Promote ASM T-01–T-10 into WHITEHAT-WP-0007 and triage each test

Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto
E2, E3, or capacity. Register all ten Canon tests as pending with named
blockers, known-bad designs, and result routes. Add a value-safe
conformance-message renderer. Authorizes no probe.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

src/whitehat_security/cli.py

@@ -15,7 +15,7 @@ from .fixtures import FixtureService, probe_suite
 from .model import RunReport, utc_now
 from .plane import KillSwitch, admit, default_broker, retired_ids
 from .platform_custody import broker_from_receipt, finalize_run_report
-from .reporting import queue_risk_nexus, risk_nexus_message
+from .reporting import conformance_message, queue_risk_nexus, risk_nexus_message
 from .targets import load_catalog, load_registration
 
 
@@ -104,6 +104,14 @@ def main(argv: list[str] | None = None) -> None:
     capacity_fix.add_argument("--output")
     message = commands.add_parser("risk-message")
     message.add_argument("report")
+    conformance = commands.add_parser(
+        "conformance-message", help="render a Gate House conformance envelope"
+    )
+    conformance.add_argument("report")
+    conformance.add_argument("--spec", required=True)
+    conformance.add_argument("--test-id", required=True)
+    conformance.add_argument("--component")
+    conformance.add_argument("--invariants", default="")
     args = parser.parse_args(argv)
 
     if args.command == "fixtures":
@@ -219,6 +227,14 @@ def main(argv: list[str] | None = None) -> None:
         report = RunReport(**json.loads(Path(args.report).read_text(encoding="utf-8")))
         print(risk_nexus_message(report), end="")
         return
+    if args.command == "conformance-message":
+        report = RunReport(**json.loads(Path(args.report).read_text(encoding="utf-8")))
+        invariants = [item for item in args.invariants.split(",") if item]
+        print(conformance_message(
+            report, specification=args.spec, test_id=args.test_id,
+            component=args.component, invariant_ids=invariants or None,
+        ), end="")
+        return
     raise SystemExit(2)
 
 

src/whitehat_security/plane.py

@@ -26,8 +26,12 @@ APPROVAL_CLASSES = {
     "e3": frozenset({"e3-rls"}),
     "fixture-capacity": frozenset({"p1-noisy-neighbour", "p2-noisy-neighbour"}),
     "capacity": frozenset({"p1-noisy-neighbour", "p2-noisy-neighbour"}),
+    "fixture-asm": frozenset({"asm-assurance"}),
+    "asm": frozenset({"asm-assurance"}),
 }
-FIXTURE_CLASSES = frozenset({"fixture-e2", "fixture-e3", "fixture-capacity"})
+FIXTURE_CLASSES = frozenset({
+    "fixture-e2", "fixture-e3", "fixture-capacity", "fixture-asm",
+})
 
 
 def repo_root() -> Path:

src/whitehat_security/reporting.py

@@ -33,6 +33,47 @@ def risk_nexus_message(report: RunReport) -> str:
     return "\n".join(lines) + "\n"
 
 
+def conformance_message(
+    report: RunReport,
+    *,
+    specification: str,
+    test_id: str,
+    component: str | None = None,
+    invariant_ids: list[str] | None = None,
+) -> str:
+    """Render a value-safe Gate House conformance envelope. Does not send it."""
+    target = component or report.target
+    subject = (
+        f"[GH-CONFORMANCE] {test_id} {report.outcome} "
+        f"{target}@{report.target_revision}"
+    )
+    lines = [
+        f"Subject: {subject}",
+        "",
+        f"- specification: `{specification}` test `{test_id}`",
+        f"- report/run: `{report.run_id}`",
+        f"- engagement/authorization: `{report.engagement_id}` / `{report.authorization_id}`",
+        f"- target: `{target}` at `{report.target_revision}`",
+        f"- environment/class: `{report.evidence_class}`",
+        f"- outcome: `{report.outcome}`",
+        f"- attempted operations: {report.attempted_operations}",
+        f"- interval: {report.started_at} to {report.ended_at}",
+    ]
+    if invariant_ids:
+        lines.append("- invariants: " + ", ".join(f"`{item}`" for item in invariant_ids))
+    lines.extend([
+        "",
+        report.assurance_statement,
+        "",
+        "Implementation findings route to risk-nexus. This envelope is the "
+        "doctrine-return copy only. It contains no credential, response body, "
+        "or severity.",
+    ])
+    if report.evidence_class == "fixture":
+        lines.extend(["", "Fixture calibration is not target assurance."])
+    return "\n".join(lines) + "\n"
+
+
 def queue_risk_nexus(report: RunReport, outbox: str | Path) -> Path:
     """Persist a delivery artifact. Fixture calibration is not target assurance."""
     if report.evidence_class == "fixture":

src/whitehat_security/targets.py

@@ -45,6 +45,10 @@ def load_registration(path: str | Path) -> dict[str, Any]:
             raise AuthorizationError(f"{path}: E3 registration must project one runtime identity")
         if classes & {"fixture-capacity", "capacity"} and count not in {0, 1}:
             raise AuthorizationError(f"{path}: capacity registration projects at most one aggressor identity")
+        if classes & {"fixture-asm", "asm"} and count not in {0, 1, 2}:
+            raise AuthorizationError(f"{path}: ASM registration projects at most two identities")
+        if classes & {"fixture-asm", "asm"} and not data.get("test_id"):
+            raise AuthorizationError(f"{path}: ASM registration must preserve a Canon test_id")
         if count and identities.get("ttl_seconds", 0) > 900:
             raise AuthorizationError(f"{path}: identity TTL must be at most 900 seconds")
         if data.get("known_bad_calibration") in {None, "", "pending"}: