T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l1-rendering/default-deny-baseline-render/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+# =============================================================================
+# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
+#                         (R-NET-01)
+# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
+#
+# GIVEN any onboarded service (any namespace),
+# WHEN  its resources are rendered,
+# THEN  the render includes the namespaced default-deny baseline policy.
+#
+# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
+# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
+# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
+#
+# STATUS: scaffold — needs T-0.3 (renderer) + T-2.2 (baseline definition).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: default-deny-baseline-render
+  labels:
+    conformance.home.k3s/R-NET-01: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-NET-01"
+    conformance.home.k3s/layer: "L1"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      Rendering any service's namespace yields a default-deny baseline policy.
+spec:
+  steps:
+    - name: given-a-rendered-namespace
+      try:
+        - script:
+            content: 'echo "TODO(T-0.3/T-2.2): render a service; capture namespaced policies"'
+    - name: then-render-includes-default-deny
+      try:
+        - assert:
+            file: golden/default-deny-baseline.expected.yaml   # TODO: author golden

conformance/tests/l1-rendering/egress-class-render/chainsaw-test.yaml

@@ -0,0 +1,51 @@
+# =============================================================================
+# L1 RENDERING SCAFFOLD — egress class renders the kill-switched path
+#                         (R-NET-05, R-NET-06, R-NET-07)
+# Catalog: docs/14 L1 example "`egress: vpn` renders the kill-switched egress path"
+#
+# L1 verifies the ServiceDefinition -> rendered-resources mapping matches golden
+# expectations, WITHOUT asserting runtime behavior. This is NOT a substitute for
+# the L2/L3 behavior tests (R-TEST-01): rendering the policy != enforcing it.
+#
+# GIVEN a ServiceDefinition with `egress: vpn`,
+# WHEN  the renderer produces resources,
+# THEN  the output includes the egress-gateway steering + kill-switch construct
+#       (and `egress: internet` does NOT), and flipping the class only changes the
+#       egress path (R-NET-07), not the workload spec.
+#
+# STATUS: scaffold — needs T-0.3 (renderer contract) + T-3.1/T-3.2 (egress design).
+# Rendering assertions can run without live behavior, but Chainsaw applies to a
+# cluster; until Phase 1 this is skipped by run.sh like every other layer.
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: egress-class-render
+  labels:
+    conformance.home.k3s/R-NET-05: "true"
+    conformance.home.k3s/R-NET-06: "true"
+    conformance.home.k3s/R-NET-07: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-NET-05, R-NET-06, R-NET-07"
+    conformance.home.k3s/layer: "L1"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      egress: vpn renders the egress-gateway + kill-switch path; internet does not.
+spec:
+  steps:
+    - name: given-vpn-servicedefinition-render
+      try:
+        - script:
+            # TODO(T-0.3): invoke the renderer on a fixture ServiceDefinition
+            # (egress: vpn) and capture rendered YAML to $RENDER_OUT.
+            content: 'echo "TODO: render fixtures/svcdef-egress-vpn.yaml -> rendered.yaml"'
+    - name: then-render-contains-killswitched-egress
+      try:
+        - assert:
+            # TODO(T-3.x): assert the rendered set includes the egress-gateway
+            # steering + kill-switch construct for a vpn-class workload.
+            file: golden/egress-vpn.expected.yaml   # TODO: author golden file
+    - name: then-internet-render-omits-vpn-path
+      try:
+        - script:
+            content: 'echo "TODO: render egress: internet fixture; assert NO vpn/gateway steer"'