---
id: w7/m2/t004
title: "Verification: hostile spec rejected, no SA token, build limits, samples still Ready"
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m2/t002, w7/m2/t003]
---

## Objective

Prove the milestone's DoD end to end on a live cluster: a hostile pod spec is rejected at admission, a reconciled tenant pod carries the hardened spec and no SA token, build Jobs are bounded, and both example apps deploy Ready unchanged.

## Context

- Mock cluster via `scripts/mock-cluster.sh`; samples via `examples/whoami-app.yaml` + `scripts/deploy-sample.sh` (hello-go, exercises the build path).
- Checks are `kubectl`-scriptable — fold them into `scripts/verify-tenant-isolation.sh` (w7/m1/t005) as a second section rather than a separate script, so one command proves both milestones.

## Steps

1. Apply a privileged + hostPath pod spec to the apps namespace → expect PSS rejection.
2. Deploy both samples; inspect the running pods: no SA token volume, RuntimeDefault seccomp, dropped caps; inspect the build Job for resource limits.
3. Wire the checks into the verification script; run the whole thing green.

## Files

- `scripts/verify-tenant-isolation.sh` (extend)

## Acceptance criteria

- [ ] Hostile spec rejected with a PSS admission message
- [ ] Running tenant pod shows the t002 spec (no SA token mount) and build Job shows t003 limits
- [ ] `whoami` + `hello-go` reach Ready and serve

## Out of scope

- Network probes (m1's half of the script)
