fix(ci): kill the false-green base resolution; cover R-SEC-01/02 + R-TEST-06 (L0)

Unblocks the enforced Gitea gate, which correctly BLOCKED this branch on
['R-SEC-01','R-SEC-02','R-TEST-06'] being touched but uncovered. Tests were authored;
the coverage rule was NOT narrowed.

=== THE FALSE GREEN (root cause) ===
`make -C ci gate` locally reported PASS having checked NOTHING. resolve_base() validated
nothing, and EVERY way of failing to find a base degraded silently to an empty touched
set + exit 0: an `HEAD~1` last resort, a two-dot diff fallback masking a failing
three-dot diff, and no check that HEAD is even AHEAD of the base. Run while sitting on
`main` (main == origin/main), `origin/main...HEAD` is empty -> "no changed files vs
base" -> the empty set means run.sh is invoked with NO --requirements -> coverage.py's
--require gate never runs at all. Green by vacuum.

Now: candidates are BASE_REF > GITHUB_BASE_REF > origin/main > main, each verified to
resolve. HEAD~1 and the two-dot fallback are gone. Unresolvable base / no merge base /
failed diff / HEAD-not-ahead -> loud banner, EMPTY stdout, exit 3, and a machine-readable
reason (on-base | no-base | diff-failed). gate.sh turns exit 3 into an UNDECIDED
decision: `on-base` -> "NOT APPLICABLE — no branch under gate" (exit 0 so push-to-main
runs don't break, but it never reads as PASS); `no-base`/`diff-failed` -> BLOCKED. It
also now prints the diff base it used. A stale local main warns (widens, never falsely
greens). Also fixed `make -C ci test`, which was SWALLOWING failing suites.

Regression: ci/tests/touched-requirements-base.test.sh — 31 assertions over 8
throwaway-repo scenarios including the exact false-green case, an already-merged branch,
no base ref, a single-commit repo, bogus BASE_REF, a shallow GITHUB_BASE_REF, and
origin/main-preferred-over-stale-main.

=== NEW L0 STATIC LAYER (conformance/tests/l0-static/) ===
Where docs/14 actually puts these invariants. Each check.sh really executes offline via
`run.sh --layer l0` and is wired into ci/l0.sh, so it runs on every PR. No scaffolds.

R-SEC-01 no-plaintext-secrets (165 assertions / 445 tracked files): .sops.yaml holds only
PUBLIC age recipients; every committed Secret is SOPS-wrapped with a mac and ENC[...]
values; ansible vault.yml files are $ANSIBLE_VAULT; no secret-valued ansible key carries
a literal outside a vault; no PEM key / age secret key / kubeconfig client-key-data is
tracked; Flux declares sops decryption; the disallow-plaintext-secrets policy Enforces
and has a proving `result: fail` row. Exemptions are SELF-POLICING, not path allowlists —
a .example must be referenced by no kustomization and hold only placeholders, and the
Kyverno fixture is exempt ONLY while a test asserts the policy rejects it. Proven against
7 injected violations, including deleting the negative row and weakening Enforce->Audit.

R-SEC-02 least-privilege-rbac (41 assertions): no wildcard apiGroup/resource/verb and no
escalate|bind|impersonate in any in-repo Role/ClusterRole; no ServiceAccount bound to
cluster-admin or a wildcard role; the conformance runner's own test identity is scoped
and holds no rights over RBAC objects; the default-deny/host-namespace/egress-class
policies Enforce and each carry a negative row. Proven against 6 injected violations.

R-TEST-06 spec-immutability-enforced (16 assertions): drives the REAL
ci/spec-immutability.sh against HERMETIC throwaway spec repos and asserts its exit code
in every state — clean-at-pin 0, edits under docs/ or decisions/ 1, untracked addition 1,
unadopted drift 1, explicit pin bump 0, ABSENT spec repo 3 (honest skip, never green),
unpinned SPEC_PIN 1 — plus that gate.sh sets BLOCK=1 on its failure, so the mechanism is
load-bearing. The real spec repo is never written to.

Each check documents what it does NOT cover (runtime decryption, git history, runtime
least-privilege, branch protection) rather than overclaiming. status.py now reads
check.sh too, so a placeholder L0 body still outranks an `executable: true` annotation.

Coverage 37/51 -> 40/51 (11 gaps); executable tests 32 -> 35; scaffold-only stays 5 —
no sixth scaffold was added.

Serves: R-SEC-01, R-SEC-02, R-TEST-01..06.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

conformance/lib/common.sh

@@ -47,7 +47,7 @@ conf_dirs_for_requirements() {
   done < <(conf_all_test_files) | sort -u
 }
 
-# Directories for a given layer (subtree): l1 | l2 | l3 | meta | all.
+# Directories for a given layer (subtree): l0 | l1 | l2 | l3 | meta | all.
 # Accepts a comma/space separated LIST of layers (e.g. "l2,l3") and returns the UNION of
 # their test dirs, deduplicated. A single layer keeps its prior behavior (backward compatible);
 # this is what lets `run.sh --layer l2,l3` (the ci/conformance.sh L2/L3 stage) select both
@@ -58,6 +58,7 @@ conf_dirs_for_layer() {
   for layer in ${layers//,/ }; do
     case "$layer" in
       all)  roots=("${CONF_ROOT}/tests"); break ;;
+      l0)   roots+=("${CONF_ROOT}/tests/l0-static") ;;
       l1)   roots+=("${CONF_ROOT}/tests/l1-rendering") ;;
       l2)   roots+=("${CONF_ROOT}/tests/l2-behavioral") ;;
       l3)   roots+=("${CONF_ROOT}/tests/l3-fault-injection") ;;

conformance/lib/coverage.py

@@ -115,7 +115,9 @@ def parse_test(path: Path) -> dict:
     # Layer inferred from path as a fallback / cross-check.
     rel = str(path)
     if not layer:
-        if "l1-rendering" in rel:
+        if "l0-static" in rel:
+            layer = "L0"
+        elif "l1-rendering" in rel:
             layer = "L1"
         elif "l2-behavioral" in rel:
             layer = "L2"

conformance/lib/emit_skipped_junit.py

@@ -33,7 +33,8 @@ def collect(path: Path) -> tuple[str, list[str], str]:
     reqs = sorted({m.group(1).upper() for m in
                    (LABEL_LINE_RE.match(l) for l in text.splitlines()) if m})
     rel = str(path)
-    layer = ("L1" if "l1-rendering" in rel else "L2" if "l2-behavioral" in rel
+    layer = ("L0" if "l0-static" in rel
+             else "L1" if "l1-rendering" in rel else "L2" if "l2-behavioral" in rel
              else "L3" if "l3-fault-injection" in rel else "META")
     return name, reqs, layer
 

conformance/lib/run_l1_offline.py

@@ -1,17 +1,24 @@
 #!/usr/bin/env python3
-"""Run the L1 *rendering* conformance checks OFFLINE (no cluster) and emit JUnit.
+"""Run the CLUSTER-INDEPENDENT conformance checks OFFLINE and emit JUnit.
 
-docs/14: "L1 rendering assertions run in CI without a cluster." L1 verifies the
-ServiceDefinition -> rendered-resources mapping against golden expectations; unlike L2/L3
-it needs no live cluster. Each l1-rendering test dir carries a `render-check.sh` (renderer
-+ golden diff + structural asserts). run.sh invokes this for `--layer l1` so those tests
-report a REAL pass/fail instead of being skipped with the cluster-gated layers.
+docs/14 puts two layers in CI with no cluster:
+  * L0 static/policy  -- "manifests/ServiceDefinitions obey invariants" (tests/l0-static/,
+                         each dir carrying a `check.sh`).
+  * L1 rendering      -- ServiceDefinition -> rendered resources vs golden expectations
+                         (tests/l1-rendering/, each dir carrying a `render-check.sh`).
+Both are executed here so they report a REAL pass/fail instead of being skipped with the
+cluster-gated layers. run.sh invokes this for `--layer l0`, `--layer l1`, and as the
+offline leg of a full run.
 
-Pure standard library (matches the harness's no-pip-dependency posture); the render checks
-themselves shell out to catalog/render.py (the renderer's PyYAML dependency lives there).
+Pure standard library (matches the harness's no-pip-dependency posture); the checks
+themselves shell out (render checks to catalog/render.py, whose PyYAML dependency lives
+there; L0 checks to git + PyYAML).
 
 Usage: run_l1_offline.py --junit <out.xml> [--label-prefix P] <test-dir> [<test-dir> ...]
-Exit 0 iff every selected render check passes.
+Exit 0 iff every selected offline check passes.
+
+The per-dir check script is whichever of `render-check.sh` / `check.sh` the directory
+carries; a dir with neither is reported SKIPPED (never a pass).
 """
 from __future__ import annotations
 
@@ -25,6 +32,19 @@ from xml.dom import minidom
 
 LABEL_LINE_RE_TMPL = r"^\s*{prefix}/(R-[A-Z0-9]+-[0-9]+)\s*:\s*[\"']?true"
 
+# The offline check script a test dir may carry, in preference order.
+CHECK_SCRIPTS = ("render-check.sh", "check.sh")
+
+
+def layer_of(d: Path) -> str:
+    """Layer for the JUnit properties, from the subtree the test lives in."""
+    rel = str(d)
+    if "l0-static" in rel:
+        return "L0"
+    if "l1-rendering" in rel:
+        return "L1"
+    return "OFFLINE"
+
 
 def collect_meta(test_yaml: Path, prefix: str):
     text = test_yaml.read_text() if test_yaml.exists() else ""
@@ -44,10 +64,11 @@ def main() -> int:
 
     cases = []  # (name, reqs, dir, rc, output)
     for d in args.dirs:
-        check = d / "render-check.sh"
+        check = next((d / s for s in CHECK_SCRIPTS if (d / s).exists()), None)
         name, reqs = collect_meta(d / "chainsaw-test.yaml", args.label_prefix)
-        if not check.exists():
-            cases.append((name, reqs, d, 3, f"no render-check.sh in {d}"))
+        if check is None:
+            cases.append((name, reqs, d, 3,
+                          f"no offline check script ({' or '.join(CHECK_SCRIPTS)}) in {d}"))
             continue
         proc = subprocess.run(
             ["bash", str(check)], capture_output=True, text=True
@@ -61,7 +82,7 @@ def main() -> int:
     suite = ET.Element(
         "testsuite",
         {
-            "name": "home-k3s-conformance L1 (offline render)",
+            "name": "home-k3s-conformance L0/L1 (offline)",
             "tests": str(len(cases)),
             "failures": str(failures),
             "errors": "0",
@@ -72,19 +93,21 @@ def main() -> int:
         tc = ET.SubElement(
             suite,
             "testcase",
-            {"classname": f"L1:{','.join(reqs) if reqs else 'UNTAGGED'}", "name": name},
+            {"classname": f"{layer_of(d)}:{','.join(reqs) if reqs else 'UNTAGGED'}",
+             "name": name},
         )
         props = ET.SubElement(tc, "properties")
         ET.SubElement(props, "property", {"name": "requirements", "value": ",".join(reqs)})
-        ET.SubElement(props, "property", {"name": "layer", "value": "L1"})
+        ET.SubElement(props, "property", {"name": "layer", "value": layer_of(d)})
         ET.SubElement(props, "property", {"name": "path", "value": str(d)})
         if rc == 3:
-            ET.SubElement(tc, "skipped", {"message": out or "no render-check.sh"})
+            ET.SubElement(tc, "skipped", {"message": out or "no offline check script"})
         elif rc != 0:
-            fail = ET.SubElement(tc, "failure", {"message": f"render-check exit {rc}"})
+            fail = ET.SubElement(tc, "failure", {"message": f"offline check exit {rc}"})
             fail.text = out
         status = "PASS" if rc == 0 else ("SKIP" if rc == 3 else "FAIL")
-        print(f"[l1-offline] {status:4s} {name} ({','.join(reqs) or 'untagged'})",
+        print(f"[offline] {layer_of(d):3s} {status:4s} {name} "
+              f"({','.join(reqs) or 'untagged'})",
               file=sys.stderr)
         if rc not in (0, 3):
             print(out, file=sys.stderr)
@@ -103,7 +126,7 @@ def main() -> int:
     args.junit.parent.mkdir(parents=True, exist_ok=True)
     xml = minidom.parseString(ET.tostring(root, "utf-8")).toprettyxml(indent="  ")
     args.junit.write_text(xml)
-    print(f"[l1-offline] wrote JUnit ({len(cases)} case(s), {failures} failure(s)) -> "
+    print(f"[offline] wrote JUnit ({len(cases)} case(s), {failures} failure(s)) -> "
           f"{args.junit}", file=sys.stderr)
     return 1 if failures else 0
 

conformance/lib/status.py

@@ -287,15 +287,22 @@ def classify_test(t: dict) -> dict:
       executable           annotated `conformance.home.k3s/executable: "true"` and no TODOs.
       executable-untagged  no TODOs and a real runnable body, but the annotation is
                            missing (true of the L1 render tests, which execute a
-                           render-check.sh + golden diff, and of the META self-check).
+                           render-check.sh + golden diff, of the L0 static checks, and
+                           of the META self-check).
                            Counted as executable, and flagged as an annotation gap.
       scaffold             anything else.
     """
     p = Path(t["path"])
     text = p.read_text() if p.is_file() else ""
+    # The offline assertion script a test dir may carry: `render-check.sh` (L1 rendering)
+    # or `check.sh` (L0 static). BOTH are read, so a placeholder body in either one still
+    # downgrades the test to a scaffold — an annotation must never outrank the body,
+    # whichever file the body lives in.
     extra = ""
-    if (p.parent / "render-check.sh").is_file():
-        extra = (p.parent / "render-check.sh").read_text()
+    for script in ("render-check.sh", "check.sh"):
+        sp = p.parent / script
+        if sp.is_file():
+            extra += sp.read_text()
     declared = bool(_EXECUTABLE_RE.search(text))
     has_todo = "TODO" in text or "TODO" in extra
     bm = _BLOCKED_RE.search(text)