# =============================================================================
# L3 FAULT-INJECTION SCAFFOLD — breaking registry access produces failed targets and the coverage alert  (R-VULN-03, R-VULN-06)
# Catalog: docs/17 "Acceptance gates" (L3).
#
# With registry access broken for one image, that target becomes failed with its reason, prior findings are retained, and VulnCoverageGap fires after 24h.
#
# STATUS: scaffold only. It asserts nothing and DOES NOT EXECUTE IN CI: vars.CLUSTER_AVAILABLE is unset,
# so L2/L3 conformance does not run. Coverage from this file is a named gap, not evidence.
# =============================================================================
apiVersion: chainsaw.kyverno.io/v1alpha1
kind: Test
metadata:
  name: vuln-registry-failure
  labels:
    conformance.home.k3s/R-VULN-03: "true"
    conformance.home.k3s/R-VULN-06: "true"
  annotations:
    conformance.home.k3s/requirements: "R-VULN-03, R-VULN-06"
    conformance.home.k3s/layer: "L3"
    conformance.home.k3s/safety-critical: "false"
    conformance.home.k3s/intent: >-
      With registry access broken for one image, that target becomes failed with its reason, prior findings are retained, and VulnCoverageGap fires after 24h.
spec:
  steps:
    - name: given-a-scanned-target
      try:
        - script:
            content: 'echo "TODO: record a scanned target and its findings"'
    - name: when-registry-access-is-broken
      try:
        - script:
            content: 'echo "TODO: inject a fault blocking that registry"'
    - name: then-target-failed
      try:
        - script:
            content: 'echo "TODO: assert state failed, reason present, findings retained, run continues"'
    - name: then-coverage-alert-fires
      try:
        - script:
            content: 'echo "TODO: assert VulnCoverageGap fires once the failure passes 24h"'