Promote ASM T-01–T-10 into WHITEHAT-WP-0007 and triage each test

Extend whitehat-target/v1 with fixture-asm/asm instead of mapping onto
E2, E3, or capacity. Register all ten Canon tests as pending with named
blockers, known-bad designs, and result routes. Add a value-safe
conformance-message renderer. Authorizes no probe.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

tests/test_cli.py

@@ -18,7 +18,7 @@ def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
 
 def test_validate_targets_accepts_catalog(capsys):
     main(["validate-targets", "targets"])
-    assert capsys.readouterr().out.startswith("validated 8 target registrations")
+    assert capsys.readouterr().out.startswith("validated 18 target registrations")
 
 
 def test_kill_switch_is_clear_by_default(capsys):

tests/test_e3_capacity_reporting.py

@@ -1,7 +1,7 @@
 from whitehat_security.capacity import CapacitySample, capacity_calibration, characterize
 from whitehat_security.e3 import PROBES, evaluate
 from whitehat_security.model import RunReport
-from whitehat_security.reporting import risk_nexus_message
+from whitehat_security.reporting import conformance_message, risk_nexus_message
 
 
 def test_e3_expected_failures_are_findings_and_limit_is_not():
@@ -65,6 +65,26 @@ def test_risk_message_contains_pass_and_no_severity():
     assert "not proof" in message
 
 
+def test_conformance_message_uses_canon_test_id_and_omits_severity():
+    report = RunReport(
+        schema_version="whitehat-run/v1", run_id="run-asm-1", evidence_class="target",
+        engagement_id="eng-1", authorization_id="auth-1", target="access-engine",
+        target_revision="abc", posture_claim="ASM T-01", attacker_model="ASM",
+        started_at="2026-09-02T00:00:00Z", ended_at="2026-09-02T00:01:00Z",
+        outcome="pass", attempted_operations=1, cleanup="complete",
+        credential_revocation="complete",
+    )
+    message = conformance_message(
+        report, specification="asm-assurance-targets.v1", test_id="T-01",
+        invariant_ids=["A-01"],
+    )
+    assert message.startswith("[GH-CONFORMANCE] T-01 pass access-engine@abc") or \
+        "Subject: [GH-CONFORMANCE] T-01 pass access-engine@abc" in message
+    assert "Severity" not in message
+    assert "asm-assurance-targets.v1" in message
+    assert "`A-01`" in message
+
+
 def test_abort_message_is_not_target_assurance():
     report = RunReport(
         schema_version="whitehat-run/v1", run_id="abort-1", evidence_class="abort",

tests/test_plane.py

@@ -64,6 +64,12 @@ def test_catalog_loads_honest_applicability():
     assert catalog["fixture-capacity"]["applicability"] == "applicable"
     assert catalog["platform-pg"]["applicability"] == "not_applicable"
     assert catalog["shared-substrate"]["applicability"] == "pending"
+    assert catalog["asm-t01"]["applicability"] == "pending"
+    assert catalog["asm-t01"]["test_id"] == "T-01"
+    assert catalog["asm-t10"]["test_id"] == "T-10"
+    assert "asm" in catalog["asm-t06"]["approval_classes"]
+    assert "live-e2" not in catalog["asm-t01"]["approval_classes"]
+    assert "capacity" not in catalog["asm-t07"]["approval_classes"]
 
 
 def test_retired_ids_include_cancelled_records():