Admit E3 and capacity on the test plane

Register in-process E3 and capacity fixtures, keep live database and
substrate targets pending, and ask ops-mason for namespace-only provision.
No packets, no credentials, no cancelled engagement IDs.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

tests/test_cli.py

@@ -16,7 +16,7 @@ def test_validate_engagement_reports_clean_denial(tmp_path, capsys):
 
 def test_validate_targets_accepts_catalog(capsys):
     main(["validate-targets", "targets"])
-    assert capsys.readouterr().out.startswith("validated 4 target registrations")
+    assert capsys.readouterr().out.startswith("validated 8 target registrations")
 
 
 def test_kill_switch_is_clear_by_default(capsys):

tests/test_plane.py

@@ -8,6 +8,7 @@ from whitehat_security.differential import execute, execute_authorized
 from whitehat_security.engagement import AuthorizationError, Engagement
 from whitehat_security.fixtures import FixtureService, probe_suite
 from whitehat_security.model import RunReport
+from whitehat_security.e3 import e3_calibration
 from whitehat_security.plane import (
     KillSwitch, LocalBroker, RateWatcher, UnconnectedCustodyBroker,
     admit, cleanup, retired_ids,
@@ -59,6 +60,10 @@ def test_catalog_loads_honest_applicability():
     assert catalog["audit-core"]["applicability"] == "applicable"
     assert catalog["tenant-engine"]["applicability"] == "not_applicable"
     assert catalog["flex-auth"]["applicability"] == "pending"
+    assert catalog["fixture-e3"]["applicability"] == "applicable"
+    assert catalog["fixture-capacity"]["applicability"] == "applicable"
+    assert catalog["platform-pg"]["applicability"] == "pending"
+    assert catalog["shared-substrate"]["applicability"] == "pending"
 
 
 def test_retired_ids_include_cancelled_records():
@@ -171,6 +176,82 @@ def test_e3_is_not_admitted_by_the_e2_plane(tmp_path):
         )
 
 
+def test_fixture_e3_projects_one_runtime_identity(tmp_path):
+    broker = LocalBroker()
+    engagement = load_engagement(tmp_path, fixture_record(
+        target_id="fixture-e3", approval_class="fixture-e3",
+        techniques=["e3-rls"], routes=["conformance"],
+    ))
+    lease = admit(
+        engagement=engagement, registration=load_registration("targets/fixture-e3.json"),
+        broker=broker, kill_switch=KillSwitch(tmp_path / "KILL"),
+        now=NOW, retired=set(),
+    )
+    assert len(lease.identities) == 1
+    assert lease.identities[0].role == "runtime"
+    assert cleanup(lease, broker)["credential_revocation"] == "revoked"
+
+
+def test_fixture_capacity_projects_no_identities(tmp_path):
+    broker = LocalBroker()
+    engagement = load_engagement(tmp_path, fixture_record(
+        target_id="fixture-capacity", approval_class="fixture-capacity",
+        techniques=["p1-noisy-neighbour"], routes=["baseline"],
+    ))
+    lease = admit(
+        engagement=engagement, registration=load_registration("targets/fixture-capacity.json"),
+        broker=broker, kill_switch=KillSwitch(tmp_path / "KILL"),
+        now=NOW, retired=set(),
+    )
+    assert lease.identities == ()
+    assert cleanup(lease, broker)["credential_revocation"] == "revoked"
+
+
+def test_pending_e3_target_is_refused(tmp_path):
+    engagement = load_engagement(tmp_path, fixture_record(
+        target_id="platform-pg", approval_class="e3",
+        techniques=["e3-rls"], environment="build",
+        plane_namespace="whitehat", runner_image_digest="sha256:abc",
+        database="platform-pg", routes=["conformance"],
+    ))
+    with pytest.raises(AuthorizationError, match="pending"):
+        admit(
+            engagement=engagement,
+            registration=load_registration("targets/platform-pg-e3.json"),
+            broker=LocalBroker(), kill_switch=KillSwitch(tmp_path / "KILL"),
+            now=NOW, retired=set(),
+        )
+
+
+def test_live_e3_without_database_fails_closed(tmp_path):
+    registration = load_registration("targets/fixture-e3.json")
+    registration["target_id"] = "fixture-e3-live"
+    registration["approval_classes"] = ["e3"]
+    engagement = load_engagement(tmp_path, fixture_record(
+        target_id="fixture-e3-live", approval_class="e3",
+        techniques=["e3-rls"], environment="build",
+        plane_namespace="whitehat", runner_image_digest="sha256:abc",
+        routes=["conformance"],
+    ))
+    with pytest.raises(AuthorizationError, match="named database"):
+        admit(
+            engagement=engagement, registration=registration,
+            broker=LocalBroker(), kill_switch=KillSwitch(tmp_path / "KILL"),
+            now=NOW, retired=set(),
+        )
+
+
+def test_e3_calibration_keeps_documented_limit_inconclusive():
+    report = e3_calibration()
+    assert report["outcome"] == "pass"
+    by_id = {item["probe_id"]: item for item in report["known_good"]}
+    assert by_id["sql-compromise-reset"]["outcome"] == "inconclusive"
+    assert by_id["conformance-view-empty"]["outcome"] == "pass"
+    bad = {item["probe_id"]: item for item in report["known_bad"]}
+    assert bad["conformance-view-empty"]["outcome"] == "finding"
+    assert bad["sql-compromise-reset"]["outcome"] == "inconclusive"
+
+
 def test_rate_and_concurrency_ceilings(tmp_path):
     watcher = RateWatcher(per_minute=10, max_concurrency=1, max_requests=1)
     watcher.acquire()