f0d695ec97
Save the current implementation and README, status, and known-issue documentation at the user-requested stop. No completed release or deployment is claimed. Co-Authored-By: Claude <noreply@anthropic.com> Co-Authored-By: GPT-6 Codex <noreply@openai.com>
Synthetic static fixture — never deploy
These files contain no credentials, real certificate fingerprints, accepted
evidence, actual sandbox configuration or deployable image. The reserved
registry.invalid image reference and repeated test digests are deliberate.
enabled=true exists only to exercise the positive rendering branch. The normal
operator template remains ../qualification.disabled.json, disabled and empty.
synthetic-input.json and the full six-resource synthetic-manifest.json are
compared by tests. Separate assertions check namespace isolation, resource
identity uniqueness, Deployment/Service/NetworkPolicy selection, ports, mounts,
Secret key references, file modes, exact SupervisorMain config keys, security,
finite resources, and the absence of a false native-cleanup liveness claim.
The local CLI test renders to a temporary file, refuses an overwrite, and refuses
the disabled template without output. It invokes no container or cluster tool.
These checks are not target Kubernetes OpenAPI/admission validation, actual CNI enforcement, RuntimeClass qualification, resource measurements, or production readiness. No fixture has been applied to a cluster.