Admit fixture-asm for ASM T-06 and calibrate known-bad replay

Reassess the T-06 blocker against the secrets-engine consume client.
Gate House cited 3cd9955; approval_consume.py first appears at 4b4d556.
An in-process CAS disables different-digest conflict for known-bad and
drives consume_approval through a mock opener. No network or OpenBao.
Live asm-t06 stays pending.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

targets/README.md

@@ -13,7 +13,8 @@ honest applicability record the test plane admits against.
 | `platform-pg` | not_applicable | No ordinary runtime identity can read the conformance view. |
 | `fixture-capacity` | applicable | In-process P1/P2 evaluator. Generates no load. |
 | `shared-substrate` | pending | Live capacity needs an operator window and aggressor ceiling. |
-| `asm-t01` … `asm-t10` | pending | Gate House ASM T-01…T-10. Separate `asm` class; not E2/E3/capacity. See `WHITEHAT-WP-0007`. |
+| `asm-t01` … `asm-t10` | pending | Gate House ASM T-01…T-10 live registrations. Separate `asm` class; not E2/E3/capacity. See `WHITEHAT-WP-0007`. |
+| `fixture-asm-t06` | applicable | In-process T-06 known-bad/known-good CAS. Offline only. |
 
 `not_applicable` is a completed artifact, not a deferral. Do not relabel it to
 close a workplan. Do not reuse cancelled engagement IDs from `engagements/`.

targets/asm-t06.json

@@ -4,7 +4,7 @@
   "posture_claim": "ASM T-06",
   "attacker_model": "replay, mutation, race, or post-revocation reuse of a bound approval",
   "applicability": "pending",
-  "applicability_reason": "No synthetic approval fixture and no admitted consumption contract in this plane. Known-bad design: disable one binding dimension or atomic consumption so a prohibited replay is accepted. This registration does not authorize a probe.",
+  "applicability_reason": "Live T-06 still needs a named approval-engine and consuming PEP under a dated engagement. In-process known-bad calibration exists as fixture-asm-t06 against secrets-engine.approval_consume (module first appears at 4b4d556; Gate House cited 3cd9955). This live registration does not authorize a probe.",
   "approval_classes": [
     "asm"
   ],

targets/fixture-asm-t06.json

@@ -0,0 +1,44 @@
+{
+  "schema_version": "whitehat-target/v1",
+  "target_id": "fixture-asm-t06",
+  "posture_claim": "ASM T-06",
+  "attacker_model": "replay, mutation, race, or post-revocation reuse of a bound approval",
+  "applicability": "applicable",
+  "applicability_reason": "In-process T-06 evaluator owned by this repository. It drives secrets-engine.approval_consume through a mock HTTP opener and an in-process CAS. Known-bad disables different-digest conflict. No network, OpenBao, or live approval-engine.",
+  "approval_classes": ["fixture-asm"],
+  "specification": "asm-assurance-targets.v1",
+  "test_id": "T-06",
+  "title": "Approval Replay Test",
+  "claims": ["A-04", "A-07", "A-13", "A-15"],
+  "oracle": "only-live-exactly-bound-unconsumed-request-succeeds",
+  "adapter": "src/whitehat_security/asm.py",
+  "probe_pack": "src/whitehat_security/asm.py",
+  "known_bad_calibration": "src/whitehat_security/asm.py",
+  "fixture_lifecycle": {
+    "create": "in-process CAS and temporary 0600 synthetic token file",
+    "delete": "drop process state and unlink token file",
+    "ids_are_synthetic": true
+  },
+  "egress": "in-process",
+  "surface": ["in-process-cas", "secrets-engine.approval_consume"],
+  "result_route": {
+    "conformance": "gate-house",
+    "implementation_finding": "risk-nexus",
+    "specification_finding": "gate-house",
+    "harness_gap": "whitehat-security"
+  },
+  "routes": [
+    "t06-exact-consume",
+    "t06-different-digest-replay"
+  ],
+  "identities": {
+    "count": 0,
+    "role": "none; fixture generates no live identity",
+    "broker_audience": "whitehat-asm/fixture-t06"
+  },
+  "abort_telemetry": [
+    "kill_switch",
+    "secret_value_observed",
+    "openbao_called_on_conflict"
+  ]
+}