Finish WHITEHAT-WP-0001 and own live residuals in WP-0006

Close T05 and T06 on the same applicable-target rule as T03: E3 cadence
and in-process calibration, platform-pg not_applicable, P1/P2 evaluator
proven against known-good and known-bad samples. Persist offline capacity
calibration. Live E3, P1/P2, flex-auth E2, and a later audit-core run
move to WHITEHAT-WP-0006, which authorizes no packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

workplans/WHITEHAT-WP-0006-authorized-live-residuals.md

@@ -0,0 +1,82 @@
+---
+id: WHITEHAT-WP-0006
+type: workplan
+title: "Authorized live residuals after WHITEHAT-WP-0001"
+domain: infotech
+repo: whitehat-security
+status: blocked
+owner: net-kingdom
+topic_slug: whitehat-security
+created: "2026-09-01"
+updated: "2026-09-01"
+related:
+  - WHITEHAT-WP-0001
+---
+
+# WHITEHAT-WP-0006 — authorized live residuals
+
+## Goal
+
+Own the live evidence work that `WHITEHAT-WP-0001` correctly did not run:
+E3 against a runtime-safe database surface, P1/P2 against a bounded substrate
+window, flex-auth E2 once the attacker identity exists, and a later audit-core
+E2 run under a new engagement ID.
+
+This plan authorizes no engagement, runner, credential, traffic, or load.
+
+## Origin
+
+`WHITEHAT-WP-0001` finished on 2026-09-01. Its applicable artifacts are
+offline E2/E3/P1/P2 calibration, the `audit-core` E2 pass
+`WH-ENG-20260822-AUDIT-E2-03`, and honest `not_applicable` / `pending` target
+records. Live residuals must not remain only in that plan's prose.
+
+## Tasks
+
+### T01 — Live E3 against a runtime-safe surface
+
+```task
+id: WHITEHAT-WP-0006-T01
+status: wait
+priority: medium
+```
+
+Blocked until a named database exposes an ordinary runtime identity that can
+read the conformance view without `BYPASSRLS`, superuser or owner privilege,
+and until a complete engagement record names the database, window, rate
+ceiling, abort contact and finding destination. `platform-pg` stays
+`not_applicable` until that identity exists. Do not open a database
+connection to finish this task.
+
+### T02 — Live P1/P2 against a bounded substrate window
+
+```task
+id: WHITEHAT-WP-0006-T02
+status: wait
+priority: medium
+```
+
+Blocked until an operator-approved substrate window names the aggressor
+consumer, allowance, concurrency/resource ceilings, service classes, headroom
+threshold and abort thresholds. `shared-substrate` stays `pending` until that
+window exists. Do not generate load to finish this task.
+
+### T03 — Remaining E2 under new engagement IDs
+
+```task
+id: WHITEHAT-WP-0006-T03
+status: wait
+priority: medium
+```
+
+Blocked until either `flex-auth` names a confirmed tenant-A identity with no
+tenant-B authority, or a later `audit-core` run is approved under a **new**
+engagement ID. `WH-ENG-20260822-AUDIT-E2-01`, `-02` and `-03` are terminal and
+must not be reused. `tenant-engine` stays `not_applicable`. Do not send a
+packet to finish this task.
+
+## Sequencing
+
+None of these tasks starts without the engagement record and approvals
+required by the rules of engagement §1 plus plane admission. T01, T02 and T03
+are independent. Offline fixture work stays on `WHITEHAT-WP-0001`.