Replication package: Cross-plane semantic portability of compliance rules from CI gates to Kubernetes admission control

Self-verifying replication package for a study of how executable compliance rules change meaning when they move from a CI policy gate to Kubernetes admission control. Three archives: (1) the cross-plane portability framework and the two-plane differential study of Sections 3–5 (P20_TCC_CORE_REPLICATION.zip); (2) the operational-latency study of supplement S15 (P3_REPLICATION_PACKAGE.zip). Each archive ships a top-level SHA256SUMS.txt; verify with shasum -a 256 -c SHA256SUMS.txt from the archive root (core 380/380, latency 172/172). Pinned tool versions, policy manifests, controlled signals, mutation variants, per-block data, and an offline re-analysis that reproduces the reported tables are included. See each archive's README.md and PROVENANCE_AND_EXCLUSIONS.md. Version v1.1.0 (2026-10-30): post-freeze addendum. This version adds P20_REPLICATION_ADDENDUM_2026-10-30.zip (SHA-256 16ad4f6cb237297cd21219843168a70034fdaee519e7a0d82412722d6f43ba54) and leaves the two v1.0.0 archives unchanged (core package 380/380 file hashes; P3 package 172/172). The addendum contains everything added after the freeze and reported in the manuscript's supplement S8 timeline: (i) the pre-specified, signed rule-set-breadth policy arm (gitleaks rules ported to Rego; P-B1/P-B2 and the confirmatory P-B3 with 55 signed cell predictions; results, attribution and statistics); (ii) the pre-registered replication of the Kyverno arm on the ValidatingPolicy (CEL) API (translated policies, compile log, run log, 168/173 comparison, and the Gatekeeper REV3 control-coverage-gap disclosure); (iii) the independent human-rater exercise (the blinded rater package, both raters' anonymised returns as received, the author's hash-sealed labels, scoring scripts, agreement and sensitivity reports, the unexecuted adjudication protocol, the author's self-review record, and the corrected labels of 2026-10-30 with agreement before and after). Raters are identified only as human rater 1 and 2; names, declarations and consent forms are not deposited. The addendum's README.md maps every file named in the manuscript to its path, and MANIFEST_SHA256.txt lists all 119 files. Cite the record by the concept DOI 10.5281/zenodo.23446723, which resolves to the latest version.