# =============================================================================
# L2 BEHAVIORAL SCAFFOLD — Onboarding completeness  (WS-APPS; R-GITOPS-02)
# Catalog: docs/14 "Onboarding completeness (WS-APPS)"
#
# GIVEN only a merged ServiceDefinition (no manual steps beyond merge),
# THEN  the service is fully wired: compute + storage + policy + egress + TLS +
#       DNS + monitoring + update — asserted by the UNION of the relevant tests
#       above run against that specific service.
#
# This is an AGGREGATE gate: it composes the other behavior tests (default-deny,
# deny-undeclared, egress-class, trusted-tls, dns-exposure, data-survival,
# alerting, hands-off-update) scoped to one onboarded service. It maps to
# R-GITOPS-02 ("onboarding = a versioned catalog change") — the machine-checkable
# proxy for the WS-APPS "fully wired from ServiceDefinition alone" gate.
#
# STATUS: scaffold — meaningful only once the composed tests + a real onboarded
# service exist (Phase 6, T-6.*).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: onboarding-completeness
  labels:
    conformance.home.k3s/R-GITOPS-02: "true"
  annotations:
    conformance.home.k3s/requirements: "R-GITOPS-02"
    conformance.home.k3s/layer: "L2"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      From a merged ServiceDefinition alone, the service is fully wired with no
      manual step (union of compute/storage/policy/egress/TLS/DNS/obs/update tests).
    conformance.home.k3s/composes: >-
      default-deny, deny-undeclared, egress-class, trusted-tls, dns-exposure,
      data-survival, alerting, hands-off-update
spec:
  steps:
    - name: given-only-a-merged-servicedefinition
      try:
        - script:
            content: 'echo "TODO(T-6.*): apply ONE ServiceDefinition; perform NO manual steps"'
    - name: then-fully-wired-union-of-behaviors
      try:
        - script:
            # Each line below is a scoped invocation of the corresponding behavior
            # check against the onboarded service; ALL must pass for completeness.
            content: |
              set -euo pipefail
              echo "TODO: assert compute up (pods/VM Running)"
              echo "TODO: assert PVC bound on longhorn/bulk (not ephemeral)"
              echo "TODO: assert default-deny + declared dependencies only"
              echo "TODO: assert egress class as declared"
              echo "TODO: assert DNS record + trusted TLS"
              echo "TODO: assert metrics/logs flowing + alert defined"
              echo "TODO: assert update policy present"
              echo "NO manual step was required beyond git merge"