build: provision and verify Whitehat foundational plane

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448

docs/evidence/whitehat-foundational-plane.md

@@ -0,0 +1,62 @@
+# Whitehat foundational plane apply evidence
+
+Applied: `2026-08-22T09:24:44Z`  
+Plan: `whitehat-foundational-plane`  
+Approved by: Bernd Worsch, 2026-08-22  
+Executor source: ops-mason `2b31863`  
+Bundle digest: `9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035`
+
+## Provenance and guard result
+
+- Whitehat coordination revision:
+  `4882c2d47a826a305d5c4e05aa7fcc1252c3887e`
+- Plane implementation revision:
+  `95129d7a35c8999be359b163b554853c9c6afa3a`
+- The three source files and Mason pins are byte-identical.
+- Context `default`, create RBAC, audit-core Service TCP 8080, and
+  `audit-core-whitehat-ingress` exact selectors/port passed.
+- All four objects were absent before apply.
+- All three manifests passed client validation and server dry-run before
+  persistence.
+
+## Live objects
+
+| Object | UID | Resource version |
+| --- | --- | --- |
+| Namespace `whitehat` | `b0f97761-28a2-4b50-b4cb-890995fc0993` | `50841574` |
+| NetworkPolicy `default-deny` | `f4143fc9-4e42-454e-867b-c3fe5a050945` | `50841577` |
+| NetworkPolicy `allow-audit-core-e2` | `84ba88a8-74df-448d-b9ba-066083c49b0f` | `50841578` |
+| ServiceAccount `whitehat-runner` | `6229deb0-82b8-4ca7-aee5-e00b4eff81a9` | `50841583` |
+
+Post-apply preflight classifies every object as `exact` and server-validates
+all manifests. ServiceAccount token automount is `false`. The namespace has
+zero Pods and zero Secrets. Kubernetes created its normal `default`
+ServiceAccount and `kube-root-ca.crt` ConfigMap; neither is part of the bundle.
+
+No runner Pod, credential, projected identity, custody lease, new engagement,
+or target request was created or sent.
+
+## Rollback
+
+Object-scoped rollback, in order:
+
+```bash
+kubectl -n whitehat delete networkpolicies.networking.k8s.io default-deny
+kubectl -n whitehat delete networkpolicies.networking.k8s.io allow-audit-core-e2
+kubectl -n whitehat delete serviceaccounts whitehat-runner
+```
+
+Before considering Namespace deletion, inventory it:
+
+```bash
+kubectl -n whitehat get all,configmaps,secrets,serviceaccounts,networkpolicies
+```
+
+Only if no later or unrelated object exists:
+
+```bash
+kubectl delete namespaces whitehat
+```
+
+No rollback command was executed. Machine-readable evidence is in
+`docs/evidence/whitehat-foundational-plane.json`.