T-0.4 Chainsaw conformance harness + coverage + behavior scaffolds (R-TEST-01..06)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

conformance/tests/l3-fault-injection/gitops-drift/chainsaw-test.yaml

@@ -0,0 +1,51 @@
+# =============================================================================
+# L3 FAULT-INJECTION SCAFFOLD — GitOps drift correction  (R-GITOPS-03)
+# Catalog: docs/14 "GitOps drift (R-GITOPS-03, L3)"
+#
+# GIVEN a reconciled resource,
+# WHEN  it is MUTATED live (out-of-band, simulating drift/click-ops),
+# THEN  Flux reverts it to the git-declared state within a bounded window.
+#
+# Fault-injection style: we deliberately corrupt live state and assert the control
+# loop heals it (converges back). `finally` leaves the resource in its declared
+# state regardless of outcome.
+#
+# STATUS: scaffold — needs T-1.4 (Flux bootstrapped) + a reconciled sample resource.
+# =============================================================================
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: gitops-drift
+  labels:
+    conformance.home.k3s/R-GITOPS-03: "true"
+  annotations:
+    conformance.home.k3s/requirements: "R-GITOPS-03"
+    conformance.home.k3s/layer: "L3"
+    conformance.home.k3s/safety-critical: "false"
+    conformance.home.k3s/intent: >-
+      A live mutation to a reconciled resource is reverted by Flux to git state.
+spec:
+  steps:
+    - name: given-a-reconciled-resource
+      try:
+        - script:
+            content: 'echo "TODO(T-1.4): pick a Flux-reconciled resource with a known git value"'
+    - name: when-mutate-live-out-of-band
+      try:
+        # FAULT INJECTION: patch the live resource to a value that differs from git.
+        - script:
+            content: |
+              set -euo pipefail
+              echo "TODO: kubectl patch the resource to a drifted value (e.g. replicas/annotation)"
+    - name: then-flux-reverts-to-git-state
+      try:
+        - script:
+            # Bounded poll: assert the live value returns to the git-declared value.
+            content: |
+              set -euo pipefail
+              echo "TODO: within Flux interval, assert live value == git-declared value"
+              echo "DRIFT_REVERTED_OK"
+            check: { ($stdout =~ 'DRIFT_REVERTED_OK'): true }
+      finally:
+        - script:
+            content: 'echo "TODO: ensure resource left in git-declared state"'