coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish GH-WP-0001 conformance loop

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
This commit is contained in:
tegwick 2026-09-02 15:49:25 +02:00
parent 18ec61a696
commit c0c25e7056
7 changed files with 158 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/conformance/2026-09-02-secrets-engine-t06-candidate.md
View file

@ -1,7 +1,7 @@
# Conformance candidate — secrets-engine approval consumption
**Repository:** gate-house
**Status:** candidate; not executed by whitehat-security
**Status:** promoted into Whitehat fixture calibration; live target pending
**Date:** 2026-09-02
**Canon target:** T-06 — Approval Replay Test
**Implementer:** secrets-engine
@ -45,18 +45,15 @@ inferred from the surrounding workplan history. Gate House accepts that
correction. The initial test count remains a working-tree suitability check;
the immutable candidate revision is `4b4d556`.
## What whitehat-security must still supply
## Whitehat return
Whitehat-security owns the probe design and outcome. A conforming return still
requires all of the following under `conformance-reporting.v1`:
Whitehat-security supplied the fixture-only probe, known-bad calibration, and
contract-complete return under `conformance-reporting.v1`:
1. independently identify the exact target revision and fixture boundary;
2. author a known-bad fixture that disables at least one replay protection,
such as different-digest conflict or atomic single-use consumption;
3. demonstrate that the known-bad fixture accepts a prohibited replay or loses
the T-06 oracle;
4. run the same probe against the unmodified candidate;
5. return `pass`, `fail`, `blocked`, or `not_run` with safe evidence references.
- Whitehat evidence revision `75deaf0`;
- return message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`;
- final Gate House review
`docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`.
The existing implementer tests may be reused as setup evidence but must not be
reported as independent Whitehat evidence.

12
docs/conformance/2026-09-02-whitehat-asm-fixture-calibrations.md
View file

@ -66,11 +66,9 @@ exposed an ambiguous, contradictory, or untestable Gate House target. This
disposition accepts the harness/specification fit only; it does not convert
fixture outcomes into live conformance.
## Reporting residual
The standalone T-06 return has the required subject and safe evidence
reference, but its message/artifact pair does not yet express the engagement
and authorization references required by `conformance-reporting.v1`. Gate
House requested a reporting-only correction in reply
`07572202-c855-4235-8289-5a3d9c8f28ae`; no rerun or live target is required.
## Reporting closure
Whitehat supplied the complete T-06 envelope, including engagement and
authorization references, in message
`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`. Final review:
`docs/conformance/2026-09-02-whitehat-t06-fixture-return.md`.

11
docs/conformance/2026-09-02-whitehat-asm-triage-review.md
View file

@ -68,13 +68,12 @@ authorized by this review.
Whitehat subsequently admitted the fixture-only T-06 surface and returned a
known-bad calibration at revision `75deaf0`. Gate House reproduced the focused
Whitehat suite (53 passed) and accepted Whitehat's correction that the consume
module first entered committed secrets-engine history at `4b4d556`. A formal
`conformance-reporting.v1` envelope remains pending; the triage-thread reply is
not substituted for that durable return.
module first entered committed secrets-engine history at `4b4d556`. Whitehat
then supplied the formal `conformance-reporting.v1` envelope in message
`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`.
## Completion effect
The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete.
The harness-calibration portion is also substantively complete. The reporting
portion remains open until Whitehat supplies the missing contract fields for
the T-06 return.
The harness-calibration and reporting portions are complete. Live execution
remains separate residual work under `WHITEHAT-WP-0008`.

83
docs/conformance/2026-09-02-whitehat-t06-fixture-return.md Normal file
View file

@ -0,0 +1,83 @@
# Conformance disposition — Whitehat T-06 fixture return
**Repository:** gate-house
**Status:** review complete; live target remains pending
**Date:** 2026-09-02
**Contract:** `conformance-reporting.v1`
**Source:** State Hub message `a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`
**Executor:** whitehat-security
**Executor evidence revision:** `75deaf0`
**Report/run:** `asm-t06-calibration-2026-09-02T08:10:37.814145Z`
**Target:** secrets-engine `4b4d556d6264a5da933f7e14aae0fe27ba1f4300`
**Environment:** fixture
**Outcome:** `pass`
**Gate House disposition:** `no_change`
**Workplan:** GH-WP-0001-T06
## Returned result
Whitehat-security returned a contract-complete fixture result for Canon T-06,
Approval Replay Test, against `secrets_engine.approval_consume`:
- specification `asm-assurance-targets.v1`, test `T-06`;
- invariant identifiers `A-04`, `A-07`, `A-13`, and `A-15`;
- engagement `fixture-asm-t06`;
- authorization `docs/rules-of-engagement.md v0.2 §1`, the accepted offline
fixture authorization;
- known-bad and evidence reference
`evidence/offline-asm-t06-calibration.json@75deaf0`;
- fixture registration `targets/fixture-asm-t06.json`.
The Whitehat-owned known-bad CAS disables different-digest conflict. The
prohibited replay is accepted and reaches the OpenBao-call oracle, producing a
`finding`. The same probe against the enforcing in-process CAS rejects the
different-digest replay with zero OpenBao calls. Exact first use and
same-digest retry remain accepted as the contract requires.
Gate House reproduced Whitehat's focused suite at the later aggregate fixture
revision `6f1ca0b`: 53 tests passed. Gate House copies Whitehat's result without
regrading it: `pass` for the recorded fixture run.
## Assurance bound
The returned assurance statement is bounded to the recorded attacks and
conditions. This is not proof that the control always holds.
Specifically:
- the run is offline fixture evidence;
- no network, live approval-engine, OpenBao instance, reusable credential,
packet, or production effect was used;
- the consume client first entered committed secrets-engine history at
`4b4d556`; the earlier Gate House reference to `3cd9955` was corrected;
- live `asm-t06` remains `pending` / `not_run`.
## Doctrine disposition
`no_change`.
The result exercises the published T-06 invariant and oracle without exposing
an ambiguity or contradiction in Gate House doctrine. Whitehat owned the
attack design, known-bad calibration, execution, and verdict. Gate House did
not turn the implementer's tests into independent evidence or authorize a live
probe.
## Residual ownership
Whitehat-security finished `WHITEHAT-WP-0007` at revision `7bc0933` and moved
live T-01 through T-10 execution into `WHITEHAT-WP-0008`. That workplan is
blocked-clean until a target owner names a component revision, identities,
window, and technique and a complete dated engagement is admitted.
The live T-06 residual therefore has a durable owner and is not a Gate House
foundation blocker. No live result is inferred from this fixture return.
## Review triggers
Re-review T-06 when:
1. Whitehat executes a live `asm-t06` engagement;
2. secrets-engine changes the consume-before-effect boundary;
3. approval-engine exposes or changes the durable consume binding;
4. the T-06 invariant, oracle, or reporting contract changes.

15
docs/conformance/README.md
View file

@ -21,18 +21,21 @@ Returned reviews:
origin-linked advisory observation is staffed for one lane; load-bearing deny
stream completeness remains unknown; doctrine disposition `no_change`.
Fixture-safe candidates awaiting independent execution:
- [`2026-09-02 — Whitehat T-06 fixture return`](2026-09-02-whitehat-t06-fixture-return.md):
fixture-class approval-replay result `pass`; live `asm-t06` remains
`pending` / `not_run`; doctrine disposition `no_change`.
Fixture-safe candidates and promotions:
- [`2026-09-02 — secrets-engine T-06 approval-consumption candidate`](2026-09-02-secrets-engine-t06-candidate.md):
the implementer's focused suite passes, but no whitehat-owned known-bad
calibration or verdict has returned.
promoted into Whitehat's fixture-only T-06 calibration; the live target
remains pending.
Coordination reviews:
- [`2026-09-02 — whitehat ASM triage review`](2026-09-02-whitehat-asm-triage-review.md):
all ten targets are triaged and remain `pending`; Gate House accepted the
class split and routes while requesting reassessment of one stale T-06
blocker.
all ten targets were triaged; Gate House accepted the class split and routes,
and the T-06 reassessment produced the fixture return above.
Fixture calibration reviews: