tegwick
c0c25e7056
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
79 lines
3.1 KiB
Markdown
79 lines
3.1 KiB
Markdown
# Conformance coordination review — whitehat ASM triage
|
|
|
|
**Repository:** gate-house
|
|
**Status:** triage accepted; T-06 blocker reassessment pending
|
|
**Date:** 2026-09-02
|
|
**Executor:** whitehat-security
|
|
**Executor workplan:** WHITEHAT-WP-0007
|
|
**Executor triage revision:** `5384f05`
|
|
**Observed repository revision:** `75b79a0`
|
|
**Gate House workplan:** GH-WP-0001-T06
|
|
|
|
## Returned triage
|
|
|
|
Whitehat-security promoted `WHITEHAT-IN-0002` into `WHITEHAT-WP-0007` and
|
|
triaged Canon T-01 through T-10. Each test now has:
|
|
|
|
- an applicability state;
|
|
- an owning surface;
|
|
- a whitehat-owned known-bad design;
|
|
- a named blocker;
|
|
- a conformance and implementation-finding route.
|
|
|
|
Whitehat also kept ASM separate from its tenancy and capacity attacker models.
|
|
`whitehat-target/v1` now distinguishes:
|
|
|
|
- `fixture-asm` for in-process known-bad/known-good calibration without a
|
|
network; and
|
|
- `asm` for a live run against a named revision under a dated engagement.
|
|
|
|
Gate House accepts the ten-target triage, the class split, and the result
|
|
routes without revising `asm-assurance-targets.v1` or
|
|
`conformance-reporting.v1`.
|
|
|
|
## Evidence bound
|
|
|
|
All ten registrations remain `pending`. T-01 through T-10 being triaged does
|
|
not mean they ran, passed, failed, or conform. `WHITEHAT-WP-0007-T11` remains
|
|
`wait` for a target-owner-named surface and a later engagement.
|
|
|
|
Fixture calibration has now returned for all ten targets. Gate House continues
|
|
to record every live ASM target as `not_run` for doctrine-review purposes.
|
|
|
|
## T-06 reassessment
|
|
|
|
Whitehat's T-06 registration names this blocker:
|
|
|
|
> No synthetic approval fixture and no admitted consumption contract in this
|
|
> plane.
|
|
|
|
That statement must be reassessed against evidence supplied before the triage
|
|
revision:
|
|
|
|
- Gate House candidate message `cc19a1c4-2acf-448d-b90f-e9843a57a7d4`;
|
|
- Gate House candidate record at commit `e04a8b7`;
|
|
- secrets-engine implementation revision `4b4d556`;
|
|
- a mock-HTTP approval-consume fixture whose focused suite passed 17/17;
|
|
- Gate House's normative approval-consumption contract.
|
|
|
|
Gate House does not decide that this evidence is sufficient for admission.
|
|
Whitehat-security owns that decision. Gate House asked Whitehat either to admit
|
|
only T-06 as `fixture-asm` and author its known-bad calibration, or to preserve
|
|
`pending` and name the smallest missing artifact. Review message:
|
|
`418fe53b-4a4b-4ebb-909e-62d206cd005f`.
|
|
|
|
No live target, credential, approval service, packet, OpenBao call, or effect is
|
|
authorized by this review.
|
|
|
|
Whitehat subsequently admitted the fixture-only T-06 surface and returned a
|
|
known-bad calibration at revision `75deaf0`. Gate House reproduced the focused
|
|
Whitehat suite (53 passed) and accepted Whitehat's correction that the consume
|
|
module first entered committed secrets-engine history at `4b4d556`. Whitehat
|
|
then supplied the formal `conformance-reporting.v1` envelope in message
|
|
`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`.
|
|
|
|
## Completion effect
|
|
|
|
The target-triage and acknowledgement portion of GH-WP-0001-T06 is complete.
|
|
The harness-calibration and reporting portions are complete. Live execution
|
|
remains separate residual work under `WHITEHAT-WP-0008`.
|