Admit fixture-asm for ASM T-06 and calibrate known-bad replay

Reassess the T-06 blocker against the secrets-engine consume client.
Gate House cited 3cd9955; approval_consume.py first appears at 4b4d556.
An in-process CAS disables different-digest conflict for known-bad and
drives consume_approval through a mock opener. No network or OpenBao.
Live asm-t06 stays pending.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

tests/test_asm.py

@@ -0,0 +1,47 @@
+import json
+
+import pytest
+
+from whitehat_security.asm import t06_calibration, t06_results
+from whitehat_security.cli import main
+
+
+def test_t06_enforcing_rejects_different_digest_without_openbao():
+    results = {item.probe_id: item for item in t06_results(enforce=True)}
+    assert results["t06-exact-consume"].outcome == "pass"
+    assert results["t06-different-digest-replay"].outcome == "pass"
+    assert results["t06-different-digest-replay"].openbao_calls == 0
+
+
+def test_t06_known_bad_accepts_different_digest_and_calls_openbao():
+    results = {item.probe_id: item for item in t06_results(enforce=False)}
+    assert results["t06-different-digest-replay"].outcome == "finding"
+    assert results["t06-different-digest-replay"].openbao_calls == 1
+
+
+def test_t06_calibration_detects_known_bad_and_keeps_token_out():
+    report = t06_calibration()
+    assert report["outcome"] == "pass"
+    assert report["evidence_class"] == "fixture"
+    assert report["test_id"] == "T-06"
+    rendered = json.dumps(report)
+    assert "whitehat-t06-synthetic" not in rendered
+    assert "Bearer" not in rendered
+    bad = {item["probe_id"]: item for item in report["known_bad"]}
+    assert bad["t06-different-digest-replay"]["outcome"] == "finding"
+
+
+def test_asm_fixtures_cli_writes_t06(tmp_path):
+    output = tmp_path / "offline-asm-t06-calibration.json"
+    with pytest.raises(SystemExit) as stopped:
+        main(["asm-fixtures", "--test-id", "T-06", "--output", str(output)])
+    assert stopped.value.code == 0
+    report = json.loads(output.read_text(encoding="utf-8"))
+    assert report["outcome"] == "pass"
+    assert report["test_id"] == "T-06"
+
+
+def test_asm_fixtures_cli_refuses_unterminated_test():
+    with pytest.raises(SystemExit) as stopped:
+        main(["asm-fixtures", "--test-id", "T-01"])
+    assert stopped.value.code == 2