Add in-process known-bad fixtures for remaining ASM T-01–T-10

Each Canon test now has a fixture-asm registration that fails known-bad
and passes known-good in-process. Live asm-tNN targets stay pending.
No network, OpenBao, or packet.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

tests/test_asm.py

@@ -2,7 +2,7 @@ import json
 
 import pytest
 
-from whitehat_security.asm import t06_calibration, t06_results
+from whitehat_security.asm import CALIBRATORS, asm_calibration, t06_calibration, t06_results
 from whitehat_security.cli import main
 
 
@@ -41,7 +41,20 @@ def test_asm_fixtures_cli_writes_t06(tmp_path):
     assert report["test_id"] == "T-06"
 
 
-def test_asm_fixtures_cli_refuses_unterminated_test():
+@pytest.mark.parametrize("test_id", [key for key in CALIBRATORS if key != "T-06"])
+def test_remaining_asm_calibrations_fail_known_bad(test_id):
+    report = asm_calibration(test_id)
+    assert report["outcome"] == "pass"
+    assert report["evidence_class"] == "fixture"
+    assert report["test_id"] == test_id
+    assert any(item["outcome"] == "finding" for item in report["known_bad"])
+    assert all(item["outcome"] == "pass" for item in report["known_good"])
+    blob = json.dumps(report)
+    assert "sk-whitehat-t02-not-a-real-secret" not in blob
+    assert "whitehat-t06-synthetic" not in blob
+
+
+def test_asm_fixtures_cli_refuses_unknown_test():
     with pytest.raises(SystemExit) as stopped:
-        main(["asm-fixtures", "--test-id", "T-01"])
+        main(["asm-fixtures", "--test-id", "T-99"])
     assert stopped.value.code == 2

tests/test_cli.py

@@ -18,7 +18,7 @@ def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
 
 def test_validate_targets_accepts_catalog(capsys):
     main(["validate-targets", "targets"])
-    assert capsys.readouterr().out.startswith("validated 19 target registrations")
+    assert capsys.readouterr().out.startswith("validated 28 target registrations")
 
 
 def test_kill_switch_is_clear_by_default(capsys):

tests/test_plane.py

@@ -70,9 +70,11 @@ def test_catalog_loads_honest_applicability():
     assert "asm" in catalog["asm-t06"]["approval_classes"]
     assert "live-e2" not in catalog["asm-t01"]["approval_classes"]
     assert "capacity" not in catalog["asm-t07"]["approval_classes"]
-    assert catalog["fixture-asm-t06"]["applicability"] == "applicable"
-    assert catalog["fixture-asm-t06"]["test_id"] == "T-06"
-    assert catalog["asm-t06"]["applicability"] == "pending"
+    for n in range(1, 11):
+        key = f"fixture-asm-t{n:02d}"
+        assert catalog[key]["applicability"] == "applicable"
+        assert catalog[key]["test_id"] == f"T-{n:02d}"
+        assert catalog[f"asm-t{n:02d}"]["applicability"] == "pending"
 
 
 def test_retired_ids_include_cancelled_records():