{
  "schema_version": "whitehat-target/v1",
  "target_id": "fixture-asm-t06",
  "posture_claim": "ASM T-06",
  "attacker_model": "replay, mutation, race, or post-revocation reuse of a bound approval",
  "applicability": "applicable",
  "applicability_reason": "In-process T-06 evaluator owned by this repository. It drives secrets-engine.approval_consume through a mock HTTP opener and an in-process CAS. Known-bad disables different-digest conflict. No network, OpenBao, or live approval-engine.",
  "approval_classes": ["fixture-asm"],
  "specification": "asm-assurance-targets.v1",
  "test_id": "T-06",
  "title": "Approval Replay Test",
  "claims": ["A-04", "A-07", "A-13", "A-15"],
  "oracle": "only-live-exactly-bound-unconsumed-request-succeeds",
  "adapter": "src/whitehat_security/asm.py",
  "probe_pack": "src/whitehat_security/asm.py",
  "known_bad_calibration": "src/whitehat_security/asm.py",
  "fixture_lifecycle": {
    "create": "in-process CAS and temporary 0600 synthetic token file",
    "delete": "drop process state and unlink token file",
    "ids_are_synthetic": true
  },
  "egress": "in-process",
  "surface": ["in-process-cas", "secrets-engine.approval_consume"],
  "result_route": {
    "conformance": "gate-house",
    "implementation_finding": "risk-nexus",
    "specification_finding": "gate-house",
    "harness_gap": "whitehat-security"
  },
  "routes": [
    "t06-exact-consume",
    "t06-different-digest-replay"
  ],
  "identities": {
    "count": 0,
    "role": "none; fixture generates no live identity",
    "broker_audience": "whitehat-asm/fixture-t06"
  },
  "abort_telemetry": [
    "kill_switch",
    "secret_value_observed",
    "openbao_called_on_conflict"
  ]
}