# =============================================================================
# L3 FAULT-INJECTION SCAFFOLD — Data survival on rebuild  (R-STATE-01)
#                               *SAFETY-CRITICAL*
# Catalog: docs/14 "Data survival (R-STATE-01, L3)"
#
# GIVEN a stateful service with written data (PVC on longhorn),
# WHEN  the workload is DESTROYED entirely and re-applied from git,
# THEN  the data is intact.
#
# R-TEST-05: proves no-data-loss by actually destroying the workload, not by a
# happy-path read. Applies to PaaS pods AND `kind: vm` disks (shared with
# R-PLAT-03 rebuild).
#
# STATUS: scaffold — needs T-2.1 (Longhorn StorageClass) + T-1.5 rebuild path.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: data-survival
  labels:
    conformance.home.k3s/R-STATE-01: "true"
  annotations:
    conformance.home.k3s/requirements: "R-STATE-01"
    conformance.home.k3s/layer: "L3"
    conformance.home.k3s/safety-critical: "true"
    conformance.home.k3s/intent: >-
      Destroy the workload entirely and re-apply from git; written data survives.
spec:
  steps:
    - name: given-stateful-workload-with-written-data
      try:
        - apply:
            file: fixtures/stateful-app.yaml   # TODO(T-2.1): PVC on longhorn + writer
        - script:
            content: |
              set -euo pipefail
              kubectl -n "$NAMESPACE" exec app -- \
                sh -c 'echo conformance-canary-$(date +%s) > /data/canary && sync'
              kubectl -n "$NAMESPACE" exec app -- cat /data/canary
    - name: when-destroy-workload-entirely
      try:
        # FAULT INJECTION: delete the workload (NOT the PVC) — simulate rebuild.
        - script:
            content: |
              set -euo pipefail
              echo "TODO(T-1.5): delete Deployment/pod entirely; keep PVC; re-apply from git"
    - name: then-data-is-intact-after-reapply
      try:
        - script:
            content: |
              set -euo pipefail
              val=$(kubectl -n "$NAMESPACE" exec app -- cat /data/canary)
              echo "recovered=$val"
              case "$val" in conformance-canary-*) echo DATA_SURVIVED_OK ;; *) exit 1 ;; esac
            check: { ($stdout =~ 'DATA_SURVIVED_OK'): true }