# =============================================================================
# L0 STATIC — a placeholder value in cluster-vars is REFUSED by the guard that owns it
# Catalog: docs/14 L0 row ("Pre-apply, in CI") — runs WITHOUT a cluster.
#
# THE BUG CLASS THIS CLOSES (it has now bitten three times in one file). A guard in
# `bootstrap/standup.sh` keys on the SHAPE of a value that lives in
# `clusters/base/cluster-vars.yaml`, and nothing tied the two together. On 2026-09-05 the
# S3 placeholder changed from `TBD-PROD-S3-BACKUP-ENDPOINT` to
# `https://TBD-R2-ACCOUNT-ID.r2.cloudflarestorage.com`; the three guards matched the glob
# `TBD-*`, a PREFIX match, and `fnmatch('https://TBD-R2-…','TBD-*')` is False. All three
# guards silently stopped matching, and `standup.sh resume` would have resumed `velero` on
# prod against a nonexistent hostname: installs clean, reports healthy, NO BACKUPS EXIST.
# It was found by accident. The guard is fixed (`s3_is_placeholder`, substring); the
# COUPLING was untested, which is what makes the class reintroducible.
#
# GIVEN the repository as authored,
# WHEN  the REAL predicate is extracted from bootstrap/standup.sh and executed by bash
#       (never reimplemented — see check.sh "HOW THE REAL GUARD IS EXERCISED"),
# THEN  (1) every authored value of a guarded knob that is placeholder-shaped by an
#           INDEPENDENT detector is actually refused by that guard, in base and in every
#           environment overlay;
#       (2) no environment overlay carries a placeholder-shaped value for a knob no guard
#           refuses;
#       (3) every function in standup.sh that reads a guarded knob applies the guard to it
#           (the "three guards died at once" regression);
#       (4) the guard matches its own vocabulary ANYWHERE in a value, not just as a prefix
#           — the exact anchoring defect above — and still accepts a real endpoint;
#   AND (5) the extraction is faithful, and the check fails LOUDLY rather than silently
#           testing a copy if the guard stops being a self-contained predicate.
#
# STATUS: EXECUTABLE. `check.sh` is a pure offline assertion script (standard library +
# PyYAML + bash); conformance/run.sh --layer l0 runs it directly and this Chainsaw Test
# wraps the SAME script.
#
# NOT proven: that the endpoint is REACHABLE or that backups exist (runtime facts —
# `standup.sh s3check` probes the former from a pod, l3-fault-injection/dr-restore proves
# the latter); that guards for knobs OTHER than the placeholder-refusing ones are correct;
# and that the guard runs at all in a real standup (the dispatch path is shell, executed
# only against a live cluster). R-STATE-03 is tagged for the narrow static slice only: the
# authored backup target cannot be a placeholder that the guard fails to recognise.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: placeholder-guard-coupling
  labels:
    conformance.home.k3s/R-ENV-02: "true"
    conformance.home.k3s/R-STATE-03: "true"
  annotations:
    conformance.home.k3s/requirements: "R-ENV-02, R-STATE-03"
    conformance.home.k3s/layer: "L0"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/executable: "true"
    conformance.home.k3s/intent: >-
      Every placeholder-shaped value authored in cluster-vars, for any environment
      overlay, is actually recognised as a placeholder by the real bootstrap guard that
      is supposed to refuse it — so a value change in one file cannot silently disarm a
      guard in another and enable velero against an endpoint that does not exist.
spec:
  steps:
    - name: couple-authored-placeholders-to-the-real-guard
      description: >-
        Extract the real placeholder predicate from bootstrap/standup.sh, run it against
        every authored cluster-vars value the repo actually carries, and assert the guard
        refuses each one an independent detector calls a placeholder.
      try:
        - script:
            content: bash ./check.sh