coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit fixture-asm for ASM T-06 and calibrate known-bad replay

Browse source 
Reassess the T-06 blocker against the secrets-engine consume client.
Gate House cited 3cd9955; approval_consume.py first appears at 4b4d556.
An in-process CAS disables different-digest conflict for known-bad and
drives consume_approval through a mock opener. No network or OpenBao.
Live asm-t06 stays pending.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
This commit is contained in:
tegwick 2026-09-02 10:10:53 +02:00
parent 75b79a0167
commit 75deaf073f
13 changed files with 424 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

8
evidence/README.md
View file

@ -1,10 +1,10 @@
# Evidence
This directory stores sanitized run artifacts. `offline-calibration.json`,
`offline-e3-calibration.json` and `offline-capacity-calibration.json` are
generated from repository-created fixtures and prove only that the harness
distinguishes known-good from known-bad behavior. They are not target
assurance. `WH-ENG-20260822-AUDIT-E2-02-abort.json`
`offline-e3-calibration.json`, `offline-capacity-calibration.json`, and
`offline-asm-t06-calibration.json` are generated from repository-created
fixtures and prove only that the harness distinguishes known-good from
known-bad behavior. They are not target assurance. `WH-ENG-20260822-AUDIT-E2-02-abort.json`
is an abort record (`evidence_class: abort`), not an E2 pass or finding.
`WH-ENG-20260822-AUDIT-E2-03.json` is the first authorized target pass; SHA-256
`2d5a21141b78024a5334881e2b7fd62a69c46931057f77515a6c6f18ec497593`. A pass

50
evidence/offline-asm-t06-calibration.json Normal file
View file

@ -0,0 +1,50 @@
{
"ended_at": "2026-09-02T08:10:37.894382Z",
"evidence_class": "fixture",
"known_bad": [
{
"openbao_calls": 2,
"outcome": "pass",
"probe_id": "t06-exact-consume",
"reason": "first and same-digest retry consumed"
},
{
"openbao_calls": 1,
"outcome": "finding",
"probe_id": "t06-different-digest-replay",
"reason": "known-bad CAS accepted a different-digest replay and the PEP called OpenBao"
}
],
"known_good": [
{
"openbao_calls": 2,
"outcome": "pass",
"probe_id": "t06-exact-consume",
"reason": "first and same-digest retry consumed"
},
{
"openbao_calls": 0,
"outcome": "pass",
"probe_id": "t06-different-digest-replay",
"reason": "different-digest replay rejected; OpenBao not called"
}
],
"limitations": [
"Offline ASM T-06 calibration evaluates the harness against an in-process CAS.",
"No network, OpenBao, live approval-engine, or reusable credential was used.",
"Gate House cited secrets-engine 3cd9955; approval_consume.py first appears at 4b4d556.",
"This is fixture evidence, not live target assurance."
],
"outcome": "pass",
"run_id": "asm-t06-calibration-2026-09-02T08:10:37.814145Z",
"schema_version": "whitehat-asm-calibration/v1",
"specification": "asm-assurance-targets.v1",
"started_at": "2026-09-02T08:10:37.814145Z",
"target": {
"claimed_revision": "3cd9955ac935be398f0fbb6aa7263660a9888721",
"component": "secrets-engine",
"consume_module_revision": "4b4d556d6264a5da933f7e14aae0fe27ba1f4300",
"module": "secrets_engine.approval_consume"
},
"test_id": "T-06"
}