Promote ASM T-01–T-10 into WHITEHAT-WP-0007 and triage each test

Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto
E2, E3, or capacity. Register all ten Canon tests as pending with named
blockers, known-bad designs, and result routes. Add a value-safe
conformance-message renderer. Authorizes no probe.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

docs/reporting.md

@@ -24,6 +24,17 @@ Queue a target report without assigning severity:
 PYTHONPATH=src python3 -m whitehat_security.cli deliver evidence/<run>.json --outbox outbox
 ```
 
+Gate House ASM returns use a separate envelope. Render it with:
+
+```sh
+PYTHONPATH=src python3 -m whitehat_security.cli conformance-message evidence/<run>.json \
+  --spec asm-assurance-targets.v1 --test-id T-01 --component access-engine
+```
+
+That command does not send the message. Subject form:
+`[GH-CONFORMANCE] <test> <outcome> <target>@<revision>`. Implementation
+findings still go to `risk-nexus`.
+
 Offline calibration stays in this repository and is plainly labeled
 `evidence_class: fixture`; it is not sent as if it were a target result. The
 deliver command refuses fixture evidence.

docs/rules-of-engagement.md

@@ -144,13 +144,16 @@ Live runs are admitted only through the test plane documented in
 projected short-lived identities, registered target, kill switch, rate watcher
 and lease cleanup. The plane is a control, not authorization.
 
-`fixture-e2`, `fixture-e3` and `fixture-capacity` are in-process classes
-already permitted by §1. `live-e2` still requires the dated engagement
-record, target-owner acknowledgement and technique-specific operator approval
-required by §1, plus plane admission. Live `e3` additionally names the
-database and uses one ordinary runtime role with no `BYPASSRLS`. Live
-`capacity` additionally names an aggressor ceiling and a substrate window.
-Recovery and destructive techniques remain outside this plane.
+`fixture-e2`, `fixture-e3`, `fixture-capacity` and `fixture-asm` are
+in-process classes already permitted by §1 once a registration is
+`applicable`. No ASM registration is applicable yet. `live-e2` still requires
+the dated engagement record, target-owner acknowledgement and
+technique-specific operator approval required by §1, plus plane admission.
+Live `e3` additionally names the database and uses one ordinary runtime role
+with no `BYPASSRLS`. Live `capacity` additionally names an aggressor ceiling
+and a substrate window. Live `asm` additionally names the Canon `test_id` and
+component revision. Recovery, archive-disable and other destructive
+techniques remain outside this plane.
 
 Cancelled engagement identifiers are terminal and must not be reused.
 

docs/test-plane.md

@@ -12,7 +12,8 @@ A live E2 run is admitted only when every item below is true:
 3. The engagement is complete, in window, owner-acknowledged, and not a
    retired ID.
 4. `approval_class` matches the registration (`fixture-e2` / `live-e2` /
-   `fixture-e3` / `e3` / `fixture-capacity` / `capacity`).
+   `fixture-e3` / `e3` / `fixture-capacity` / `capacity` / `fixture-asm` /
+   `asm`).
 5. The runner namespace is `whitehat`, the image digest is pinned, and
    engagement labels are present. Live E3 also names a `database`. Live
    capacity also names an `aggressor_ceiling`.
@@ -33,6 +34,7 @@ requested.
 - Not a secret broker. `UnconnectedCustodyBroker` is the default for every
   non-fixture environment and raises before any custody call.
 - Not a way to finish tenant-engine E2. That target is `not_applicable`.
+- Not a way to run ASM T-01…T-10. Those registrations are `pending`.
 
 ## Operator commands