T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l1-rendering/default-deny-baseline-render/chainsaw-test.yaml

@@ -0,0 +1,37 @@
+# =============================================================================
+# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
+#                         (R-NET-01)
+# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
+#
+# GIVEN any onboarded service (any namespace),
+# WHEN  its resources are rendered,
+# THEN  the render includes the namespaced default-deny baseline policy.
+#
+# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
+# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
+# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
+#
+# STATUS: scaffold — needs T-0.3 (renderer) + T-2.2 (baseline definition).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: default-deny-baseline-render
+  labels:
+    conformance.home.k3s/R-NET-01: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-NET-01"
+    conformance.home.k3s/layer: "L1"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      Rendering any service's namespace yields a default-deny baseline policy.
+spec:
+  steps:
+    - name: given-a-rendered-namespace
+      try:
+        - script:
+            content: 'echo "TODO(T-0.3/T-2.2): render a service; capture namespaced policies"'
+    - name: then-render-includes-default-deny
+      try:
+        - assert:
+            file: golden/default-deny-baseline.expected.yaml   # TODO: author golden