Add governed test plane and close T04/T08

Encode fail-closed admission, target registrations, and a credential
broker that never returns secret values. Calibrate audit-core shaped
probes in-process. Send no packets and request no live credentials.

Assistant: grok
Assistant-Session: 01a02670-3345-76f2-a014-70fde8e2a2bb

plane/README.md

@@ -0,0 +1,27 @@
+# Governed test plane
+
+Contract only. This repository does not apply cluster objects, request
+credentials, or send packets. `ops-mason` provisions from these files after a
+**new, unretired** engagement ID exists. Cancelled IDs
+`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal.
+
+## Controls
+
+1. Namespace `whitehat`, default-deny networking, explicit target egress.
+2. Immutable runner identity with required engagement labels and no standing
+   service-account token.
+3. Custody broker projects two short-lived tenant-scoped identities into the
+   runner mount and revokes them. Values never enter Git, chat, evidence or
+   State Hub.
+4. Pinned runner image digest on the engagement.
+5. Independently usable kill switch: create `plane/KILL` or set
+   `WHITEHAT_KILL_SWITCH=1`. Admission fails closed while it is engaged.
+6. Rate watcher and automatic lease cleanup in `whitehat_security.plane`.
+
+## Standing versus live
+
+`fixture-e2` is the in-process class already permitted by the rules of
+engagement. `live-e2` still needs a dated engagement, target-owner
+acknowledgement, plane namespace, pinned digest and a connected custody
+broker. `e3` and `capacity` are separate approval classes and will not be
+admitted by the E2 plane.

plane/namespace.yaml

@@ -0,0 +1,9 @@
+# CONTRACT ONLY. Do not apply from this repository.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+    whitehat.security/plane: "true"
+    pod-security.kubernetes.io/enforce: restricted

plane/network-policy.yaml

@@ -0,0 +1,40 @@
+# CONTRACT ONLY. Do not apply from this repository.
+# Default deny in namespace whitehat; live E2 adds a named egress rule per
+# registered target. This example names audit-core only as the currently
+# applicable live E2 target.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: whitehat
+spec:
+  podSelector: {}
+  policyTypes: ["Ingress", "Egress"]
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-audit-core-e2
+  namespace: whitehat
+spec:
+  podSelector:
+    matchLabels:
+      whitehat.security/target: audit-core
+  policyTypes: ["Egress"]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: audit-core
+      ports:
+        - protocol: TCP
+          port: 8080
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53

plane/runner-pod.yaml

@@ -0,0 +1,53 @@
+# CONTRACT ONLY. Do not apply from this repository.
+# Replace PLACEHOLDERS after a new unretired engagement is admitted.
+# Never reuse WH-ENG-20260821-AUDIT-E2 or WH-ENG-20260821-TENANT-E2.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: whitehat-e2-audit
+  namespace: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+    app.kubernetes.io/component: whitehat-probe
+    whitehat.security/plane: "true"
+    whitehat.security/target: audit-core
+    whitehat.security/engagement: WH-ENG-PLACEHOLDER
+spec:
+  serviceAccountName: whitehat-runner
+  automountServiceAccountToken: false
+  activeDeadlineSeconds: 900
+  restartPolicy: Never
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 10001
+    runAsGroup: 10001
+    fsGroup: 10001
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - name: probe
+      image: PINNED_RUNNER_IMAGE_DIGEST
+      imagePullPolicy: IfNotPresent
+      command: ["python3", "-"]
+      resources:
+        requests: {cpu: 5m, memory: 16Mi}
+        limits: {cpu: 50m, memory: 64Mi}
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+        readOnlyRootFilesystem: true
+      volumeMounts:
+        - name: credentials
+          mountPath: /var/run/secrets/whitehat
+          readOnly: true
+  volumes:
+    - name: credentials
+      secret:
+        secretName: whitehat-e2-audit-credentials
+        defaultMode: 0440
+        items:
+          - key: token-a
+            path: token-a
+          - key: token-b
+            path: token-b

plane/service-account.yaml

@@ -0,0 +1,9 @@
+# CONTRACT ONLY. Do not apply from this repository.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: whitehat-runner
+  namespace: whitehat
+  labels:
+    app.kubernetes.io/name: whitehat-security
+automountServiceAccountToken: false