Finish WHITEHAT-WP-0007 and own live ASM residuals in WP-0008

Triage and in-process T-01–T-10 calibration are complete. Live ASM runs
move to WHITEHAT-WP-0008, which authorizes no packet. Record DoD-Ok on
WP-0007.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

workplans/WHITEHAT-WP-0008-live-asm-residuals.md

@@ -0,0 +1,55 @@
+---
+id: WHITEHAT-WP-0008
+type: workplan
+title: "Authorized live ASM residuals after WHITEHAT-WP-0007"
+domain: infotech
+repo: whitehat-security
+status: blocked
+owner: net-kingdom
+topic_slug: whitehat-security
+created: "2026-09-02"
+updated: "2026-09-02"
+related:
+  - WHITEHAT-WP-0007
+  - WHITEHAT-IN-0002
+---
+
+# WHITEHAT-WP-0008 — live ASM residuals
+
+## Goal
+
+Own live `asm-assurance-targets.v1` runs that `WHITEHAT-WP-0007` correctly did
+not execute. In-process known-bad calibration for T-01…T-10 already exists.
+
+This plan authorizes no engagement, runner, credential, traffic, or load.
+
+## Origin
+
+`WHITEHAT-WP-0007` finished on 2026-09-02. Its artifacts are ten triaged
+Canon tests, `fixture-asm-t01`…`t10` in-process calibrations, the T-06
+conformance-reporting.v1 fixture envelope, and pending live `asm-tNN`
+registrations. Live residuals must not remain only in that plan's prose.
+
+## Tasks
+
+### T01 — Live ASM under a new engagement
+
+```task
+id: WHITEHAT-WP-0008-T01
+status: wait
+priority: medium
+```
+
+Blocked until a target owner names, for a specific Canon `test_id`, the
+component revision, identities, window, and technique, and until a complete
+engagement record plus plane admission exist. `asm-t01`…`asm-t10` stay
+`pending` until that happens. Do not relabel a pending target to finish this
+task. Do not send a packet.
+
+T-06 live still needs a named approval-engine and consuming PEP; the
+in-process consume client at secrets-engine `4b4d556` is not that surface.
+
+## Sequencing
+
+Nothing starts without the rules of engagement §1 record and plane admission.
+Offline fixtures stay on `WHITEHAT-WP-0007`.