Gate House reference to `3cd9955` was corrected; +- live `asm-t06` remains `pending` / `not_run`. + +## Doctrine disposition + +`no_change`. + +The result exercises the published T-06 invariant and oracle without exposing +an ambiguity or contradiction in Gate House doctrine. Whitehat owned the +attack design, known-bad calibration, execution, and verdict. Gate House did +not turn the implementer's tests into independent evidence or authorize a live +probe. + +## Residual ownership + +Whitehat-security finished `WHITEHAT-WP-0007` at revision `7bc0933` and moved +live T-01 through T-10 execution into `WHITEHAT-WP-0008`. That workplan is +blocked-clean until a target owner names a component revision, identities, +window, and technique and a complete dated engagement is admitted. + +The live T-06 residual therefore has a durable owner and is not a Gate House +foundation blocker. No live result is inferred from this fixture return. + +## Review triggers + +Re-review T-06 when: + +1. Whitehat executes a live `asm-t06` engagement; +2. secrets-engine changes the consume-before-effect boundary; +3. approval-engine exposes or changes the durable consume binding; +4. the T-06 invariant, oracle, or reporting contract changes. + diff --git a/docs/conformance/README.md b/docs/conformance/README.md index 1f2eb14..13e09c2 100644 --- a/docs/conformance/README.md +++ b/docs/conformance/README.md @@ -21,18 +21,21 @@ Returned reviews: origin-linked advisory observation is staffed for one lane; load-bearing deny stream completeness remains unknown; doctrine disposition `no_change`. -Fixture-safe candidates awaiting independent execution: +- [`2026-09-02 — Whitehat T-06 fixture return`](2026-09-02-whitehat-t06-fixture-return.md): + fixture-class approval-replay result `pass`; live `asm-t06` remains + `pending` / `not_run`; doctrine disposition `no_change`. + +Fixture-safe candidates and promotions: - [`2026-09-02 — secrets-engine T-06 approval-consumption candidate`](2026-09-02-secrets-engine-t06-candidate.md): - the implementer's focused suite passes, but no whitehat-owned known-bad - calibration or verdict has returned. + promoted into Whitehat's fixture-only T-06 calibration; the live target + remains pending. Coordination reviews: - [`2026-09-02 — whitehat ASM triage review`](2026-09-02-whitehat-asm-triage-review.md): - all ten targets are triaged and remain `pending`; Gate House accepted the - class split and routes while requesting reassessment of one stale T-06 - blocker. + all ten targets were triaged; Gate House accepted the class split and routes, + and the T-06 reassessment produced the fixture return above. Fixture calibration reviews: diff --git a/history/2026-09-01-conformance-loop-handoff.md b/history/2026-09-01-conformance-loop-handoff.md index 386f54e..8118f95 100644 --- a/history/2026-09-01-conformance-loop-handoff.md +++ b/history/2026-09-01-conformance-loop-handoff.md @@ -182,3 +182,28 @@ focused suite (53 passed) and recorded `no_change` to the executable target specification. These are fixture harness calibrations, not ten live system results; every live `asm-tNN` remains `pending` / `not_run`. Review: `docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md`. + +## Closure — 2026-09-02 + +Whitehat-security supplied the corrected standalone T-06 envelope in message +`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`. It confirms engagement +`fixture-asm-t06`, authorization `docs/rules-of-engagement.md v0.2 §1`, stable +report/run id, target revision `4b4d556`, invariants, evidence references, +limitations, and returned time. No rerun or live target was used. + +Gate House recorded Whitehat's fixture outcome `pass` without regrading it and +set doctrine disposition `no_change`. Final review: +`docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`. + +All GH-WP-0001-T06 completion conditions are satisfied: + +1. T-01 through T-10 are triaged and their fixture probes are calibrated; +2. a contract-complete Whitehat T-06 result returned; +3. King's Guard accepted the posture contract, staffed one live observation + lane, and preserved completeness separately from richness; +4. Gate House recorded and returned explicit doctrine dispositions; +5. the qonto implementation finding is tracked as `RISK-F-0011`; +6. live ASM residuals are owned by `WHITEHAT-WP-0008` and remain explicitly + `pending` / `not_run`. + +The conformance loop is staffed. It is not declared estate-wide green. diff --git a/workplans/GH-WP-0001-foundation.md b/workplans/GH-WP-0001-foundation.md index 5cfedfd..36b48de 100644 --- a/workplans/GH-WP-0001-foundation.md +++ b/workplans/GH-WP-0001-foundation.md @@ -4,9 +4,9 @@ type: workplan title: "Foundation" domain: infotech repo: gate-house -status: active +status: finished state_hub_workstream_id: "2ec4cf1a-a73f-5793-9738-8d8019cccca8" -updated: "2026-09-01" +updated: "2026-09-02" --- # Foundation @@ -106,7 +106,7 @@ and agent guidance now point to the current document. ```task id: GH-WP-0001-T06 -status: wait +status: done priority: medium state_hub_task_id: "8cc018e1-2787-5435-9c2c-c2b01cf75ae4" ``` @@ -116,12 +116,12 @@ whitehat-security as executable targets, agree the posture and findings return path with kings-guard, and establish how conformance review reports back. Until this turns, Gate House is a paper generator by its own falsifier. -Waiting on the first return — Gate House's side is published at commit +Initial handoff — Gate House's side was published at commit `8cb7250`. The executable target set and reporting contract were handed to whitehat-security in State Hub message `8229c9a4-862f-4d55-842c-5c95702f79d9`; the posture/findings contract, grounded in `KG-DEC-2026-001` and `KG-WP-0003`, was handed to kings-guard in message -`50d392ad-b342-4e90-85e7-d4c5495f3671`. T06 becomes done after a calibrated +`50d392ad-b342-4e90-85e7-d4c5495f3671`. Completion required a calibrated whitehat result, kings-guard's return-path disposition/status, and Gate House's first recorded doctrine disposition. Full record: `history/2026-09-01-conformance-loop-handoff.md`. @@ -131,10 +131,10 @@ Progress 2026-09-02 — kings-guard accepted the return-path contract, completed recorded `no_change`: the lane is staffed, while deny-stream completeness is unknown pending heartbeat/reconciliation. Review: `docs/conformance/2026-09-02-kings-guard-qonto-live-observation.md`. The -remaining completion gate is a contract-complete Whitehat return envelope. -Risk Nexus disposition is complete. Gate House acknowledged the King's Guard -return and accepted -whitehat's probe-ownership correction; whitehat follow-up +last completion gate was a contract-complete Whitehat return envelope, now +satisfied by message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`. Risk Nexus +disposition is complete. Gate House acknowledged the King's Guard return and +accepted whitehat's probe-ownership correction; whitehat follow-up `c33c3a72-5bf3-4693-8861-9e9ad37d5908` requests the remaining fixture-safe calibrated result without authorizing a live probe. A concrete T-06 candidate is now recorded from secrets-engine revision `4b4d556`; its implementer suite @@ -148,16 +148,26 @@ routed to risk-nexus in message `53645a75-0215-4261-a700-f7aedf09e7e8` for grading and remediation tracking. Whitehat then promoted its intake into `WHITEHAT-WP-0007` at revision `5384f05` and completed the ten-target triage. Gate House accepted the triage, class split, and result routes without contract -revision. All targets remain `pending`; T-06's blocker is under reassessment -against the supplied secrets-engine fixture candidate via message -`418fe53b-4a4b-4ebb-909e-62d206cd005f`. Review: +revision. At triage all live targets remained `pending`; T-06's fixture +blocker was reassessed against the supplied secrets-engine candidate via +message `418fe53b-4a4b-4ebb-909e-62d206cd005f`. Review: `docs/conformance/2026-09-02-whitehat-asm-triage-review.md`. Whitehat then admitted fixture-only T-06 and returned a passing known-bad calibration at revision `75deaf0`; Gate House reproduced the focused suite (53 passed). The -standalone `conformance-reporting.v1` envelope is still pending. Risk Nexus +standalone `conformance-reporting.v1` envelope was then supplied. Risk Nexus registered the qonto residual as `RISK-F-0011` (medium, public, open, no escalation) under `RISK-RULING-2026-09-02-A`, closing the finding-intake gate. Whitehat revision `6f1ca0b` now calibrates fixture harnesses for T-01 through T-10; Gate House reproduced 53/53 focused tests and recorded `no_change` to the target specification. Live targets remain `pending` / `not_run`. Review: `docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md`. + +Done — Whitehat supplied the contract-complete T-06 fixture envelope in State +Hub message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`, including engagement and +authorization references. Gate House recorded Whitehat's `pass` without +regrading it and dispositioned doctrine `no_change` in +`docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`. The live T-01 +through T-10 residuals remain `pending` / `not_run` under +`WHITEHAT-WP-0008`; they are deliberately not converted into green results. +With King's Guard's return, `RISK-F-0011`, and both Gate House dispositions +recorded, the conformance loop is staffed and GH-WP-0001 is finished.