Finish WHITEHAT-WP-0007 and own live ASM residuals in WP-0008

Triage and in-process T-01–T-10 calibration are complete. Live ASM runs
move to WHITEHAT-WP-0008, which authorizes no packet. Record DoD-Ok on
WP-0007.

Assistant: grok
Assistant-Session: 01a05e32-c776-72a3-86ec-c490e027aca9

SCOPE.md

@@ -67,12 +67,13 @@ boundary always holds.
 - Repository status: active.
 - Layer: Staff (declared in `INTENT.md`, 2026-09-01). `WHITEHAT-IN-0001` is
   closed.
-- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005`. Residual live
+- Finished: `WHITEHAT-WP-0001` through `WHITEHAT-WP-0005` and
-  Tenancy Posture evidence is owned by `WHITEHAT-WP-0006` and is blocked on
+  `WHITEHAT-WP-0007`. Residual live Tenancy Posture evidence is
-  authorization.
+  `WHITEHAT-WP-0006`. Residual live ASM is `WHITEHAT-WP-0008`. Both are
-- Active: `WHITEHAT-WP-0007` triages Gate House ASM T-01…T-10. Live
+  blocked on authorization.
+- `WHITEHAT-WP-0007` triaged Gate House ASM T-01…T-10. Live `asm-tNN`
   registrations remain `pending`. In-process `fixture-asm-t01`…`t10`
-  calibrations exist. That work authorizes no live probe.
+  calibrations exist. That work authorized no live probe.
 - `WHITEHAT-WP-0001` T01–T08 are complete for every applicable target.
   `audit-core` has dated E2 pass `WH-ENG-20260822-AUDIT-E2-03`.
   `tenant-engine` E2 and `platform-pg` E3 stay `not_applicable`. `flex-auth`
@@ -100,4 +101,6 @@ boundary always holds.
    [`WHITEHAT-WP-0006`](workplans/WHITEHAT-WP-0006-authorized-live-residuals.md)
    for unauthorized live Tenancy Posture residuals, and
    [`WHITEHAT-WP-0007`](workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md)
-   for ASM T-01…T-10 triage.
+   for finished ASM T-01…T-10 triage, and
+   [`WHITEHAT-WP-0008`](workplans/WHITEHAT-WP-0008-live-asm-residuals.md)
+   for unauthorized live ASM residuals.

workplans/WHITEHAT-WP-0007-asm-t01-t10-triage.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Triage Gate House ASM T-01–T-10 executable targets"
 domain: infotech
 repo: whitehat-security
-status: active
+status: finished
 owner: net-kingdom
 topic_slug: whitehat-security
 created: "2026-09-02"
@@ -12,7 +12,12 @@ updated: "2026-09-02"
 related:
   - WHITEHAT-IN-0002
   - WHITEHAT-WP-0001
+  - WHITEHAT-WP-0008
 state_hub_workstream_id: "a06d1a9b-d9fa-5bec-bf03-e0e9b5b0ee3a"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-09-02"
+quality_dod_by: grok
+quality_dod_note: "T01–T10 triage done; fixture-asm-t01…t10 calibrated known-bad/known-good in-process; T-06 reporting envelope sent. Live ASM owned by WHITEHAT-WP-0008. make check passed. No live traffic."
 ---
 
 # WHITEHAT-WP-0007 — ASM T-01–T-10 triage
@@ -278,19 +283,29 @@ state_hub_task_id: "28b231b2-b51f-5484-89cb-e709258a3a15"
 
 ```task
 id: WHITEHAT-WP-0007-T11
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "13518801-015f-51ef-9d07-8cf989e08710"
 ```
 
-In-process known-bad calibration exists for T-01…T-10
+Done 2026-09-02 for the in-process part: T-01…T-10 have `fixture-asm-tNN`
-(`targets/fixture-asm-tNN.json`, `evidence/offline-asm-tNN-calibration.json`).
+registrations and `evidence/offline-asm-tNN-calibration.json`. Known-bad
-Any live ASM run is blocked until a target owner names the surface, identities,
+loses the oracle; known-good passes. T-06 also has a
-and window for that test. Do not relabel a pending live target to finish this
+conformance-reporting.v1 fixture envelope
-plan. Do not send a packet.
+(`a1ebf012-bd1e-43d2-843c-ba3ddecb8c82`) with `engagement_id=fixture-asm-t06`
+and RoE v0.2 §1. Live ASM is owned by `WHITEHAT-WP-0008`. This task does not
+relabel pending live targets and sent no packet.
 
 ## Sequencing
 
-T01–T10 are the triage and are done together. T11 cannot start without an
+T01–T10 were the triage. T11's fixture work is done. Live runs are
-owner-named surface. Offline Tenancy Posture work remains on
+`WHITEHAT-WP-0008`. Offline Tenancy Posture work remains on
 `WHITEHAT-WP-0001` / `WHITEHAT-WP-0006`.
+
+## Closeout — 2026-09-02
+
+This workplan is **finished**. Gate House's first completion condition is met:
+ten triaged Canon tests, each with applicability, known-bad design, owning
+surface, and result route, plus in-process calibration. A later live run needs
+a new engagement ID, an `applicable` live registration, and plane admission.
+`WHITEHAT-WP-0008` owns that residual and authorizes no packet.

workplans/WHITEHAT-WP-0008-live-asm-residuals.md

@@ -0,0 +1,55 @@
+---
+id: WHITEHAT-WP-0008
+type: workplan
+title: "Authorized live ASM residuals after WHITEHAT-WP-0007"
+domain: infotech
+repo: whitehat-security
+status: blocked
+owner: net-kingdom
+topic_slug: whitehat-security
+created: "2026-09-02"
+updated: "2026-09-02"
+related:
+  - WHITEHAT-WP-0007
+  - WHITEHAT-IN-0002
+---
+
+# WHITEHAT-WP-0008 — live ASM residuals
+
+## Goal
+
+Own live `asm-assurance-targets.v1` runs that `WHITEHAT-WP-0007` correctly did
+not execute. In-process known-bad calibration for T-01…T-10 already exists.
+
+This plan authorizes no engagement, runner, credential, traffic, or load.
+
+## Origin
+
+`WHITEHAT-WP-0007` finished on 2026-09-02. Its artifacts are ten triaged
+Canon tests, `fixture-asm-t01`…`t10` in-process calibrations, the T-06
+conformance-reporting.v1 fixture envelope, and pending live `asm-tNN`
+registrations. Live residuals must not remain only in that plan's prose.
+
+## Tasks
+
+### T01 — Live ASM under a new engagement
+
+```task
+id: WHITEHAT-WP-0008-T01
+status: wait
+priority: medium
+```
+
+Blocked until a target owner names, for a specific Canon `test_id`, the
+component revision, identities, window, and technique, and until a complete
+engagement record plus plane admission exist. `asm-t01`…`asm-t10` stay
+`pending` until that happens. Do not relabel a pending target to finish this
+task. Do not send a packet.
+
+T-06 live still needs a named approval-engine and consuming PEP; the
+in-process consume client at secrets-engine `4b4d556` is not that surface.
+
+## Sequencing
+
+Nothing starts without the rules of engagement §1 record and plane admission.
+Offline fixtures stay on `WHITEHAT-WP-0007`.