T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l2-behavioral/onboarding-completeness/chainsaw-test.yaml

@@ -0,0 +1,55 @@
+# =============================================================================
+# L2 BEHAVIORAL SCAFFOLD — Onboarding completeness  (WS-APPS; R-GITOPS-02)
+# Catalog: docs/14 "Onboarding completeness (WS-APPS)"
+#
+# GIVEN only a merged ServiceDefinition (no manual steps beyond merge),
+# THEN  the service is fully wired: compute + storage + policy + egress + TLS +
+#       DNS + monitoring + update — asserted by the UNION of the relevant tests
+#       above run against that specific service.
+#
+# This is an AGGREGATE gate: it composes the other behavior tests (default-deny,
+# deny-undeclared, egress-class, trusted-tls, dns-exposure, data-survival,
+# alerting, hands-off-update) scoped to one onboarded service. It maps to
+# R-GITOPS-02 ("onboarding = a versioned catalog change") — the machine-checkable
+# proxy for the WS-APPS "fully wired from ServiceDefinition alone" gate.
+#
+# STATUS: scaffold — meaningful only once the composed tests + a real onboarded
+# service exist (Phase 6, T-6.*).
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: onboarding-completeness
+  labels:
+    conformance.home.k3s/R-GITOPS-02: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-GITOPS-02"
+    conformance.home.k3s/layer: "L2"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      From a merged ServiceDefinition alone, the service is fully wired with no
+      manual step (union of compute/storage/policy/egress/TLS/DNS/obs/update tests).
+    conformance.home.k3s/composes: >-
+      default-deny, deny-undeclared, egress-class, trusted-tls, dns-exposure,
+      data-survival, alerting, hands-off-update
+spec:
+  steps:
+    - name: given-only-a-merged-servicedefinition
+      try:
+        - script:
+            content: 'echo "TODO(T-6.*): apply ONE ServiceDefinition; perform NO manual steps"'
+    - name: then-fully-wired-union-of-behaviors
+      try:
+        - script:
+            # Each line below is a scoped invocation of the corresponding behavior
+            # check against the onboarded service; ALL must pass for completeness.
+            content: |
+              set -euo pipefail
+              echo "TODO: assert compute up (pods/VM Running)"
+              echo "TODO: assert PVC bound on longhorn/bulk (not ephemeral)"
+              echo "TODO: assert default-deny + declared dependencies only"
+              echo "TODO: assert egress class as declared"
+              echo "TODO: assert DNS record + trusted TLS"
+              echo "TODO: assert metrics/logs flowing + alert defined"
+              echo "TODO: assert update policy present"
+              echo "NO manual step was required beyond git merge"