coulomb/whitehat-security
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit fixture-asm for ASM T-06 and calibrate known-bad replay

Browse source 
Reassess the T-06 blocker against the secrets-engine consume client.
Gate House cited 3cd9955; approval_consume.py first appears at 4b4d556.
An in-process CAS disables different-digest conflict for known-bad and
drives consume_approval through a mock opener. No network or OpenBao.
Live asm-t06 stays pending.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9
This commit is contained in:
tegwick 2026-09-02 10:10:53 +02:00
parent 75b79a0167
commit 75deaf073f
13 changed files with 424 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
targets/asm-t06.json
View file

@ -4,7 +4,7 @@
"posture_claim": "ASM T-06",
"attacker_model": "replay, mutation, race, or post-revocation reuse of a bound approval",
"applicability": "pending",
"applicability_reason": "No synthetic approval fixture and no admitted consumption contract in this plane. Known-bad design: disable one binding dimension or atomic consumption so a prohibited replay is accepted. This registration does not authorize a probe.",
"applicability_reason": "Live T-06 still needs a named approval-engine and consuming PEP under a dated engagement. In-process known-bad calibration exists as fixture-asm-t06 against secrets-engine.approval_consume (module first appears at 4b4d556; Gate House cited 3cd9955). This live registration does not authorize a probe.",
"approval_classes": [
"asm"
],