tegwick
2b318634b6
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02878-7c21-7692-bcd6-ce2838c4b448
31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# Whitehat foundational plane source pins
|
|
|
|
These three YAML files are byte-for-byte pins of the selected
|
|
`whitehat-security` contract files at coordination revision
|
|
`4882c2d47a826a305d5c4e05aa7fcc1252c3887e`; the implementation revision is
|
|
`95129d7a35c8999be359b163b554853c9c6afa3a`.
|
|
|
|
The preserved `CONTRACT ONLY` header means the source repository does not own
|
|
or perform the apply. In this repository, only the guarded bundle executor may
|
|
apply them, after validating `bundles/whitehat-foundational-plane.yaml` and the
|
|
approved construction plan. Do not invoke `kubectl apply` directly on this
|
|
directory.
|
|
|
|
Pinned SHA-256 digests:
|
|
|
|
- `namespace.yaml`: `a0919aa0c3d5f92844eeea3834fc684bc6ad112a3c4419be7f759f6b31c1d7a8`
|
|
- `network-policy.yaml`: `05097e33221f93f4d82da7c4d5bb688c5ec5807dc15ab4378263cddad6031610`
|
|
- `service-account.yaml`: `42cb5276ea2f0a555ea835fed5c14397fe76fbfa18b1acec1f3168bb1db54a5d`
|
|
|
|
Excluded unconditionally: runner Pod, Secret, credential, projected identity,
|
|
engagement lease, and traffic.
|
|
|
|
Rollback is generated by:
|
|
|
|
```bash
|
|
ops-mason plane rollback-plan \
|
|
--bundle bundles/whitehat-foundational-plane.yaml
|
|
```
|
|
|
|
It never executes deletion. Namespace deletion remains conditional on a fresh
|
|
inventory proving that no later or unrelated object entered the namespace.
|