tegwick
d97e8efa6e
Four findings returned so far, all from access-engine and approval-engine. F1 is the serious one: GH-DEC-2026-008 as written mandated a comparison that could never pass, because a claim travelling inside a hashed request cannot name the digest of the request containing it. A fail-closed consumer obeying it would have denied destroy permanently — the ruling and its own fail-closed requirement compounded rather than cancelled. Ruling and its four obligations stand; the comparison target is corrected to the PDP's published exclusion-scoped digest, verified in flex-auth's schema and canonical.go before amending. A consumer must not guess the exclusion rule, and until a PDP publishes one the path is fail-closed rather than complete. F2 adds the general property access-engine flagged as a near miss it was not asking to have written: an evidence-bearing input may be excluded from a correspondence digest but never from the replay identity. The round record notes what this says about the process. GH-DEC-2026-008 was correct in substance, argued from doctrine, and verified against another repository's schema before issue — and none of that caught a defect three repositories found within hours of building on it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 425128@bnt-lap001 Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63 |
||
|---|---|---|
| .. | ||
| 2026-09-02-kings-guard-qonto-live-observation.md | ||
| 2026-09-02-secrets-engine-t06-candidate.md | ||
| 2026-09-02-whitehat-asm-fixture-calibrations.md | ||
| 2026-09-02-whitehat-asm-triage-review.md | ||
| 2026-09-02-whitehat-t06-fixture-return.md | ||
| 2026-09-06-v06-findings-audit.md | ||
| 2026-09-06-v08-assent-round.md | ||
| README.md | ||
Conformance review register
Gate House records doctrine dispositions for returned assurance and posture reports here. This directory does not hold raw exploit evidence, credential values, severity decisions, or another repository's remediation tasks.
Normative inputs:
A review record names the external report and safe evidence references, copies the executor's outcome without changing it, records Gate House's doctrine disposition, and links every residual to a live owner.
Returned reviews:
-
2026-09-02 — kings-guard qonto live observation: origin-linked advisory observation is staffed for one lane; load-bearing deny stream completeness remains unknown; doctrine dispositionno_change. -
2026-09-02 — Whitehat T-06 fixture return: fixture-class approval-replay resultpass; liveasm-t06remainspending/not_run; doctrine dispositionno_change.
Fixture-safe candidates and promotions:
2026-09-02 — secrets-engine T-06 approval-consumption candidate: promoted into Whitehat's fixture-only T-06 calibration; the live target remains pending.
Coordination reviews:
2026-09-02 — whitehat ASM triage review: all ten targets were triaged; Gate House accepted the class split and routes, and the T-06 reassessment produced the fixture return above.
Fixture calibration reviews:
2026-09-02 — Whitehat ASM T-01–T-10 fixture calibrations: all known-bad fixtures produce findings and known-good fixtures pass; live targets remainpending/not_run; doctrine dispositionno_change.
No live whitehat-security ASM execution report has returned under
conformance-reporting.v1. The live target set remains not_run, not
conformance.