# Whitehat foundational plane source pins

These three YAML files are byte-for-byte pins of the selected
`whitehat-security` contract files at coordination revision
`4882c2d47a826a305d5c4e05aa7fcc1252c3887e`; the implementation revision is
`95129d7a35c8999be359b163b554853c9c6afa3a`.

The preserved `CONTRACT ONLY` header means the source repository does not own
or perform the apply. In this repository, only the guarded bundle executor may
apply them, after validating `bundles/whitehat-foundational-plane.yaml` and the
approved construction plan. Do not invoke `kubectl apply` directly on this
directory.

Pinned SHA-256 digests:

- `namespace.yaml`: `a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8`
- `network-policy.yaml`: `05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610`
- `service-account.yaml`: `42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d`

Excluded unconditionally: runner Pod, Secret, credential, projected identity,
engagement lease, and traffic.

Rollback is generated by:

```bash
ops-mason plane rollback-plan \
  --bundle bundles/whitehat-foundational-plane.yaml
```

It never executes deletion. Namespace deletion remains conditional on a fresh
inventory proving that no later or unrelated object entered the namespace.