gate-house/docs/conformance/2026-09-02-whitehat-t06-fixture-return.md

Conformance disposition — Whitehat T-06 fixture return

Repository: gate-house Status: review complete; live target remains pending Date: 2026-09-02 Contract: conformance-reporting.v1 Source: State Hub message a1ebf012-bd1e-43d2-843c-ba3ddecb8c82 Executor: whitehat-security Executor evidence revision: 75deaf0 Report/run: asm-t06-calibration-2026-09-02T08:10:37.814145Z Target: secrets-engine 4b4d556d6264a5da933f7e14aae0fe27ba1f4300 Environment: fixture Outcome: pass Gate House disposition: no_change Workplan: GH-WP-0001-T06

Returned result

Whitehat-security returned a contract-complete fixture result for Canon T-06, Approval Replay Test, against secrets_engine.approval_consume:

• specification asm-assurance-targets.v1, test T-06;
• invariant identifiers A-04, A-07, A-13, and A-15;
• engagement fixture-asm-t06;
• authorization docs/rules-of-engagement.md v0.2 §1, the accepted offline fixture authorization;
• known-bad and evidence reference evidence/offline-asm-t06-calibration.json@75deaf0;
• fixture registration targets/fixture-asm-t06.json.

The Whitehat-owned known-bad CAS disables different-digest conflict. The prohibited replay is accepted and reaches the OpenBao-call oracle, producing a finding. The same probe against the enforcing in-process CAS rejects the different-digest replay with zero OpenBao calls. Exact first use and same-digest retry remain accepted as the contract requires.

Gate House reproduced Whitehat's focused suite at the later aggregate fixture revision 6f1ca0b: 53 tests passed. Gate House copies Whitehat's result without regrading it: pass for the recorded fixture run.

Assurance bound

The returned assurance statement is bounded to the recorded attacks and conditions. This is not proof that the control always holds.

Specifically:

• the run is offline fixture evidence;
• no network, live approval-engine, OpenBao instance, reusable credential, packet, or production effect was used;
• the consume client first entered committed secrets-engine history at 4b4d556; the earlier Gate House reference to 3cd9955 was corrected;
• live asm-t06 remains pending / not_run.

Doctrine disposition

no_change.

The result exercises the published T-06 invariant and oracle without exposing an ambiguity or contradiction in Gate House doctrine. Whitehat owned the attack design, known-bad calibration, execution, and verdict. Gate House did not turn the implementer's tests into independent evidence or authorize a live probe.

Residual ownership

Whitehat-security finished WHITEHAT-WP-0007 at revision 7bc0933 and moved live T-01 through T-10 execution into WHITEHAT-WP-0008. That workplan is blocked-clean until a target owner names a component revision, identities, window, and technique and a complete dated engagement is admitted.

The live T-06 residual therefore has a durable owner and is not a Gate House foundation blocker. No live result is inferred from this fixture return.

Review triggers

Re-review T-06 when:

1. Whitehat executes a live asm-t06 engagement;
2. secrets-engine changes the consume-before-effect boundary;
3. approval-engine exposes or changes the durable consume binding;
4. the T-06 invariant, oracle, or reporting contract changes.