# Governed test plane

This repository does not apply cluster objects, request credentials, or send
packets. `ops-mason` provisions the foundational plane from these files
**before** a fresh engagement is proposed. Cancelled IDs
`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal.

## Ordering

1. Foundational plane: Namespace `whitehat`, default-deny NetworkPolicy,
   audit-core egress NetworkPolicy, ServiceAccount `whitehat-runner` with
   `automountServiceAccountToken: false`.
2. A **new** unretired engagement proposal (`status: proposed`).
3. Operator approval, then target-owner acknowledgement.
4. Custody projection of two short-lived identities into the runner mount.
5. `whitehat admit-plane`, then a runner pod. Not before.

ops-mason applied step 1 on 2026-08-22 (evidence `c26a6e5`, bundle digest
`9636f48f0b994118ff60a8c014e0099486945d66a2b3d3582dc57a09862b2035`). The
namespace had zero Pods and zero Secrets at apply. That apply authorizes no
runner, credential, engagement or traffic.

## Controls

1. Namespace `whitehat`, default-deny networking, explicit target egress.
2. Immutable runner identity with required engagement labels and no standing
   service-account token.
3. Custody broker projects two short-lived tenant-scoped identities into the
   runner mount and revokes them. Values never enter Git, chat, evidence or
   State Hub.
4. Pinned runner image digest on the engagement.
5. Independently usable kill switch: create `plane/KILL` or set
   `WHITEHAT_KILL_SWITCH=1`. Admission fails closed while it is engaged.
6. Rate watcher and automatic lease cleanup in `whitehat_security.plane`.

## Standing versus live

`fixture-e2`, `fixture-e3` and `fixture-capacity` are in-process classes
already permitted by the rules of engagement. `live-e2` still needs a dated
engagement, target-owner acknowledgement, the provisioned plane namespace, a
pinned digest and a connected custody broker. Live `e3` and `capacity` keep
separate approval classes and extra envelope fields.