Finish WHITEHAT-WP-0001 and own live residuals in WP-0006

Close T05 and T06 on the same applicable-target rule as T03: E3 cadence
and in-process calibration, platform-pg not_applicable, P1/P2 evaluator
proven against known-good and known-bad samples. Persist offline capacity
calibration. Live E3, P1/P2, flex-auth E2, and a later audit-core run
move to WHITEHAT-WP-0006, which authorizes no packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

src/whitehat_security/capacity.py

@@ -1,8 +1,8 @@
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import asdict, dataclass
 
-from .model import Outcome
+from .model import Outcome, utc_now
 
 
 @dataclass(frozen=True)
@@ -71,3 +71,63 @@ def _decrease(before: float, after: float) -> float:
     if before == 0:
         return 0.0
     return round((before - after) / before * 100, 3)
+
+
+def _case(name: str, result: CapacityResult) -> dict:
+    payload = asdict(result)
+    payload["case"] = name
+    return payload
+
+
+def capacity_calibration() -> dict:
+    """In-process known-good/known-bad outcomes. Generates no load."""
+    started = utc_now()
+    baseline = [
+        CapacitySample("aggressor", 10, 0, 100),
+        CapacitySample("neighbour", 12, 0, 80),
+    ]
+    loaded = [
+        CapacitySample("aggressor", 25, 0.01, 120),
+        CapacitySample("neighbour", 18, 0.02, 60),
+    ]
+    good = characterize(
+        baseline=baseline, loaded=loaded, governor_bound=True,
+        aggressor_peak=10, aggressor_ceiling=10,
+    )
+    unbound = characterize(
+        baseline=baseline, loaded=loaded, governor_bound=False,
+        aggressor_peak=10, aggressor_ceiling=10,
+    )
+    exceeded = characterize(
+        baseline=baseline, loaded=loaded, governor_bound=True,
+        aggressor_peak=11, aggressor_ceiling=10,
+    )
+    missing = characterize(
+        baseline=baseline, loaded=[loaded[0]], governor_bound=True,
+        aggressor_peak=10, aggressor_ceiling=10,
+    )
+    ok = (
+        good.outcome == "pass"
+        and unbound.outcome == "finding"
+        and exceeded.outcome == "aborted"
+        and missing.outcome == "finding"
+    )
+    return {
+        "schema_version": "whitehat-capacity-calibration/v1",
+        "evidence_class": "fixture",
+        "run_id": f"capacity-calibration-{started}",
+        "started_at": started,
+        "ended_at": utc_now(),
+        "outcome": "pass" if ok else "finding",
+        "known_good": [_case("governor_bound_within_ceiling", good)],
+        "known_bad": [
+            _case("unbound_governor", unbound),
+            _case("exceeded_ceiling", exceeded),
+            _case("missing_neighbour", missing),
+        ],
+        "limitations": [
+            "Offline capacity calibration evaluates the harness; it is not target assurance.",
+            "No network load, database connection, or live credential was used.",
+            "Zero neighbour degradation is not an expected assertion on shared infrastructure.",
+        ],
+    }

src/whitehat_security/cli.py

@@ -7,7 +7,7 @@ from dataclasses import asdict
 from pathlib import Path
 
 from .audit_fixtures import AuditFixture, audit_probe_suite
-from .capacity import CapacitySample, characterize
+from .capacity import capacity_calibration
 from .differential import execute
 from .e3 import CADENCE, PROBES, e3_calibration
 from .engagement import AuthorizationError, Engagement
@@ -46,21 +46,6 @@ def fixture_calibration() -> dict:
     }
 
 
-def capacity_fixture() -> dict:
-    baseline = [
-        CapacitySample("aggressor", 10, 0, 100),
-        CapacitySample("neighbour", 12, 0, 80),
-    ]
-    loaded = [
-        CapacitySample("aggressor", 25, 0.01, 120),
-        CapacitySample("neighbour", 18, 0.02, 60),
-    ]
-    return asdict(characterize(
-        baseline=baseline, loaded=loaded, governor_bound=True,
-        aggressor_peak=10, aggressor_ceiling=10,
-    ))
-
-
 def validate_pack(path: Path) -> None:
     data = json.loads(path.read_text(encoding="utf-8"))
     required = {"schema_version", "target", "posture_claim", "attacker_model", "probes"}
@@ -113,7 +98,10 @@ def main(argv: list[str] | None = None) -> None:
     commands.add_parser("e3-plan")
     e3_fix = commands.add_parser("e3-fixtures", help="calibrate E3 probes offline")
     e3_fix.add_argument("--output")
-    commands.add_parser("capacity-fixture")
+    capacity_fix = commands.add_parser(
+        "capacity-fixture", help="calibrate P1/P2 evaluator offline"
+    )
+    capacity_fix.add_argument("--output")
     message = commands.add_parser("risk-message")
     message.add_argument("report")
     args = parser.parse_args(argv)
@@ -220,8 +208,13 @@ def main(argv: list[str] | None = None) -> None:
             print(rendered, end="")
         raise SystemExit(0 if result["outcome"] == "pass" else 1)
     if args.command == "capacity-fixture":
-        print(json.dumps(capacity_fixture(), indent=2, sort_keys=True))
-        return
+        result = capacity_calibration()
+        rendered = json.dumps(result, indent=2, sort_keys=True) + "\n"
+        if args.output:
+            Path(args.output).write_text(rendered, encoding="utf-8")
+        else:
+            print(rendered, end="")
+        raise SystemExit(0 if result["outcome"] == "pass" else 1)
     if args.command == "risk-message":
         report = RunReport(**json.loads(Path(args.report).read_text(encoding="utf-8")))
         print(risk_nexus_message(report), end="")