# Whitehat foundational plane apply evidence

Applied: `2026-08-22T09:24:44Z`  
Plan: `whitehat-foundational-plane`  
Approved by: Bernd Worsch, 2026-08-22  
Executor source: ops-mason `2b31863`  
Bundle digest: `9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035`

## Provenance and guard result

- Whitehat coordination revision:
  `4882c2d47a826a305d5c4e05aa7fcc1252c3887e`
- Plane implementation revision:
  `95129d7a35c8999be359b163b554853c9c6afa3a`
- The three source files and Mason pins are byte-identical.
- Context `default`, create RBAC, audit-core Service TCP 8080, and
  `audit-core-whitehat-ingress` exact selectors/port passed.
- All four objects were absent before apply.
- All three manifests passed client validation and server dry-run before
  persistence.

## Live objects

| Object | UID | Resource version |
| --- | --- | --- |
| Namespace `whitehat` | `b0f97761-28a2-4b50-b4cb-890995fc0993` | `50841574` |
| NetworkPolicy `default-deny` | `f4143fc9-4e42-454e-867b-c3fe5a050945` | `50841577` |
| NetworkPolicy `allow-audit-core-e2` | `84ba88a8-74df-448d-b9ba-066083c49b0f` | `50841578` |
| ServiceAccount `whitehat-runner` | `6229deb0-82b8-4ca7-aee5-e00b4eff81a9` | `50841583` |

Post-apply preflight classifies every object as `exact` and server-validates
all manifests. ServiceAccount token automount is `false`. The namespace has
zero Pods and zero Secrets. Kubernetes created its normal `default`
ServiceAccount and `kube-root-ca.crt` ConfigMap; neither is part of the bundle.

No runner Pod, credential, projected identity, custody lease, new engagement,
or target request was created or sent.

## Rollback

Object-scoped rollback, in order:

```bash
kubectl -n whitehat delete networkpolicies.networking.k8s.io default-deny
kubectl -n whitehat delete networkpolicies.networking.k8s.io allow-audit-core-e2
kubectl -n whitehat delete serviceaccounts whitehat-runner
```

Before considering Namespace deletion, inventory it:

```bash
kubectl -n whitehat get all,configmaps,secrets,serviceaccounts,networkpolicies
```

Only if no later or unrelated object exists:

```bash
kubectl delete namespaces whitehat
```

No rollback command was executed. Machine-readable evidence is in
`docs/evidence/whitehat-foundational-plane.json`.