# =============================================================================
# L1 RENDERING SCAFFOLD — every namespace renders a default-deny baseline
#                         (R-NET-01)
# Catalog: docs/14 L0/L1 "Every namespace has a default-deny baseline"
#
# GIVEN any onboarded service (any namespace),
# WHEN  its resources are rendered,
# THEN  the render includes the namespaced default-deny baseline policy.
#
# This is the RENDER-TIME partner of the L2 behavioral default-deny test and of
# the L0 Kyverno gate (T-0.5). Rendering the baseline is necessary but NOT
# sufficient — enforcement is proven behaviorally at L2 (R-TEST-01).
#
# STATUS: scaffold — needs T-0.3 (renderer) + T-2.2 (baseline definition).
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: default-deny-baseline-render
  labels:
    conformance.home.k3s/R-NET-01: "true"
  annotations:
    conformance.home.k3s/requirements: "R-NET-01"
    conformance.home.k3s/layer: "L1"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      Rendering any service's namespace yields a default-deny baseline policy.
spec:
  steps:
    - name: given-a-rendered-namespace
      try:
        - script:
            content: 'echo "TODO(T-0.3/T-2.2): render a service; capture namespaced policies"'
    - name: then-render-includes-default-deny
      try:
        - assert:
            file: golden/default-deny-baseline.expected.yaml   # TODO: author golden