MASON-WP-0015-T06: apply as the scoped ops-mason-builder identity

The default path is user ops-mason-builder. Token mint, pod create, and
serviceaccount impersonation are no. Admin stays on the attended warden lane.
Negative-scope verify treats a denied get as the proof, and the CCR test
interpreter can import the platform generator.

Assistant: grok
Assistant-Session: 01a16071-5425-78d3-80b4-20fe2ee30f0a

tests/test_kubernetes_plane.py

@@ -146,11 +146,13 @@ def test_json_pointer_supports_label_keys_with_slashes_and_dots() -> None:
 
 class FakeCluster:
     def __init__(
-        self, *, context: str = "default", drift: bool = False, dirty: bool = False
+        self, *, context: str = "default", drift: bool = False, dirty: bool = False,
+        can_get_negative: bool = True,
     ) -> None:
         self.context = context
         self.drift = drift
         self.dirty = dirty
+        self.can_get_negative = can_get_negative
         self.applied = False
         self.calls: list[list[str]] = []
 
@@ -169,7 +171,9 @@ class FakeCluster:
             return CommandResult(0)
         if command == ["kubectl", "config", "current-context"]:
             return CommandResult(0, self.context + "\n")
-        if command[:4] == ["kubectl", "auth", "can-i", "create"]:
+        if command[:3] == ["kubectl", "auth", "can-i"]:
+            if command[3] == "get" and not self.can_get_negative:
+                return CommandResult(0, "no\n")
             return CommandResult(0, "yes\n")
         if "apply" in command:
             if "--dry-run=client" not in command and "--dry-run=server" not in command:
@@ -271,6 +275,25 @@ def test_apply_runs_guarded_path_and_writes_metadata_only_evidence(tmp_path: Pat
     assert "--field-manager=ops-mason" in mutating[0]
 
 
+def test_apply_records_negative_scope_when_get_is_denied(tmp_path: Path) -> None:
+    bundle = PlaneBundle.load(_fixture(tmp_path))
+    cluster = FakeCluster(can_get_negative=False)
+    evidence = apply(
+        bundle,
+        confirm_plan_id="plane",
+        expected_digest=bundle.digest,
+        runner=cluster,
+    )
+    assert evidence["verification"]["negative_scope"] == {"pods": 0, "secrets": 0}
+    listed = [
+        call for call in cluster.calls
+        if call[:4] == ["kubectl", "-n", "whitehat", "get"] and call[4] in ("pods", "secrets")
+    ]
+    assert listed == []
+    denied = [call for call in cluster.calls if call[:4] == ["kubectl", "auth", "can-i", "get"]]
+    assert [call[4] for call in denied] == ["pods", "secrets"]
+
+
 def test_preflight_refuses_unmanaged_live_drift(tmp_path: Path) -> None:
     bundle = PlaneBundle.load(_fixture(tmp_path))
     cluster = FakeCluster(drift=True)