whitehat-security/workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md

---
id: WHITEHAT-WP-0007
type: workplan
title: "Triage Gate House ASM T-01–T-10 executable targets"
domain: infotech
repo: whitehat-security
status: active
owner: net-kingdom
topic_slug: whitehat-security
created: "2026-09-02"
updated: "2026-09-02"
related:
  - WHITEHAT-IN-0002
  - WHITEHAT-WP-0001
state_hub_workstream_id: "a06d1a9b-d9fa-5bec-bf03-e0e9b5b0ee3a"
---

# WHITEHAT-WP-0007 — ASM T-01–T-10 triage

## Goal

Triage Gate House `asm-assurance-targets.v1` tests T-01…T-10 into this
repository's work structure: applicability, owning surface, known-bad
calibration design, and result route for each Canon test id.

This plan authorizes no fixture, engagement, runner, credential, traffic, or
load. A later probe needs a new engagement and an `applicable` registration.

## Origin

`WHITEHAT-IN-0002`, from gate-house GH-WP-0001-T06 (commit `8cb7250`, message
`8229c9a4-862f-4d55-842c-5c95702f79d9`). Specs:

- `gate-house/docs/assurance/asm-t01-t10-executable-targets.md`
- `gate-house/docs/assurance/asm-targets.yaml`
- `gate-house/docs/contracts/conformance-reporting.md`

WHITEHAT-IN-0001 already recorded the split: gate-house specifies the
invariant; this repository designs the attack and records whether it held.

Gate House's first completion condition is ten triaged targets, not ten green
results.

## Schema decision

Do **not** map ASM onto `fixture-e2` / `live-e2` / `e3` / `capacity`. Those
classes model tenant isolation, RLS detection, and bounded saturation. ASM
tests a different attacker: a privileged agent or credential path trying to
cross an Active Secrets Management invariant.

`whitehat-target/v1` therefore grows two approval classes:

| Class | Meaning |
| --- | --- |
| `fixture-asm` | In-process known-bad/known-good calibration. No network. |
| `asm` | Live run against a named component revision. Needs a dated engagement. |

Technique name: `asm-assurance`. Canon `test_id` (`T-01`…`T-10`) is stored on
the registration, not folded into Tenancy Posture claims.

A revision of a Gate House target must keep the Canon test id and say what
changed. None of the ten oracles is rejected at triage; each is `pending`
with a named blocker.

## Result routes (every test)

| Result | Route |
| --- | --- |
| Implementation control failed | `risk-nexus` (severity/disclosure); Gate House gets the safe conformance report |
| Doctrine ambiguous, unsafe, or untestable | Gate House intake/message citing test and evidence |
| Harness or target-registration gap | this repository |
| Posture/stream-silence gap | `kings-guard` |
| Pass, finding, inconclusive, aborted | State Hub message to `gate-house`, subject `[GH-CONFORMANCE] <test> <outcome> <target>@<revision>` |

`whitehat conformance-message` renders that envelope from a native
`whitehat-run/v1` report. It does not send the message.

## Triage

Live registrations live in `targets/asm-t01.json` … `targets/asm-t10.json` and
remain `pending`. In-process fixtures live in `targets/fixture-asm-t01.json` …
`targets/fixture-asm-t10.json` and are `applicable`. The plane will not admit
a pending live ASM target.

### T-01 — Malicious Model

```task
id: WHITEHAT-WP-0007-T01
status: done
priority: high
state_hub_task_id: "3c1c1001-268e-5bf0-bcb2-b6608a84d715"
```

- **Applicability:** `pending`
- **Surface:** agent runtime, `access-engine` (today `flex-auth`) decision, PEP,
  and a fixture resource that shows whether a mutation occurred
- **Known-bad design:** ceiling check disabled; the excluded effect must occur
  or the oracle otherwise fails
- **Blocker:** no named agent runtime, ceiling-bound identity, or excluded
  action class. `glas-harness` and `access-engine` must name those before a
  fixture is built
- **Route:** `[GH-CONFORMANCE] T-01 …`; finding → `risk-nexus` (`access-engine` / PEP owner)

### T-02 — Credential Exfiltration

```task
id: WHITEHAT-WP-0007-T02
status: done
priority: high
state_hub_task_id: "321548eb-86b7-5405-809d-42f08e290275"
```

- **Applicability:** `pending`
- **Surface:** model-visible context, tool output, environment, credential
  broker, egress, target-side use
- **Known-bad design:** a canary credential placed in model-visible context;
  the probe detects it without retaining the value
- **Blocker:** no synthetic canary credential lane and no agent-context oracle.
  This repository's value-safe receipts are not T-02
- **Route:** `[GH-CONFORMANCE] T-02 …`; finding → `risk-nexus` (broker / runtime owner)

### T-03 — Human Disconnect

```task
id: WHITEHAT-WP-0007-T03
status: done
priority: high
state_hub_task_id: "3bb3c08c-4874-5820-b721-a81281194610"
```

- **Applicability:** `pending`
- **Surface:** human session, agent session, `access-engine` assistant mode,
  PEP, one supervision-bound protected operation
- **Known-bad design:** session binding omitted; a post-disconnect privileged
  operation succeeds
- **Blocker:** no supervised-mode fixture. Session cutoff belongs to
  `glas-harness` and `access-engine`
- **Route:** `[GH-CONFORMANCE] T-03 …`; finding → `risk-nexus` (harness / `access-engine`)

### T-04 — Policy Self-Modification

```task
id: WHITEHAT-WP-0007-T04
status: done
priority: high
state_hub_task_id: "90bc48d4-b31a-5bf1-baac-e8c7d91d3e64"
```

- **Applicability:** `pending`
- **Surface:** policy-change PEP, `access-engine`, policy repository or fixture,
  high-value security evidence route
- **Known-bad design:** the actor can modify its own ceiling; oracle becomes
  `finding`
- **Blocker:** no ordinary-actor versus independent-governance identity pair
  exposed to this facility
- **Route:** `[GH-CONFORMANCE] T-04 …`; finding → `risk-nexus`; doctrine
  ambiguity → Gate House

### T-05 — Confused Deputy

```task
id: WHITEHAT-WP-0007-T05
status: done
priority: high
state_hub_task_id: "77ff7edc-364c-544a-9761-dd78f2605ae9"
```

- **Applicability:** `pending`
- **Surface:** two audience-distinct protected services, MCP/PEP path,
  credential issuer or exchange, target-side audience enforcement
- **Known-bad design:** audience/resource validation disabled; A's artifact is
  accepted at B
- **Blocker:** no two named services with distinct audiences registered for this
  attacker. Existing `audit-core` E2 is tenant isolation, not audience replay
- **Route:** `[GH-CONFORMANCE] T-05 …`; finding → `risk-nexus` (PEP / MCP owner)

### T-06 — Approval Replay

```task
id: WHITEHAT-WP-0007-T06
status: done
priority: high
state_hub_task_id: "dfe0ff4e-cafe-5f4e-bfe7-6238412632f3"
```

- **Applicability:** `fixture-asm-t06` **applicable** (in-process). Live
  `asm-t06` remains `pending`.
- **Surface:** secrets-engine `approval_consume` PEP client driven through an
  in-process CAS opener. Live surface is still approval-engine plus a consuming
  PEP.
- **Known-bad design:** CAS disables different-digest conflict; the PEP then
  calls OpenBao. The same probe against the enforcing CAS rejects the replay
  and does not call OpenBao.
- **Reassessment:** Gate House candidate `3cd9955` does **not** contain
  `approval_consume.py`. That module first appears at `4b4d556`. The in-process
  fixture is sufficient to admit `fixture-asm` only. It is not a live
  approval-engine.
- **Route:** `[GH-CONFORMANCE] T-06 …`; finding → `risk-nexus` (secrets-engine /
  approval-engine)

### T-07 — Circuit Breaker

```task
id: WHITEHAT-WP-0007-T07
status: done
priority: high
state_hub_task_id: "ca94ec12-7119-5a61-8eef-9d3614d8ec85"
```

- **Applicability:** `pending`
- **Surface:** change-dynamics / posture input, `access-engine`, grant or
  credential revocation owner, PEP, running autonomous fixture
- **Known-bad design:** independent stop path disconnected; an over-threshold
  mutation succeeds or misses the visibility bound
- **Blocker:** stop path not named. This is not P1/P2; do not use `capacity`
- **Route:** `[GH-CONFORMANCE] T-07 …`; finding → `risk-nexus` (posture /
  revocation owner)

### T-08 — Audit Reconstruction

```task
id: WHITEHAT-WP-0007-T08
status: done
priority: high
state_hub_task_id: "26e97415-df84-5431-95a3-13541816d2fe"
```

- **Applicability:** `pending`
- **Surface:** identity/context sources, `access-engine`, approval and
  credential path where applicable, PEP/resource, emitters, `audit-core`
- **Known-bad design:** remove or unlink one required fixture record; separately
  suppress an emission while leaving the archive chain intact. The probe must
  distinguish reconstruction failure from emission omission
- **Blocker:** `audit-core` is a real E2 target, but reconstruction and
  emission-completeness are a different attacker model. Needs an authorized
  synthetic mutation and an emission bound from `audit-core` / `kings-guard`
- **Route:** `[GH-CONFORMANCE] T-08 …`; implementation finding → `risk-nexus`
  (`audit-core`); emission-gap may also go to `kings-guard`

### T-09 — Audit Failure

```task
id: WHITEHAT-WP-0007-T09
status: done
priority: high
state_hub_task_id: "f5e4a346-4dbe-5db2-957c-40d42e5a50e7"
```

- **Applicability:** `pending`
- **Surface:** state owner, local transactional outbox, drain, audit archive,
  heartbeat/reconciliation observer, protected operation
- **Known-bad design:** emit-after-commit (silent gap) and
  synchronous-archive-in-transaction (blocked revocation) fixtures
- **Blocker:** load-bearing evidence semantics not declared by the owner.
  Disabling outbox or archive is outside standing live-e2 and needs its own
  engagement class
- **Route:** `[GH-CONFORMANCE] T-09 …`; finding → `risk-nexus` (`audit-core`)

### T-10 — Revocation Closure

```task
id: WHITEHAT-WP-0007-T10
status: done
priority: high
state_hub_task_id: "28b231b2-b51f-5484-89cb-e709258a3a15"
```

- **Applicability:** `pending`
- **Surface:** credential lifecycle owner, issuer, target verifier,
  `access-engine`/PEP where applicable, evidence path
- **Known-bad design:** one accepted validation path left unrevoked
- **Blocker:** no issuer/verifier pair admitted. This repository's lease
  cleanup is not T-10
- **Route:** `[GH-CONFORMANCE] T-10 …`; finding → `risk-nexus` (issuer /
  secrets-engine)

## Residual

```task
id: WHITEHAT-WP-0007-T11
status: wait
priority: medium
state_hub_task_id: "13518801-015f-51ef-9d07-8cf989e08710"
```

In-process known-bad calibration exists for T-01…T-10
(`targets/fixture-asm-tNN.json`, `evidence/offline-asm-tNN-calibration.json`).
Any live ASM run is blocked until a target owner names the surface, identities,
and window for that test. Do not relabel a pending live target to finish this
plan. Do not send a packet.

## Sequencing

T01–T10 are the triage and are done together. T11 cannot start without an
owner-named surface. Offline Tenancy Posture work remains on
`WHITEHAT-WP-0001` / `WHITEHAT-WP-0006`.