Admit fixture-asm for ASM T-06 and calibrate known-bad replay

Reassess the T-06 blocker against the secrets-engine consume client.
Gate House cited 3cd9955; approval_consume.py first appears at 4b4d556.
An in-process CAS disables different-digest conflict for known-bad and
drives consume_approval through a mock opener. No network or OpenBao.
Live asm-t06 stays pending.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md

@@ -181,14 +181,20 @@ priority: high
 state_hub_task_id: "dfe0ff4e-cafe-5f4e-bfe7-6238412632f3"
 ```
 
-- **Applicability:** `pending`
-- **Surface:** approval-engine, `access-engine`, consuming PEP, approval
-  consumption contract
-- **Known-bad design:** one binding dimension or atomic consumption disabled;
-  a prohibited replay is accepted
-- **Blocker:** no synthetic approval fixture and no admitted consumption
-  contract in this plane
-- **Route:** `[GH-CONFORMANCE] T-06 …`; finding → `risk-nexus` (approval-engine)
+- **Applicability:** `fixture-asm-t06` **applicable** (in-process). Live
+  `asm-t06` remains `pending`.
+- **Surface:** secrets-engine `approval_consume` PEP client driven through an
+  in-process CAS opener. Live surface is still approval-engine plus a consuming
+  PEP.
+- **Known-bad design:** CAS disables different-digest conflict; the PEP then
+  calls OpenBao. The same probe against the enforcing CAS rejects the replay
+  and does not call OpenBao.
+- **Reassessment:** Gate House candidate `3cd9955` does **not** contain
+  `approval_consume.py`. That module first appears at `4b4d556`. The in-process
+  fixture is sufficient to admit `fixture-asm` only. It is not a live
+  approval-engine.
+- **Route:** `[GH-CONFORMANCE] T-06 …`; finding → `risk-nexus` (secrets-engine /
+  approval-engine)
 
 ### T-07 — Circuit Breaker
 
@@ -275,10 +281,11 @@ priority: medium
 state_hub_task_id: "13518801-015f-51ef-9d07-8cf989e08710"
 ```
 
-Build in-process known-bad fixtures and, only after that, any live ASM run.
-Blocked until a target owner names the surface, identities, and window for a
-specific test. Do not relabel a pending target to finish this plan. Do not
-send a packet.
+In-process T-06 known-bad calibration exists (`fixture-asm-t06`,
+`evidence/offline-asm-t06-calibration.json`). Remaining tests still need
+fixtures. Any live ASM run is blocked until a target owner names the surface,
+identities, and window for that test. Do not relabel a pending live target to
+finish this plan. Do not send a packet.
 
 ## Sequencing