The label’s value is a digest, so a policy names the digest, not the stack:
printf %s 'myproject/prod' | shasum -a 256 | cut -c1-16pkg/backend/plunge/markers/keys.go computes the same value, the first 16
hex characters of the SHA-256 of <project>/<stack>.
The record store’s own fence
Section titled “The record store’s own fence”plunge+k8s:// labels each record Secret with an estate (the estate query
key, else the namespace), and choudoufu’s ValidatingAdmissionPolicy
pkg/staterecord/estate-boundary.yaml fences writes by it.
Objects plunge creates
Section titled “Objects plunge creates”choudoufu’s policy reads its own tofu-estate label. No policy reading
plunge-stack on plunge’s objects is written or run yet;
#45 holds it.
Optional: hand this page to your coding agentThe steps work by hand too.
Follow https://intentius.io/plunge/kubernetes/gate/. Compute the plunge-stack digest for this stack and draft the admission policy match for it. Show it to me; apply nothing.
Never run `plunge up`, `plunge destroy` or `plunge stack adopt --yes`, approve or apply a saved plan, or merge; never edit or remove a plunge-stack or plunge-urn tag or label by hand.