# Synthetic static fixture — never deploy

These files contain no credentials, real certificate fingerprints, accepted
evidence, actual sandbox configuration or deployable image. The reserved
`registry.invalid` image reference and repeated test digests are deliberate.
`enabled=true` exists only to exercise the positive rendering branch. The normal
operator template remains `../qualification.disabled.json`, disabled and empty.

`synthetic-input.json` and the full six-resource `synthetic-manifest.json` are
compared by tests. Separate assertions check namespace isolation, resource
identity uniqueness, Deployment/Service/NetworkPolicy selection, ports, mounts,
Secret key references, file modes, exact SupervisorMain config keys, security,
finite resources, and the absence of a false native-cleanup liveness claim.
The local CLI test renders to a temporary file, refuses an overwrite, and refuses
the disabled template without output. It invokes no container or cluster tool.

These checks are not target Kubernetes OpenAPI/admission validation, actual CNI
enforcement, RuntimeClass qualification, resource measurements, or production
readiness. No fixture has been applied to a cluster.