---
id: w7/m1/t007
title: "Test coverage — meaningful tests for label propagation + policy generation"
worker: worker7
status: done
estimate: 30m
depends_on: [w7/m1/t005]
---

## Objective

Add meaningful tests for the behavior this milestone shipped: the projector stamps workspace labels, the operator propagates them to pod templates (and datastore pods), and — if the ADR chose operator-reconciled policies — the generated NetworkPolicy objects carry the intended selectors/allows. Tests must assert real behavior and failure modes, never tautologies.

## Context

- Standing closing task (`.claude/commands/pm.md`).
- Operator tests are envtest-based (`make test` from `lego/operator/`); backend tests run with `go test ./...` from `lego/backend/`.
- Failure modes worth asserting: app without a workspace row (legacy) reconciles without the label; label survives spec updates; policy selectors don't match other workspaces' labels.

## Steps

1. Backend: projector test for label stamping (present, correct id, survives resync).
2. Operator: envtest for pod-template propagation + (if applicable) policy object generation.
3. Run both module test suites.

## Files

- `lego/backend/internal/store/` tests
- `lego/operator/internal/controller/` tests

## Acceptance criteria

- [ ] Tests fail if the workspace label is dropped from the projector or the pod template
- [ ] Legacy (label-less) apps covered
- [ ] `make test` (operator) and `go test ./...` (backend) pass

## Out of scope

- Live-cluster reachability (t005 owns that)
