Admit E3 and capacity on the test plane

Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

src/whitehat_security/e3.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from typing import Callable, Literal
 
-from .model import Outcome
+from .model import Outcome, utc_now
 
 Expectation = Literal["zero_rows", "statement_rejected", "false", "documented_limit"]
 Query = Callable[[str], object]
@@ -49,6 +49,52 @@ def evaluate(probe: E3Probe, *, rows: int = 0, rejected: bool = False,
     return E3Result(probe.probe_id, "finding", f"expectation failed: {probe.expectation}")
 
 
+def fixture_results(*, enforce: bool) -> list[E3Result]:
+    """In-process known-good/known-bad outcomes. No database connection."""
+    results: list[E3Result] = []
+    for probe in PROBES:
+        if probe.expectation == "documented_limit":
+            results.append(evaluate(probe))
+            continue
+        if enforce:
+            results.append(evaluate(probe, rows=0, rejected=True, boolean=False))
+        else:
+            results.append(evaluate(probe, rows=1, rejected=False, boolean=True))
+    return results
+
+
+def e3_calibration() -> dict:
+    started = utc_now()
+    good = fixture_results(enforce=True)
+    bad = fixture_results(enforce=False)
+
+    def expected(result: E3Result, *, enforce: bool) -> bool:
+        probe = next(item for item in PROBES if item.probe_id == result.probe_id)
+        if probe.expectation == "documented_limit":
+            return result.outcome == "inconclusive"
+        return result.outcome == ("pass" if enforce else "finding")
+
+    ok = all(expected(item, enforce=True) for item in good) and all(
+        expected(item, enforce=False) for item in bad
+    )
+    return {
+        "schema_version": "whitehat-e3-calibration/v1",
+        "evidence_class": "fixture",
+        "run_id": f"e3-calibration-{started}",
+        "started_at": started,
+        "ended_at": utc_now(),
+        "outcome": "pass" if ok else "finding",
+        "cadence": CADENCE,
+        "known_good": [result.__dict__ for result in good],
+        "known_bad": [result.__dict__ for result in bad],
+        "limitations": [
+            "Offline E3 calibration evaluates the harness; it is not target assurance.",
+            "No database connection or live credential was used.",
+            "sql-compromise-reset is E3's documented limit and stays inconclusive.",
+        ],
+    }
+
+
 CADENCE = {
     "interval": "24h",
     "maximum_detection_window": "24h plus run and reporting latency",