# Governed test plane

This is the missing control from the 2026-08-22 cutoff. It is a fail-closed
admission path, not a standing authorization to probe.

## What the plane is

A live E2 run is admitted only when every item below is true:

1. The target is registered in `targets/` with `applicability: applicable`.
2. Known-bad calibration for that target has already failed in-process.
3. The engagement is complete, in window, owner-acknowledged, and not a
   retired ID.
4. `approval_class` matches the registration (`fixture-e2` / `live-e2` /
   `fixture-e3` / `e3` / `fixture-capacity` / `capacity`).
5. The runner namespace is `whitehat`, the image digest is pinned, and
   engagement labels are present. Live E3 also names a `database`. Live
   capacity also names an `aggressor_ceiling`.
6. The custody broker projected the registered number of identity *handles*
   (two for E2, one runtime for E3, none for capacity fixtures). Credential
   values are not returned to the operator or agent. Live classes fail closed
   while the custody broker is unconnected.
7. The kill switch is clear.
8. The rate watcher is attached. Cleanup revokes the lease.

If any item is false, `whitehat admit-plane` exits 2 and no identity is
requested.

## What the plane is not

- Not authorization. Rules of engagement §1 still apply.
- Not a packet. Manifests in `plane/` are a contract for `ops-mason`.
- Not a secret broker. `UnconnectedCustodyBroker` is the default for every
  non-fixture environment and raises before any custody call.
- Not a way to finish tenant-engine E2. That target is `not_applicable`.

## Operator commands

```sh
PYTHONPATH=src python3 -m whitehat_security.cli validate-targets targets
PYTHONPATH=src python3 -m whitehat_security.cli admit-plane engagements/<record>.json targets/<target>.json
PYTHONPATH=src python3 -m whitehat_security.cli kill-switch
PYTHONPATH=src python3 -m whitehat_security.cli deliver evidence/<run>.json --outbox outbox
```

Create `plane/KILL` to abort independently of the runner process.

## Retired identifiers

`WH-ENG-20260821-AUDIT-E2` and `WH-ENG-20260821-TENANT-E2` are terminal. A new
live run needs a new ID after the cluster plane exists and the custody broker
can project identities without exposing values.