diff --git a/.github/workflows/test-e2e-federated.yml b/.github/workflows/test-e2e-federated.yml
new file mode 100644
index 00000000..03966f2b
--- /dev/null
+++ b/.github/workflows/test-e2e-federated.yml
@@ -0,0 +1,128 @@
+name: Federated E2E
+
+# Exercises the production-fidelity edge: two kind clusters (control plane + edge)
+# wired with real Karmada federation, the production Envoy Gateway version, the
+# Coraza WAF data plane, and the NSO extension server — then runs the edge e2e
+# scenarios against real traffic. This is the path the older single-stack
+# `make test-e2e` never covered.
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'Taskfile.test-infra.yml'
+      - 'config/e2e-downstream/**'
+      - 'config/federation/**'
+      - 'config/tools/**'
+      - 'config/extension-server/**'
+      - 'internal/extensionserver/**'
+      - 'cmd/**'
+      - 'test/e2e-edge/**'
+      - 'test/parity/**'
+      - '.github/workflows/test-e2e-federated.yml'
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+# One federated run per ref; a newer push cancels an in-flight one.
+concurrency:
+  group: federated-e2e-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  federated-e2e:
+    name: Two-cluster federated edge (Karmada)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      TMPDIR: /tmp
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '~1.26'
+
+      # Two kind clusters plus a full Karmada control plane and the edge data
+      # plane need more room than the runner ships with. Reclaim disk from
+      # toolchains this job never uses.
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /opt/hostedtoolcache/CodeQL
+          docker system prune -af || true
+          df -h /
+
+      # Karmada plus two clusters open a large number of file watches; the
+      # default runner limits crashloop a component with "too many open files".
+      - name: Raise inotify limits
+        run: |
+          sudo sysctl -w fs.inotify.max_user_instances=8192
+          sudo sysctl -w fs.inotify.max_user_watches=1048576
+
+      - name: Install Task
+        run: |
+          go install github.com/go-task/task/v3/cmd/task@v3.49.1
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+
+      - name: Install pinned tools (kind, karmadactl, kustomize, cmctl, chainsaw)
+        run: task test-infra:tools
+
+      - name: Bring up the two-cluster prod-fidelity env
+        run: task test-infra:up
+
+      - name: Stand up Karmada federation
+        run: task test-infra:karmada-up
+
+      - name: Run edge e2e scenarios
+        run: task test-infra:e2e
+
+      # When something fails, capture enough cross-cluster state to diagnose it
+      # from the logs alone — the runner is torn down immediately after.
+      - name: Diagnostics on failure
+        if: failure()
+        run: |
+          set +e
+          echo "::group::upstream pods"
+          kubectl --context kind-nso-upstream get pods -A -o wide
+          echo "::endgroup::"
+          echo "::group::downstream pods"
+          kubectl --context kind-nso-downstream get pods -A -o wide
+          echo "::endgroup::"
+          echo "::group::not-ready pods — describe (both clusters)"
+          for ctx in kind-nso-upstream kind-nso-downstream; do
+            echo "### $ctx"
+            kubectl --context "$ctx" get pods -A \
+              --field-selector=status.phase!=Running,status.phase!=Succeeded \
+              -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}' \
+              | while read -r ns name; do
+              [ -n "$name" ] || continue
+              kubectl --context "$ctx" -n "$ns" describe pod "$name" 2>/dev/null | tail -30
+            done
+          done
+          echo "::endgroup::"
+          echo "::group::cert-manager health (upstream) — restarts + issuance"
+          kubectl --context kind-nso-upstream -n cert-manager get pods -o wide
+          kubectl --context kind-nso-upstream -n cert-manager \
+            logs -l app.kubernetes.io/name=cert-manager --tail=80 --previous 2>/dev/null || true
+          kubectl --context kind-nso-upstream get certificate,certificaterequest,issuer,clusterissuer -A
+          echo "::endgroup::"
+          echo "::group::karmada member clusters"
+          KCFG=/tmp/karmada-nso-upstream/karmada-apiserver.config
+          kubectl --kubeconfig "$KCFG" --context karmada-apiserver get clusters -o wide
+          kubectl --kubeconfig "$KCFG" --context karmada-apiserver get clusterpropagationpolicy,work -A
+          echo "::endgroup::"
+          echo "::group::NSO manager logs (upstream)"
+          kubectl --context kind-nso-upstream -n network-services-operator-system \
+            logs deploy/network-services-operator-controller-manager --tail=200
+          echo "::endgroup::"
+          echo "::group::extension server logs (downstream)"
+          kubectl --context kind-nso-downstream -n network-services-operator-system \
+            logs deploy/network-services-operator-envoy-gateway-extension-server --tail=200
+          echo "::endgroup::"
+          echo "::group::downstream Envoy Gateway logs"
+          kubectl --context kind-nso-downstream -n datum-downstream-gateway \
+            logs deploy/envoy-gateway --tail=200
+          echo "::endgroup::"
diff --git a/Taskfile.test-infra.yml b/Taskfile.test-infra.yml
new file mode 100644
index 00000000..37c56658
--- /dev/null
+++ b/Taskfile.test-infra.yml
@@ -0,0 +1,481 @@
+version: '3'
+
+# Production-fidelity test environment. Two kind clusters: nso-upstream (the
+# control plane) and nso-downstream (the edge). Consumed by both the e2e and perf
+# suites.
+#
+# Bring up:   task test-infra:up
+# Tear down:  task test-infra:down
+# Smoke:      task test-infra:smoke
+
+# kustomize fetches some CRDs over https. A developer's global git config can
+# rewrite https to ssh, which fails in a non-interactive fetch. Neutralize the
+# global git config for kustomize's child git so the https fetches succeed; the
+# repo-local config is untouched.
+env:
+  GIT_CONFIG_GLOBAL: /dev/null
+
+vars:
+  TMP_DIR:
+    sh: echo "${TMPDIR:-/tmp}"
+  REPO:
+    sh: pwd
+  # Pinned-to-prod tooling. We use an explicit kind v0.32.0 binary because it
+  # ships the node image production runs, which the checked-in bin/kind predates.
+  KIND: '{{.REPO}}/bin/kind-v0.32.0'
+  KUSTOMIZE: '{{.REPO}}/bin/kustomize'
+  CMCTL: '{{.REPO}}/bin/cmctl'
+  KARMADACTL: '{{.REPO}}/bin/karmadactl'
+  CHAINSAW: '{{.REPO}}/bin/chainsaw'
+
+  UPSTREAM_CLUSTER: nso-upstream
+  DOWNSTREAM_CLUSTER: nso-downstream
+  UPSTREAM_CTX: kind-nso-upstream
+  DOWNSTREAM_CTX: kind-nso-downstream
+
+  # The exact node image the production edge runs.
+  K8S_NODE_IMAGE: kindest/node:v1.35.5@sha256:ce977ae6d65918d0b58a5f8b5e940429c2ce42fa3a5619ec2bbc60b949c0ac95
+  # Gateway control-plane version, matching production. The extension-server SDK
+  # version is paired with it deliberately, also matching production.
+  ENVOY_GATEWAY_VERSION: v1.7.4
+  EG_SDK_VERSION: v1.8.1
+  # Multi-arch WAF image — the same filter as the production edge, but it also
+  # loads natively on arm64 dev hosts. The data plane references this image.
+  CORAZA_WAF_IMAGE: ghcr.io/datum-labs/coraza-envoy-go-filter/coraza-waf:v1.3.0-multiarch.1
+  # CONNECT-proxy stand-in for the connector-tunnel scenario, built from
+  # test/e2e-edge/_fixtures/connector-tunnel and loaded into the downstream cluster.
+  CONNECT_PROXY_IMAGE: connect-proxy:e2e
+  # The WAF is enabled by default since the multi-arch image loads on every
+  # architecture. Set CORAZA_DISABLED=true only to deliberately skip the WAF.
+  CORAZA_DISABLED: '{{.CORAZA_DISABLED | default "false"}}'
+  # Karmada-bundled kube-apiserver, pinned to production.
+  KARMADA_APISERVER_VERSION: v1.33.2
+  # NSO image pinned by git SHA so the loaded image is used deterministically.
+  IMG:
+    sh: echo "ghcr.io/datum-cloud/network-services-operator:$(git rev-parse --short HEAD)"
+
+tasks:
+
+  tools:
+    desc: "Install the pinned tool binaries this env needs into bin/ (kind v0.32.0, karmadactl, kustomize, cmctl, chainsaw). Idempotent — skips any that are already present. Runs on CI; a local dev can run it once instead of hand-placing the binaries."
+    vars:
+      # kind is pinned to the version that ships the production edge node image;
+      # the others match the versions the Makefile installs.
+      KIND_TOOL_VERSION: v0.32.0
+      KARMADACTL_VERSION: v1.15.2
+      KUSTOMIZE_VERSION: v5.5.0
+      CMCTL_VERSION: v2.1.1
+      CHAINSAW_VERSION: v0.2.15
+    cmds:
+      - mkdir -p {{.REPO}}/bin
+      # go install writes bin/kind; rename it to the versioned path the env pins.
+      - |
+        if [ ! -x {{.REPO}}/bin/kind-{{.KIND_TOOL_VERSION}} ]; then
+          echo "installing kind {{.KIND_TOOL_VERSION}}"
+          GOBIN={{.REPO}}/bin go install sigs.k8s.io/kind@{{.KIND_TOOL_VERSION}}
+          mv {{.REPO}}/bin/kind {{.REPO}}/bin/kind-{{.KIND_TOOL_VERSION}}
+        fi
+      # kustomize / cmctl / chainsaw go-install directly under their plain names,
+      # which is exactly what this Taskfile references.
+      - '[ -x {{.REPO}}/bin/kustomize ] || GOBIN={{.REPO}}/bin go install sigs.k8s.io/kustomize/kustomize/v5@{{.KUSTOMIZE_VERSION}}'
+      - '[ -x {{.REPO}}/bin/cmctl ] || GOBIN={{.REPO}}/bin go install github.com/cert-manager/cmctl/v2@{{.CMCTL_VERSION}}'
+      - '[ -x {{.REPO}}/bin/chainsaw ] || GOBIN={{.REPO}}/bin go install github.com/kyverno/chainsaw@{{.CHAINSAW_VERSION}}'
+      # karmadactl carries replace directives in its go.mod, so `go install` can't
+      # build it; pull the published release binary for this OS/arch instead.
+      - |
+        if [ ! -x {{.REPO}}/bin/karmadactl ]; then
+          url="https://github.com/karmada-io/karmada/releases/download/{{.KARMADACTL_VERSION}}/karmadactl-{{OS}}-{{ARCH}}.tgz"
+          echo "downloading karmadactl {{.KARMADACTL_VERSION}} ({{OS}}/{{ARCH}})"
+          curl -fsSL "$url" | tar -xz -C {{.REPO}}/bin karmadactl
+        fi
+      - echo "✅ tools ready in {{.REPO}}/bin"
+
+  up:
+    desc: "Bring the canonical two-cluster prod-fidelity test env ONLINE (clusters + EG v1.7.4 + ext-server + Coraza data plane + NSO manager)."
+    cmds:
+      - echo "🚀 test-infra:up — building nso-upstream + nso-downstream"
+      - task: clusters
+      # The gateway CRDs live inside the Envoy Gateway helm chart, which is
+      # gitignored (config/**/charts). Pull it first so eg-crds can apply them —
+      # on a dev machine it is already vendored, on CI it is fetched fresh.
+      - task: eg-chart
+      # The Gateway-API and gateway CRDs must land on the downstream cluster
+      # before cert-manager (it probes the Gateway-API CRDs at startup) and before
+      # the downstream gateway (it needs its own CRDs present).
+      - task: eg-crds
+      - task: downstream-crds
+      - task: downstream-namespaces
+      # cert-manager runs with enableGatewayAPI:true and crashloops at startup if
+      # the Gateway-API CRDs are absent. The downstream gets them from eg-crds; the
+      # upstream otherwise wouldn't until prepare-upstream (config/e2e), far too
+      # late — the crashloop delays the manager's webhook cert and stalls bring-up.
+      - task: upstream-gateway-crds
+      - task: cert-manager-upstream
+      - task: cert-manager-downstream
+      - task: nso-image
+      - task: load-fixtures
+      - task: prepare-upstream
+      - task: eg-downstream
+      - task: extension-server
+      - task: external-dns
+      - task: link-clusters
+      - task: wait-ready
+      - echo "🎉 test-infra:up complete. Run 'task test-infra:smoke' to confirm M2."
+
+  down:
+    desc: "Tear down the test-infra clusters (and any Karmada host)."
+    cmds:
+      - echo "💥 test-infra:down"
+      # Deleting both kind clusters removes all federation state, so this unjoin
+      # is only a best-effort courtesy.
+      - '{{.KARMADACTL}} deinit --context {{.UPSTREAM_CTX}} --force --purge-namespace 2>/dev/null || true'
+      - rm -rf {{.TMP_DIR}}/karmada-{{.UPSTREAM_CLUSTER}}
+      - '{{.KIND}} delete cluster --name {{.UPSTREAM_CLUSTER}} || true'
+      - '{{.KIND}} delete cluster --name {{.DOWNSTREAM_CLUSTER}} || true'
+      - rm -f {{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}-internal.yaml {{.TMP_DIR}}/.kind-{{.UPSTREAM_CLUSTER}}.yaml {{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}.yaml
+      - echo "✨ done."
+
+  clusters:
+    desc: "Create the upstream + downstream kind clusters pinned to the prod edge node image."
+    cmds:
+      - echo "🏗️ creating clusters (node {{.K8S_NODE_IMAGE}})"
+      - '{{.KIND}} delete cluster --name {{.UPSTREAM_CLUSTER}} 2>/dev/null || true'
+      - '{{.KIND}} delete cluster --name {{.DOWNSTREAM_CLUSTER}} 2>/dev/null || true'
+      - '{{.KIND}} create cluster --image {{.K8S_NODE_IMAGE}} --config=config/tools/kind/upstream-cluster.yaml'
+      - '{{.KIND}} create cluster --image {{.K8S_NODE_IMAGE}} --config=config/tools/kind/downstream-cluster.yaml'
+      # Running the full federation control plane alongside the rest of the stack
+      # in one kind node exhausts the default file-watch limits on the macOS
+      # Docker VM, which crashloops a component with "too many open files" and
+      # blocks the member join. Raise the limits on both nodes.
+      - docker exec {{.UPSTREAM_CLUSTER}}-control-plane sysctl -w fs.inotify.max_user_instances=8192 fs.inotify.max_user_watches=1048576
+      - docker exec {{.DOWNSTREAM_CLUSTER}}-control-plane sysctl -w fs.inotify.max_user_instances=8192 fs.inotify.max_user_watches=1048576
+
+  cert-manager-upstream:
+    desc: "Install cert-manager (+ CSI driver) on the upstream cluster."
+    cmds:
+      - '{{.KUSTOMIZE}} build --enable-helm config/tools/cert-manager | kubectl --context {{.UPSTREAM_CTX}} apply --server-side=true --force-conflicts -f -'
+      - '{{.CMCTL}} check api --context {{.UPSTREAM_CTX}} --wait=5m'
+
+  cert-manager-downstream:
+    desc: "Install cert-manager (+ CSI driver) on the downstream cluster."
+    cmds:
+      - '{{.KUSTOMIZE}} build --enable-helm config/tools/cert-manager | kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f -'
+      - '{{.CMCTL}} check api --context {{.DOWNSTREAM_CTX}} --wait=5m'
+
+  nso-image:
+    desc: "Build the NSO operator image (git-SHA tag) and load it into both clusters."
+    cmds:
+      - echo "🔨 building {{.IMG}}"
+      - docker build -t {{.IMG}} .
+      - cd config/manager && {{.KUSTOMIZE}} edit set image ghcr.io/datum-cloud/network-services-operator={{.IMG}}
+      - '{{.KIND}} load docker-image {{.IMG}} --name {{.UPSTREAM_CLUSTER}}'
+      - '{{.KIND}} load docker-image {{.IMG}} --name {{.DOWNSTREAM_CLUSTER}}'
+
+  prepare-upstream:
+    desc: "Deploy the NSO manager + webhook (config/e2e) on the upstream cluster, with the prod-base memory profile."
+    cmds:
+      - echo "🔧 deploying NSO manager (upstream)"
+      - '{{.KUSTOMIZE}} build config/e2e | kubectl --context {{.UPSTREAM_CTX}} apply --server-side=true --force-conflicts -f -'
+      # Match production: with the extension server handling proxy configuration,
+      # NSO must not also emit its own patch policies. The shared config file is
+      # also used by an older path that still relies on them, so we patch the live
+      # config here rather than editing that file.
+      - |
+        CFG=$(kubectl --context {{.UPSTREAM_CTX}} -n network-services-operator-system get cm network-services-operator-config -o jsonpath='{.data.config\.yaml}')
+        if ! echo "$CFG" | grep -q "eppEmissionEnabled"; then
+          NEW=$(echo "$CFG" | sed 's|^  downstreamGatewayClassName: .*|&\n  eppEmissionEnabled: false|')
+          kubectl --context {{.UPSTREAM_CTX}} -n network-services-operator-system create cm network-services-operator-config \
+            --from-literal=config.yaml="$NEW" --dry-run=client -o yaml | kubectl --context {{.UPSTREAM_CTX}} apply -f -
+        fi
+      # Raise the manager's memory limit to the production base so perf sweeps and
+      # webhook-under-load reflect production headroom.
+      - |
+        kubectl --context {{.UPSTREAM_CTX}} -n network-services-operator-system patch deploy network-services-operator-controller-manager \
+          --type=json -p '[{"op":"replace","path":"/spec/template/spec/containers/0/resources/limits/memory","value":"2Gi"},{"op":"replace","path":"/spec/template/spec/containers/0/resources/requests/memory","value":"512Mi"}]' || true
+
+  eg-chart:
+    desc: "Vendor the Envoy Gateway helm chart into config/tools/envoy-gateway-downstream/charts so eg-crds can apply the CRDs bundled inside it. The chart dir is gitignored (config/**/charts); this pulls it if absent. Idempotent — a no-op when it is already vendored (dev machine) and a fresh pull on CI."
+    vars:
+      CHART_DIR: config/tools/envoy-gateway-downstream/charts/gateway-helm-{{.ENVOY_GATEWAY_VERSION}}
+    cmds:
+      - |
+        if [ ! -d "{{.CHART_DIR}}/gateway-helm/crds" ]; then
+          echo "📦 pulling gateway-helm {{.ENVOY_GATEWAY_VERSION}} from oci://docker.io/envoyproxy"
+          mkdir -p "{{.CHART_DIR}}"
+          helm pull oci://docker.io/envoyproxy/gateway-helm --version {{.ENVOY_GATEWAY_VERSION}} --untar --untardir "{{.CHART_DIR}}"
+        fi
+
+  eg-crds:
+    desc: "Install the full Gateway-API + Envoy Gateway CRD set (incl ReferenceGrant + EnvoyProxy) on the downstream cluster. The downstream EG chart sets includeCRDs:false, so CRDs are applied separately (matches prod, where CRDs are managed out-of-band)."
+    vars:
+      EG_CRD_DIR: config/tools/envoy-gateway-downstream/charts/gateway-helm-{{.ENVOY_GATEWAY_VERSION}}/gateway-helm/crds
+    cmds:
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f {{.EG_CRD_DIR}}/gatewayapi-crds.yaml
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f {{.EG_CRD_DIR}}/generated/
+
+  upstream-gateway-crds:
+    desc: "Install the Gateway-API CRDs on the upstream cluster so cert-manager (enableGatewayAPI:true) starts cleanly instead of crashlooping until config/e2e lands them. Uses the same chart-bundled CRDs as eg-crds; requires eg-chart to have pulled the chart."
+    vars:
+      EG_CRD_DIR: config/tools/envoy-gateway-downstream/charts/gateway-helm-{{.ENVOY_GATEWAY_VERSION}}/gateway-helm/crds
+    cmds:
+      - kubectl --context {{.UPSTREAM_CTX}} apply --server-side=true --force-conflicts -f {{.EG_CRD_DIR}}/gatewayapi-crds.yaml
+
+  downstream-namespaces:
+    desc: "Create the downstream gateway + hostname-accounting namespaces, plus the EG-watched e2e-direct namespace for hand-delivered fixtures (D1/D2). Runs BEFORE eg-downstream so e2e-direct carries its watch label before EG establishes its informer."
+    cmds:
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/dev/downstream_resources/namespaces.yaml
+      # e2e-direct carries the gateway watch label from creation so gateways
+      # applied directly here reconcile deterministically. The gateway only
+      # reliably watches a namespace labeled at creation time, so the label must
+      # be in the manifest, not added afterward.
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/e2e-downstream/direct-namespace.yaml
+
+  eg-downstream:
+    desc: "Install the dedicated downstream Envoy Gateway (v1.7.4) with the ext-server extensionManager wiring on the downstream cluster."
+    cmds:
+      - echo "🔧 installing downstream EG {{.ENVOY_GATEWAY_VERSION}} (+ extensionManager, failOpen:false, maxMessageSize:256Mi)"
+      # Build from the untracked config/e2e-downstream/eg-downstream copy, which
+      # bakes in the e2e pins, so a hard reset on the shared branch cannot revert
+      # them — it kept clobbering the tracked copy.
+      - '{{.KUSTOMIZE}} build --enable-helm config/e2e-downstream/eg-downstream | kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f -'
+
+  load-coraza-waf:
+    desc: "Fallback: pull the Coraza WAF image and kind-load it into the downstream cluster (offline-CI escape hatch)."
+    cmds:
+      - docker pull {{.CORAZA_WAF_IMAGE}}
+      - '{{.KIND}} load docker-image {{.CORAZA_WAF_IMAGE}} --name {{.DOWNSTREAM_CLUSTER}}'
+
+  load-fixtures:
+    desc: "Build + load the e2e fixture images into the downstream cluster (CONNECT-proxy stand-in for the connector-tunnel scenario)."
+    cmds:
+      - echo "🔧 building + loading fixture image {{.CONNECT_PROXY_IMAGE}}"
+      - docker build -t {{.CONNECT_PROXY_IMAGE}} test/e2e-edge/_fixtures/connector-tunnel
+      - '{{.KIND}} load docker-image {{.CONNECT_PROXY_IMAGE}} --name {{.DOWNSTREAM_CLUSTER}}'
+
+  d1-mint-expired-secret:
+    desc: "D1 helper: mint an ALREADY-EXPIRED kubernetes.io/tls Secret and apply it to the downstream cluster, bypassing the upstream #212 cert-health gate so the ext-server prune backstop can be tested in isolation. Vars: NAMESPACE, SECRET, HOSTNAME."
+    vars:
+      # Default to the pre-provisioned, gateway-watched namespace so a gateway
+      # applied alongside this secret reconciles deterministically.
+      NAMESPACE: '{{.NAMESPACE | default "e2e-direct"}}'
+      SECRET: '{{.SECRET | default "d1-expired-tls"}}'
+      HOSTNAME: '{{.HOSTNAME | default "d1-bad.e2e.env.datum.net"}}'
+    cmds:
+      - |
+        config/e2e-downstream/d1-cert-bypass/mint-expired-secret.sh \
+          "{{.NAMESPACE}}" "{{.SECRET}}" "{{.HOSTNAME}}" \
+          | kubectl --context {{.DOWNSTREAM_CTX}} apply -f -
+      - echo "✅ applied expired TLS Secret {{.NAMESPACE}}/{{.SECRET}} (host {{.HOSTNAME}}) to {{.DOWNSTREAM_CLUSTER}}"
+
+  extension-server:
+    desc: "Deploy the ext-server (2 replicas + PDB + mTLS) + e2e cert chain + Coraza/branded-page config + test EnvoyProxy (Coraza+admin:19000) on the downstream cluster."
+    cmds:
+      - echo "🔧 deploying ext-server + e2e issuer chain + test EnvoyProxy (config/e2e-downstream)"
+      # Pin the ext-server image to the git-SHA build (same image as the manager).
+      - cd config/e2e-downstream && {{.KUSTOMIZE}} edit set image ghcr.io/datum-cloud/network-services-operator={{.IMG}} 2>/dev/null || true
+      - '{{.KUSTOMIZE}} build config/e2e-downstream | kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f -'
+      # WAF disable toggle. The overlay ships the WAF enabled for production
+      # fidelity; when CORAZA_DISABLED is set we flip the live config so listeners
+      # program without it.
+      - |
+        if [ "{{.CORAZA_DISABLED}}" = "true" ]; then
+          echo "⚠️  Coraza WAF disabled (host arch {{OS}}/$(uname -m); WAF .so is amd64-only)"
+          kubectl --context {{.DOWNSTREAM_CTX}} -n network-services-operator-system get cm extension-server-config -o yaml \
+            | sed 's/disabled: false/disabled: true/' | kubectl --context {{.DOWNSTREAM_CTX}} apply -f -
+        fi
+      # The extension server's server cert and the gateway's client cert are both
+      # issued from the e2e certificate authority. Wait for that authority's cert,
+      # then publish it where each side reads it so they can verify each other.
+      - task: extserver-ca-bundle
+
+  extserver-ca-bundle:
+    desc: "Publish the e2e CA's ca.crt into the ext-server CA-bundle ConfigMap and the EG certificateRef Secret (both in network-services-operator-system)."
+    cmds:
+      - echo "⏳ waiting for the e2e CA certificate to be issued"
+      - |
+        kubectl --context {{.DOWNSTREAM_CTX}} -n cert-manager wait certificate e2e-extension-server-ca \
+          --for=condition=Ready --timeout=120s
+      - kubectl --context {{.DOWNSTREAM_CTX}} create namespace network-services-operator-system --dry-run=client -o yaml | kubectl --context {{.DOWNSTREAM_CTX}} apply -f -
+      - |
+        CA_CRT=$(kubectl --context {{.DOWNSTREAM_CTX}} -n cert-manager get secret e2e-extension-server-ca -o jsonpath='{.data.ca\.crt}' | base64 -d)
+        # The certificate-authority bundle the extension server mounts.
+        kubectl --context {{.DOWNSTREAM_CTX}} -n network-services-operator-system create configmap extension-server-ca-bundle \
+          --from-literal=ca.crt="$CA_CRT" --dry-run=client -o yaml | kubectl --context {{.DOWNSTREAM_CTX}} apply -f -
+        # The same authority cert the downstream gateway references. The gateway
+        # reads it from the tls.crt key, not ca.crt.
+        kubectl --context {{.DOWNSTREAM_CTX}} -n network-services-operator-system create secret generic e2e-extension-server-ca \
+          --from-literal=tls.crt="$CA_CRT" --dry-run=client -o yaml | kubectl --context {{.DOWNSTREAM_CTX}} apply -f -
+      # Restart the extension server so it picks up the freshly-published bundle.
+      - kubectl --context {{.DOWNSTREAM_CTX}} -n network-services-operator-system rollout restart deploy network-services-operator-envoy-gateway-extension-server || true
+
+  downstream-crds:
+    desc: "Install the NSO CRDs the replicator mirrors into the downstream cluster (the Gateway-API/EG CRDs come from eg-crds)."
+    cmds:
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_connectors.yaml
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_httpproxies.yaml
+      - kubectl --context {{.DOWNSTREAM_CTX}} apply -f config/crd/bases/networking.datumapis.com_trafficprotectionpolicies.yaml
+
+  external-dns:
+    desc: "Install external-dns CRDs (DNSEndpoint) on the downstream cluster."
+    cmds:
+      - '{{.KUSTOMIZE}} build --enable-helm config/tools/external-dns | kubectl --context {{.DOWNSTREAM_CTX}} apply --server-side=true --force-conflicts -f -'
+
+  link-clusters:
+    desc: "Wire the NSO manager's downstream client to the downstream cluster via the downstream-cluster-kubeconfig secret on the upstream cluster."
+    cmds:
+      - echo "🔗 linking upstream -> downstream"
+      - '{{.KIND}} get kubeconfig --name {{.DOWNSTREAM_CLUSTER}} --internal > {{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}-internal.yaml'
+      - kubectl --context {{.UPSTREAM_CTX}} create namespace network-services-operator-system --dry-run=client -o yaml | kubectl --context {{.UPSTREAM_CTX}} apply -f -
+      - |
+        kubectl --context {{.UPSTREAM_CTX}} create secret -n network-services-operator-system \
+          generic downstream-cluster-kubeconfig --save-config --dry-run=client -o yaml \
+          --from-file=kubeconfig={{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}-internal.yaml | kubectl --context {{.UPSTREAM_CTX}} apply -f -
+
+  wait-ready:
+    desc: "Wait for the core components (NSO manager, downstream EG, ext-server) to be Available."
+    cmds:
+      - echo "⏳ waiting for NSO manager (upstream)"
+      - kubectl --context {{.UPSTREAM_CTX}} -n network-services-operator-system wait deploy network-services-operator-controller-manager --for=condition=Available --timeout=300s
+      - echo "⏳ waiting for downstream EG"
+      # The gateway control-plane Deployment is named `envoy-gateway` by its chart,
+      # not after the release name.
+      - kubectl --context {{.DOWNSTREAM_CTX}} -n datum-downstream-gateway wait deploy envoy-gateway --for=condition=Available --timeout=240s
+      - echo "⏳ waiting for ext-server"
+      - kubectl --context {{.DOWNSTREAM_CTX}} -n network-services-operator-system wait deploy network-services-operator-envoy-gateway-extension-server --for=condition=Available --timeout=240s
+      - echo "✅ core components ready."
+
+  # ---- Karmada ------------------------------------------------------------
+
+  karmada-up:
+    desc: "Stand up a real Karmada host on the upstream cluster (apiserver v1.33.2), join the downstream member, and apply the prod federation artifacts."
+    vars:
+      KARMADA_KUBECONFIG: '{{.TMP_DIR}}/karmada-{{.UPSTREAM_CLUSTER}}/karmada-apiserver.config'
+      # The upstream node's docker-network IP, reachable from the downstream node
+      # on the same network, used to sign the Karmada apiserver cert.
+      HOST_IP:
+        sh: docker inspect {{.UPSTREAM_CLUSTER}}-control-plane -f '{{"{{"}}.NetworkSettings.Networks.kind.IPAddress{{"}}"}}'
+      # The downstream member's docker-network IP — reachable from the upstream
+      # control-plane pods on the same network, but not from the macOS host.
+      MEMBER_IP:
+        sh: docker inspect {{.DOWNSTREAM_CLUSTER}}-control-plane -f '{{"{{"}}.NetworkSettings.Networks.kind.IPAddress{{"}}"}}'
+    cmds:
+      # Advertise 127.0.0.1: karmadactl runs on the macOS host, and init's own
+      # post-deploy steps dial the advertise address. The docker-network IP is not
+      # routable from the macOS host, so advertising it would make init time out;
+      # the upstream cluster maps a host port through to the apiserver, so
+      # 127.0.0.1 reaches it. We still sign the cert for the docker IP for any
+      # in-cluster path. The member is joined in push mode, so it never needs to
+      # reach the apiserver address — advertising 127.0.0.1 is safe for the join.
+      - echo "🌐 karmada init (apiserver {{.KARMADA_APISERVER_VERSION}}, advertise 127.0.0.1:32443, cert-ip incl {{.HOST_IP}}) on {{.UPSTREAM_CLUSTER}}"
+      - mkdir -p {{.TMP_DIR}}/karmada-{{.UPSTREAM_CLUSTER}}
+      - |
+        {{.KARMADACTL}} init --context {{.UPSTREAM_CTX}} \
+          --kube-image-tag {{.KARMADA_APISERVER_VERSION}} \
+          --karmada-apiserver-advertise-address 127.0.0.1 \
+          --cert-external-ip "127.0.0.1,{{.HOST_IP}}" \
+          --etcd-storage-mode hostPath \
+          --karmada-data {{.TMP_DIR}}/karmada-{{.UPSTREAM_CLUSTER}} \
+          --karmada-pki {{.TMP_DIR}}/karmada-{{.UPSTREAM_CLUSTER}}/pki
+      - echo "🔗 joining {{.DOWNSTREAM_CLUSTER}} as a Karmada member"
+      # karmadactl join runs on the host and connects to the member to install its
+      # agent, so it needs a host-reachable member kubeconfig, not the internal
+      # docker-hostname form the host cannot resolve.
+      - '{{.KIND}} get kubeconfig --name {{.DOWNSTREAM_CLUSTER}} > {{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}-host.yaml'
+      - |
+        {{.KARMADACTL}} join {{.DOWNSTREAM_CLUSTER}} \
+          --karmada-context karmada-apiserver \
+          --kubeconfig {{.KARMADA_KUBECONFIG}} \
+          --cluster-kubeconfig {{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}-host.yaml \
+          --cluster-context {{.DOWNSTREAM_CTX}}
+      # The join stores the host address as the member's endpoint, which the
+      # control-plane pods running inside the upstream cluster cannot reach.
+      # Repoint it to the member's docker IP, which they can reach on the shared
+      # network, and the member then goes Ready.
+      - |
+        kubectl --kubeconfig {{.KARMADA_KUBECONFIG}} --context karmada-apiserver \
+          patch cluster {{.DOWNSTREAM_CLUSTER}} --type=merge \
+          -p '{"spec":{"apiEndpoint":"https://{{.MEMBER_IP}}:6443"}}'
+      # Label the member so the production propagation policy places resources onto
+      # it.
+      - |
+        kubectl --kubeconfig {{.KARMADA_KUBECONFIG}} --context karmada-apiserver \
+          label cluster {{.DOWNSTREAM_CLUSTER}} infra.datum.net/gateways=enabled --overwrite
+      - echo "⏳ waiting for the member cluster to become Ready"
+      - |
+        kubectl --kubeconfig {{.KARMADA_KUBECONFIG}} --context karmada-apiserver \
+          wait cluster {{.DOWNSTREAM_CLUSTER}} --for=condition=Ready --timeout=120s
+      - echo "📜 applying federation artifacts (config/federation)"
+      - |
+        kubectl --kubeconfig {{.KARMADA_KUBECONFIG}} --context karmada-apiserver apply -f config/federation/
+      - echo "✅ karmada-up complete. Karmada apiserver kubeconfig at {{.KARMADA_KUBECONFIG}}"
+
+  smoke:
+    desc: "M2 functional confirmation: drive an upstream Gateway+HTTPRoute through the ext-server path and curl a real 200."
+    cmds:
+      - '{{.CHAINSAW}} test ./test/e2e-edge/extension-server-smoke --cluster {{.UPSTREAM_CLUSTER}}={{.TMP_DIR}}/.kind-{{.UPSTREAM_CLUSTER}}.yaml --cluster {{.DOWNSTREAM_CLUSTER}}={{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}.yaml'
+
+  e2e:
+    desc: "Run chainsaw e2e scenarios against the live two-cluster env. Pass a scenario name or path after -- (e.g. `task test-infra:e2e -- waf-enforcement`); with no arg, runs every ext-server-path scenario that targets nso-upstream/nso-downstream. Use SCENARIOS=... to override the default set."
+    vars:
+      # Scenarios authored against this env's cluster names and downstream path.
+      # Older fixtures targeting the previous cluster names are excluded here.
+      DEFAULT_SCENARIOS: extension-server-smoke waf-enforcement trafficprotectionpolicy-enforce branded-error-page connector-offline-503 atomic-reject-isolation
+      # CLI_ARGS (after --) wins; else SCENARIOS env; else the default set.
+      SELECTED: '{{.CLI_ARGS | default .SCENARIOS | default .DEFAULT_SCENARIOS}}'
+    deps:
+      - kubeconfigs
+    cmds:
+      - |
+        set -e
+        for s in {{.SELECTED}}; do
+          # Accept either a bare scenario name or a full/relative path.
+          case "$s" in
+            test/e2e-edge/*|./test/e2e-edge/*) dir="$s" ;;
+            */*)                     dir="$s" ;;
+            *)                       dir="./test/e2e-edge/$s" ;;
+          esac
+          echo "🧪 chainsaw: $dir"
+          {{.CHAINSAW}} test "$dir" \
+            --cluster {{.UPSTREAM_CLUSTER}}={{.TMP_DIR}}/.kind-{{.UPSTREAM_CLUSTER}}.yaml \
+            --cluster {{.DOWNSTREAM_CLUSTER}}={{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}.yaml
+        done
+
+  kubeconfigs:
+    desc: "Export per-cluster kubeconfigs to TMPDIR for chainsaw."
+    cmds:
+      - '{{.KIND}} get kubeconfig --name {{.UPSTREAM_CLUSTER}} > {{.TMP_DIR}}/.kind-{{.UPSTREAM_CLUSTER}}.yaml'
+      - '{{.KIND}} get kubeconfig --name {{.DOWNSTREAM_CLUSTER}} > {{.TMP_DIR}}/.kind-{{.DOWNSTREAM_CLUSTER}}.yaml'
+
+  parity:check:
+    desc: "Run the config-dump parity gate against the live downstream Envoy + ext-server. Pass CLI flags after -- (PARITY owns the CLI). Exit 0 PASS / 1 parity FAIL / 2 tool error."
+    cmds:
+      - go build -o bin/parity-check ./cmd/parity-check
+      - ./bin/parity-check {{.CLI_ARGS}}
+
+  parity:check-live:
+    desc: "Convenience: resolve the live data-plane Envoy pod from this env's labels and run parity:check in kubectl-exec mode (ext-server via selector across replicas). Extra flags pass through after --."
+    vars:
+      # In this env the data-plane proxy and the extension server live in these
+      # namespaces.
+      DP_NS: datum-downstream-gateway
+      DP_SELECTOR: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e
+      EXT_NS: network-services-operator-system
+      EXT_SELECTOR: app.kubernetes.io/component=envoy-gateway-extension-server
+      # The admin side wants a single exact proxy pod name, resolved here. The
+      # extension-server side takes a selector and picks the authoritative replica
+      # itself.
+      DP_POD:
+        sh: kubectl --context {{.DOWNSTREAM_CTX}} -n datum-downstream-gateway get pods -l gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e -o jsonpath='{.items[0].metadata.name}'
+    cmds:
+      - go build -o bin/parity-check ./cmd/parity-check
+      - |
+        if [ -z "{{.DP_POD}}" ]; then
+          echo "no data-plane Envoy pod found (label {{.DP_SELECTOR}} in {{.DP_NS}}); a Gateway must exist in a watched namespace for the merged data plane to be provisioned" >&2
+          exit 2
+        fi
+      - |
+        ./bin/parity-check \
+          --coraza-filter=coraza-waf \
+          --admin-exec-pod={{.DP_POD}} --admin-exec-namespace={{.DP_NS}} --admin-exec-container=envoy --admin-exec-context={{.DOWNSTREAM_CTX}} \
+          --ext-exec-selector={{.EXT_SELECTOR}} --ext-exec-namespace={{.EXT_NS}} --ext-exec-context={{.DOWNSTREAM_CTX}} \
+          {{.CLI_ARGS}}
diff --git a/Taskfile.yaml b/Taskfile.yaml
index a34a3994..890a88f7 100644
--- a/Taskfile.yaml
+++ b/Taskfile.yaml
@@ -7,6 +7,8 @@ includes:
     dir: ./docs
   dev:
     taskfile: ./Taskfile.dev.yaml
+  test-infra:
+    taskfile: ./Taskfile.test-infra.yml
 
 tasks:
   validate-kustomizations:
diff --git a/cmd/parity-check/main.go b/cmd/parity-check/main.go
new file mode 100644
index 00000000..b145cdbc
--- /dev/null
+++ b/cmd/parity-check/main.go
@@ -0,0 +1,342 @@
+// Command parity-check is the command-line wrapper around the parity package. It
+// reads the configuration the extension server intended to program, reads the
+// proxy's live configuration, compares them, prints the result as JSON, and
+// exits non-zero on any mismatch.
+//
+// The proxy and extension server can be reached either by a direct URL or, when
+// their containers ship without any shell or HTTP client, by forwarding a port
+// to the pod and fetching through it from this process. The flags below select
+// which.
+package main
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+
+	"go.datum.net/network-services-operator/test/parity"
+)
+
+func main() {
+	cfg := parseFlags()
+	if err := run(cfg); err != nil {
+		fmt.Fprintf(os.Stderr, "parity-check: %v\n", err)
+		os.Exit(2) // 2 = could not fetch or parse; 1 = mismatch found.
+	}
+}
+
+type config struct {
+	corazaFilter string
+	timeout      time.Duration
+
+	adminURL string
+	admin    execTarget
+
+	extURL string
+	ext    execTarget
+	// extSelector matches all extension server replicas. Only one replica
+	// actually builds configuration at a time, so the check must query every
+	// replica and use the authoritative one. Mutually exclusive with
+	// --ext-exec-pod / --ext-url.
+	extSelector string
+
+	// expectMinBuildID, when set, requires the build count to be at least this
+	// value, proving a fresh build happened. Capture the count before a change,
+	// then require a higher one after.
+	expectMinBuildID uint64
+	jsonOut          bool
+
+	// printBuildID, when true, resolves the authoritative replica and prints only
+	// its build count, then exits without comparing anything. Used to capture the
+	// count before a change and to wait for configuration to settle.
+	printBuildID bool
+}
+
+type execTarget struct {
+	pod       string
+	namespace string
+	container string
+	kubeCtx   string
+}
+
+func (e execTarget) set() bool { return e.pod != "" }
+
+func parseFlags() config {
+	var c config
+	flag.StringVar(&c.corazaFilter, "coraza-filter", "coraza-waf",
+		"Coraza HTTP filter name (identifies WAF HCM injection)")
+	flag.DurationVar(&c.timeout, "timeout", 30*time.Second, "overall fetch timeout")
+
+	flag.StringVar(&c.adminURL, "admin-url", "",
+		"Envoy admin base URL (e.g. http://127.0.0.1:19000); use this OR --admin-exec-pod")
+	flag.StringVar(&c.admin.pod, "admin-exec-pod", "", "proxy pod to kubectl-exec into for admin access")
+	flag.StringVar(&c.admin.namespace, "admin-exec-namespace", "envoy-gateway-system", "namespace of the proxy pod")
+	flag.StringVar(&c.admin.container, "admin-exec-container", "envoy", "container in the proxy pod")
+	flag.StringVar(&c.admin.kubeCtx, "admin-exec-context", "", "kubeconfig context for admin exec (optional)")
+
+	flag.StringVar(&c.extURL, "ext-url", "",
+		"ext-server health base URL (e.g. http://127.0.0.1:8080); use this OR --ext-exec-pod / --ext-exec-selector")
+	flag.StringVar(&c.ext.pod, "ext-exec-pod", "", "single ext-server pod to kubectl-exec into")
+	flag.StringVar(&c.extSelector, "ext-exec-selector", "",
+		"label selector for ALL ext-server replicas; picks the authoritative one (preferred over --ext-exec-pod)")
+	flag.StringVar(&c.ext.namespace, "ext-exec-namespace", "", "namespace of the ext-server pod(s)")
+	flag.StringVar(&c.ext.container, "ext-exec-container", "", "container in the ext-server pod")
+	flag.StringVar(&c.ext.kubeCtx, "ext-exec-context", "", "kubeconfig context for ext exec (optional)")
+
+	flag.Uint64Var(&c.expectMinBuildID, "expect-min-build-id", 0, "require programmed-set BuildID >= this (STALE oracle)")
+	flag.BoolVar(&c.jsonOut, "json", true, "emit the ParityReport as JSON")
+	flag.BoolVar(&c.printBuildID, "print-build-id", false,
+		"resolve the authoritative ext-server replica and print ONLY its BuildID, then exit")
+	flag.Parse()
+	return c
+}
+
+func run(c config) error {
+	ctx, cancel := context.WithTimeout(context.Background(), c.timeout)
+	defer cancel()
+
+	// Resolve the authoritative replica and emit only its build count, without
+	// fetching or comparing the proxy's configuration.
+	if c.printBuildID {
+		expected, _, err := resolveExpected(ctx, c)
+		if err != nil {
+			return err
+		}
+		fmt.Printf("%d\n", expected.BuildID)
+		return nil
+	}
+
+	adminFetcher, err := buildFetcher(c.adminURL, c.admin, true)
+	if err != nil {
+		return fmt.Errorf("admin fetcher: %w", err)
+	}
+
+	// Resolve the intended configuration and the fetcher for the authoritative
+	// replica. With a selector this queries every replica and picks the active
+	// one; otherwise it uses the single configured endpoint.
+	expected, extFetcher, err := resolveExpected(ctx, c)
+	if err != nil {
+		return err
+	}
+	if c.expectMinBuildID > 0 && expected.BuildID < c.expectMinBuildID {
+		return fmt.Errorf("STALE: programmed-set BuildID %d < required %d (ext-server did not re-translate)",
+			expected.BuildID, c.expectMinBuildID)
+	}
+
+	droppedSecrets := expected.Keys[parity.FamilyTLSPrune]
+	actual, _, err := parity.FetchActual(ctx, adminFetcher, extFetcher, c.corazaFilter, droppedSecrets)
+	if err != nil {
+		return err
+	}
+
+	report := parity.Compare(expected, actual)
+
+	if c.jsonOut {
+		enc := json.NewEncoder(os.Stdout)
+		enc.SetIndent("", "  ")
+		_ = enc.Encode(report)
+	}
+	fmt.Fprintln(os.Stderr, report.String())
+
+	if !report.OK() {
+		os.Exit(1) // mismatch found — distinct from a fetch or parse failure (exit 2).
+	}
+	return nil
+}
+
+// resolveExpected returns the intended configuration and the fetcher for the
+// authoritative replica. With a selector it queries every replica and picks the
+// active one; otherwise it uses the single configured endpoint. The chosen
+// fetcher is reused later so other signals also come from the active replica.
+func resolveExpected(ctx context.Context, c config) (parity.Expected, parity.Fetcher, error) {
+	if c.extSelector != "" {
+		pods, err := resolvePods(ctx, c.ext.kubeCtx, c.ext.namespace, c.extSelector)
+		if err != nil {
+			return parity.Expected{}, nil, fmt.Errorf("resolve ext-server pods: %w", err)
+		}
+		if len(pods) == 0 {
+			return parity.Expected{}, nil, fmt.Errorf(
+				"no ext-server pods matched selector %q in namespace %q", c.extSelector, c.ext.namespace)
+		}
+		fetchers := make(map[string]parity.Fetcher, len(pods))
+		for _, pod := range pods {
+			et := c.ext
+			et.pod = pod
+			fetchers[pod] = &pfFetcher{target: et, remotePort: "8080"}
+		}
+		src, perReplicaErrs, err := parity.FetchExpectedFromMany(ctx, fetchers)
+		if err != nil {
+			return parity.Expected{}, nil, err
+		}
+		// Report per-replica fetch errors and the chosen replica for diagnosis;
+		// they are not fatal as long as one replica answered.
+		for pod, e := range perReplicaErrs {
+			fmt.Fprintf(os.Stderr, "parity-check: ext replica %s unreachable: %v\n", pod, e)
+		}
+		fmt.Fprintf(os.Stderr, "parity-check: authoritative ext replica %s (BuildID %d) of %d\n",
+			src.Replica, src.Expected.BuildID, len(pods))
+		return src.Expected, fetchers[src.Replica], nil
+	}
+
+	// Single-endpoint fallback.
+	extFetcher, err := buildFetcher(c.extURL, c.ext, false)
+	if err != nil {
+		return parity.Expected{}, nil, fmt.Errorf("ext fetcher: %w", err)
+	}
+	exp, err := parity.FetchExpected(ctx, extFetcher)
+	if err != nil {
+		return parity.Expected{}, nil, err
+	}
+	return exp, extFetcher, nil
+}
+
+// resolvePods returns the names of the running pods matching selector, used to
+// enumerate the extension server replicas.
+func resolvePods(ctx context.Context, kubeCtx, namespace, selector string) ([]string, error) {
+	args := []string{}
+	if kubeCtx != "" {
+		args = append(args, "--context", kubeCtx)
+	}
+	if namespace != "" {
+		args = append(args, "-n", namespace)
+	}
+	args = append(args, "get", "pods", "-l", selector,
+		"--field-selector=status.phase=Running",
+		"-o", "jsonpath={.items[*].metadata.name}")
+
+	cmd := exec.CommandContext(ctx, "kubectl", args...)
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if err != nil {
+		return nil, fmt.Errorf("kubectl get pods -l %s: %w: %s", selector, err, strings.TrimSpace(stderr.String()))
+	}
+	return strings.Fields(string(out)), nil
+}
+
+// buildFetcher returns a direct HTTP fetcher when a URL is given, otherwise a
+// port-forward fetcher to the given pod. admin selects which remote port to
+// reach. Port-forwarding is used rather than running a command inside the pod
+// because the containers ship without a shell or HTTP client.
+func buildFetcher(url string, et execTarget, admin bool) (parity.Fetcher, error) {
+	switch {
+	case url != "":
+		return parity.HTTPFetcher{BaseURL: url}, nil
+	case et.set():
+		port := "8080"
+		if admin {
+			port = "19000"
+		}
+		return &pfFetcher{target: et, remotePort: port}, nil
+	default:
+		return nil, fmt.Errorf("either a URL or an exec pod must be provided")
+	}
+}
+
+// pfFetcher fetches a path by forwarding a local port to the pod and making the
+// request from this process. The forward is set up and torn down per call, on a
+// fresh local port each time so concurrent fetches don't collide.
+type pfFetcher struct {
+	target     execTarget
+	remotePort string
+}
+
+func (p *pfFetcher) Fetch(ctx context.Context, path string) ([]byte, error) {
+	localPort, err := freeLocalPort()
+	if err != nil {
+		return nil, fmt.Errorf("allocate local port: %w", err)
+	}
+
+	args := []string{}
+	if p.target.kubeCtx != "" {
+		args = append(args, "--context", p.target.kubeCtx)
+	}
+	if p.target.namespace != "" {
+		args = append(args, "-n", p.target.namespace)
+	}
+	args = append(args, "port-forward", "pod/"+p.target.pod,
+		fmt.Sprintf("%d:%s", localPort, p.remotePort))
+
+	// The forward must outlive the single request but be torn down right after.
+	pfCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	cmd := exec.CommandContext(pfCtx, "kubectl", args...)
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("start port-forward: %w", err)
+	}
+	defer func() { cancel(); _ = cmd.Wait() }()
+
+	// Wait until the forward is listening before fetching.
+	if err := waitForwardReady(pfCtx, stdout); err != nil {
+		return nil, fmt.Errorf("port-forward not ready: %w (%s)", err, strings.TrimSpace(stderr.String()))
+	}
+
+	url := fmt.Sprintf("http://127.0.0.1:%d%s", localPort, path)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("GET %s via port-forward: %w", url, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", url, err)
+	}
+	if resp.StatusCode/100 != 2 {
+		return nil, fmt.Errorf("GET %s: status %d", url, resp.StatusCode)
+	}
+	return body, nil
+}
+
+// freeLocalPort asks the operating system for an unused port. Another process
+// could claim it in the brief gap before we bind, but that window is small and
+// the caller retries.
+func freeLocalPort() (int, error) {
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return 0, err
+	}
+	defer func() { _ = l.Close() }()
+	return l.Addr().(*net.TCPAddr).Port, nil
+}
+
+// waitForwardReady blocks until the forward reports that its local socket is
+// listening, or the context is done.
+func waitForwardReady(ctx context.Context, stdout io.Reader) error {
+	ready := make(chan struct{}, 1)
+	go func() {
+		sc := bufio.NewScanner(stdout)
+		for sc.Scan() {
+			if strings.Contains(sc.Text(), "Forwarding from") {
+				ready <- struct{}{}
+				return
+			}
+		}
+	}()
+	select {
+	case <-ready:
+		return nil
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-time.After(15 * time.Second):
+		return fmt.Errorf("timed out waiting for port-forward")
+	}
+}
diff --git a/cmd/parity-check/main_test.go b/cmd/parity-check/main_test.go
new file mode 100644
index 00000000..6f94911c
--- /dev/null
+++ b/cmd/parity-check/main_test.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"go.datum.net/network-services-operator/test/parity"
+)
+
+func TestBuildFetcher_URL(t *testing.T) {
+	f, err := buildFetcher("http://127.0.0.1:19000", execTarget{}, true)
+	require.NoError(t, err)
+	h, ok := f.(parity.HTTPFetcher)
+	require.True(t, ok)
+	assert.Equal(t, "http://127.0.0.1:19000", h.BaseURL)
+}
+
+func TestBuildFetcher_PortForward(t *testing.T) {
+	f, err := buildFetcher("", execTarget{pod: "envoy-abc", namespace: "envoy-gateway-system", container: "envoy"}, true)
+	require.NoError(t, err)
+	e, ok := f.(*pfFetcher)
+	require.True(t, ok)
+	assert.Equal(t, "19000", e.remotePort, "admin fetcher must port-forward the admin port")
+
+	fExt, err := buildFetcher("", execTarget{pod: "ext-abc", namespace: "nso"}, false)
+	require.NoError(t, err)
+	eExt := fExt.(*pfFetcher)
+	assert.Equal(t, "8080", eExt.remotePort, "ext fetcher must port-forward the health port")
+}
+
+func TestFreeLocalPort(t *testing.T) {
+	p, err := freeLocalPort()
+	require.NoError(t, err)
+	assert.Greater(t, p, 0)
+}
+
+func TestBuildFetcher_NeitherErrors(t *testing.T) {
+	_, err := buildFetcher("", execTarget{}, true)
+	assert.Error(t, err)
+}
diff --git a/config/e2e-downstream/d1-cert-bypass/README.md b/config/e2e-downstream/d1-cert-bypass/README.md
new file mode 100644
index 00000000..1923679c
--- /dev/null
+++ b/config/e2e-downstream/d1-cert-bypass/README.md
@@ -0,0 +1,28 @@
+# Expired-certificate isolation fixture (test-env-only)
+
+In production, an expired or otherwise unusable TLS certificate is caught early:
+the platform withholds that listener from the edge before it is ever delivered.
+The extension server *also* removes unusable certificates at the edge, as a
+second line of defense — but because the earlier check normally catches the
+problem first, that edge-side removal rarely gets exercised on the normal path.
+
+This fixture lets a test exercise it directly, by handing the edge a genuinely
+expired certificate and bypassing the earlier check.
+
+1. `mint-expired-secret.sh <namespace> <secret-name> <hostname>` writes a
+   self-signed, already-expired certificate as a TLS Secret to stdout. Apply it
+   into the `e2e-direct` namespace on the edge cluster.
+2. The test then applies a gateway directly to the edge whose HTTPS listener
+   uses that certificate. The extension server removes the bad listener while a
+   healthy sibling keeps serving — which is what the test asserts.
+
+> **Use the `e2e-direct` namespace.** The gateway controller only watches
+> namespaces that already carry the `meta.datumapis.com/upstream-cluster-name`
+> label when they are created; a label added afterward is not reliably picked
+> up, and a gateway there can stay unprogrammed. The `e2e-direct` namespace is
+> created with the label up front for exactly this reason. If you must create a
+> namespace inline, set the label at creation time.
+
+`task -t Taskfile.test-infra.yml d1-mint-expired-secret` is a thin wrapper around
+the script (defaults: `NAMESPACE=e2e-direct`, `SECRET=d1-expired-tls`,
+`HOSTNAME=d1-bad.e2e.env.datum.net`).
diff --git a/config/e2e-downstream/d1-cert-bypass/mint-expired-secret.sh b/config/e2e-downstream/d1-cert-bypass/mint-expired-secret.sh
new file mode 100755
index 00000000..8ea5e705
--- /dev/null
+++ b/config/e2e-downstream/d1-cert-bypass/mint-expired-secret.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Mint an already-expired self-signed TLS certificate and emit it as a
+# kubernetes.io/tls Secret on stdout. Test-env-only: it hands the gateway an
+# expired certificate directly, so the extension server's removal of unusable
+# certificates can be exercised on its own, without the earlier check rejecting
+# it first.
+#
+# Usage: mint-expired-secret.sh <namespace> <secret-name> <hostname>
+set -euo pipefail
+
+NS="${1:?namespace required}"
+SECRET="${2:?secret name required}"
+HOST="${3:?hostname required}"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Generate a key + a self-signed cert dated entirely in the past so it is expired
+# the moment it is created. openssl's -not_before/-not_after (LibreSSL/OpenSSL 3)
+# set an explicit validity window; fall back to a 1-second window via -days 0 if
+# the flags are unavailable.
+openssl req -x509 -newkey rsa:2048 -nodes \
+  -keyout "$WORK/tls.key" -out "$WORK/tls.crt" \
+  -subj "/CN=${HOST}" \
+  -addext "subjectAltName=DNS:${HOST}" \
+  -not_before 20200101000000Z -not_after 20200102000000Z 2>/dev/null \
+  || openssl req -x509 -newkey rsa:2048 -nodes \
+       -keyout "$WORK/tls.key" -out "$WORK/tls.crt" \
+       -subj "/CN=${HOST}" -addext "subjectAltName=DNS:${HOST}" -days 1 2>/dev/null
+
+CRT_B64="$(base64 < "$WORK/tls.crt" | tr -d '\n')"
+KEY_B64="$(base64 < "$WORK/tls.key" | tr -d '\n')"
+
+cat <<YAML
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${SECRET}
+  namespace: ${NS}
+type: kubernetes.io/tls
+data:
+  tls.crt: ${CRT_B64}
+  tls.key: ${KEY_B64}
+YAML
diff --git a/config/e2e-downstream/direct-namespace.yaml b/config/e2e-downstream/direct-namespace.yaml
new file mode 100644
index 00000000..636442ef
--- /dev/null
+++ b/config/e2e-downstream/direct-namespace.yaml
@@ -0,0 +1,14 @@
+# Stable namespace for fixtures delivered straight to the edge cluster. The
+# gateway controller only watches namespaces that already carry the
+# meta.datumapis.com/upstream-cluster-name label when they are created; a label
+# added afterward is not reliably picked up, and a gateway there can stay
+# unprogrammed. Creating the namespace with the label up front makes gateways
+# applied here program deterministically.
+#
+# Tests that deliver a gateway straight to the edge should use this namespace.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: e2e-direct
+  labels:
+    meta.datumapis.com/upstream-cluster-name: cluster-single
diff --git a/config/e2e-downstream/eg-downstream/kustomization.yaml b/config/e2e-downstream/eg-downstream/kustomization.yaml
new file mode 100644
index 00000000..3fa80f6a
--- /dev/null
+++ b/config/e2e-downstream/eg-downstream/kustomization.yaml
@@ -0,0 +1,92 @@
+# Reset-resilient copy of the downstream Envoy Gateway install with the
+# prod-fidelity pins baked in (EG chart v1.7.4, extensionManager
+# maxMessageSize:256Mi, e2e certificateRef). This lives in an UNTRACKED dir so an
+# external `git reset --hard` on the shared branch cannot revert these settings
+# (it kept clobbering the tracked config/tools/envoy-gateway-downstream copy).
+#
+# The non-volatile siblings (namespace.yaml, nso-crd-rbac.yaml) are reused from
+# the tracked tool dir via relative path; only the kustomization itself (the
+# thing that got reset) is vendored here.
+resources:
+  - namespace.yaml
+  - nso-crd-rbac.yaml
+helmCharts:
+  - name: gateway-helm
+    includeCRDs: false
+    namespace: datum-downstream-gateway
+    releaseName: envoy-datum-downstream-gateway
+    # Prod EG version (rolled back from 1.8.1 for the OIDC regression). Pulled
+    # from the OCI repo so this dir needs no vendored chart.
+    version: v1.7.4
+    repo: oci://docker.io/envoyproxy
+    valuesInline:
+      config:
+        envoyGateway:
+          gateway:
+            controllerName: gateway.envoyproxy.io/datum-downstream-gateway
+          extensionApis:
+            enableBackend: true
+            enableEnvoyPatchPolicy: false
+          runtimeFlags:
+            enabled:
+              - XDSNameSchemeV2
+          provider:
+            type: Kubernetes
+            kubernetes:
+              watch:
+                type: NamespaceSelector
+                namespaceSelector:
+                  matchExpressions:
+                    - key: meta.datumapis.com/upstream-cluster-name
+                      operator: Exists
+          extensionManager:
+            # Match the extension server's larger message limit. The default is
+            # far smaller, and once configuration grows past it, updates silently
+            # stop reaching the proxies.
+            maxMessageSize: 256Mi
+            policyResources:
+              - group: networking.datumapis.com
+                version: v1alpha
+                kind: TrafficProtectionPolicy
+            resources:
+              - group: networking.datumapis.com
+                version: v1alpha1
+                kind: Connector
+            service:
+              fqdn:
+                hostname: network-services-operator-envoy-gateway-extension-server.network-services-operator-system.svc.cluster.local
+                port: 5005
+              tls:
+                certificateRef:
+                  # The certificate authority that signed the extension server's
+                  # certificate, so the control plane can trust it. Published by
+                  # bring-up.
+                  name: e2e-extension-server-ca
+                  namespace: network-services-operator-system
+                clientCertificateRef:
+                  name: envoy-gateway-extension-server-eg-client-tls
+                  namespace: network-services-operator-system
+              retry:
+                maxAttempts: 4
+                initialBackoff: 100ms
+                maxBackoff: 1s
+                backoffMultiplier:
+                  numerator: 200
+                retryableStatusCodes:
+                  - UNAVAILABLE
+            hooks:
+              xdsTranslator:
+                post:
+                  - Translation
+                translation:
+                  listener:
+                    includeAll: true   # MANDATORY — without this, WAF listener filter + per-route mutations are silently dropped
+                  route:
+                    includeAll: true   # MANDATORY — without this, WAF listener filter + per-route mutations are silently dropped
+                  cluster:
+                    includeAll: true
+                  secret:
+                    includeAll: true
+            # Block updates when the extension server errors instead of serving
+            # unprotected configuration; the proxy keeps its last good config.
+            failOpen: false
diff --git a/config/e2e-downstream/eg-downstream/namespace.yaml b/config/e2e-downstream/eg-downstream/namespace.yaml
new file mode 100644
index 00000000..6cecd275
--- /dev/null
+++ b/config/e2e-downstream/eg-downstream/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: datum-downstream-gateway
diff --git a/config/e2e-downstream/eg-downstream/nso-crd-rbac.yaml b/config/e2e-downstream/eg-downstream/nso-crd-rbac.yaml
new file mode 100644
index 00000000..eaea0577
--- /dev/null
+++ b/config/e2e-downstream/eg-downstream/nso-crd-rbac.yaml
@@ -0,0 +1,37 @@
+# Lets the dedicated gateway control plane read NSO's firewall and connector
+# policies on the edge cluster. Without this grant it can't see those policies,
+# so it never re-applies configuration when one of them changes.
+#
+# Kept as a separate manifest so a chart upgrade can't overwrite it.
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: envoy-datum-downstream-gateway-nso-policy-viewer
+rules:
+  - apiGroups:
+      - networking.datumapis.com
+    resources:
+      - trafficprotectionpolicies
+      - connectors
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: envoy-datum-downstream-gateway-nso-policy-viewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: envoy-datum-downstream-gateway-nso-policy-viewer
+subjects:
+  - kind: ServiceAccount
+    # The chart names its service account "envoy-gateway" (not prefixed with the
+    # release name), so the binding must use that exact name. A mismatch leaves the
+    # control plane unable to read the policies, so it never starts and no gateway
+    # is ever programmed.
+    name: envoy-gateway
+    namespace: datum-downstream-gateway
diff --git a/config/e2e-downstream/envoyproxy.yaml b/config/e2e-downstream/envoyproxy.yaml
new file mode 100644
index 00000000..283bd01b
--- /dev/null
+++ b/config/e2e-downstream/envoyproxy.yaml
@@ -0,0 +1,87 @@
+# Test edge data plane for the downstream gateway. It models the production edge
+# proxy on the two things that matter for testing: the real WAF image, and an
+# admin endpoint (test-env-only) so the suite and parity gate can read the
+# proxy's live configuration and stats.
+#
+# Here the data plane is a Deployment/Service rather than the production
+# DaemonSet, which does not change WAF or configuration behavior.
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: datum-downstream-gateway
+  namespace: datum-downstream-gateway
+spec:
+  mergeGateways: true
+  ipFamily: DualStack
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        pod:
+          volumes:
+            - name: coraza-waf
+              emptyDir: {}
+        container:
+          image: envoyproxy/envoy:contrib-v1.37.1
+          volumeMounts:
+            - name: coraza-waf
+              mountPath: /opt/coraza-waf
+        initContainers:
+          - name: coraza-waf
+            # Multi-arch build of the same WAF filter as the production edge. The
+            # multi-arch image loads natively on arm64 dev hosts as well as on
+            # amd64 CI and production — same filter, same rules.
+            image: ghcr.io/datum-labs/coraza-envoy-go-filter/coraza-waf:v1.3.0-multiarch.1
+            imagePullPolicy: IfNotPresent
+            command:
+              - cp
+              - /coraza-waf.so
+              - /opt/coraza-waf/
+            volumeMounts:
+              - name: coraza-waf
+                mountPath: /opt/coraza-waf
+      envoyService:
+        externalTrafficPolicy: Cluster
+        type: NodePort
+        patch:
+          type: StrategicMerge
+          value:
+            spec:
+              ipFamilyPolicy: RequireDualStack
+              ports:
+                - name: http-80
+                  nodePort: 30080
+                  port: 80
+                - name: https-443
+                  nodePort: 30443
+                  port: 443
+  # TEST-ENV-ONLY: expose the proxy's admin interface so an in-cluster runner can
+  # read its live configuration and stats. The admin endpoint is unauthenticated
+  # and must never be applied in production — a CI guard asserts this patch is
+  # absent from any non-e2e output.
+  bootstrap:
+    type: JSONPatch
+    jsonPatches:
+      - op: add
+        path: /admin/address
+        value:
+          socket_address:
+            address: 0.0.0.0
+            port_value: 19000
+  telemetry:
+    metrics:
+      prometheus:
+        disable: false
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: datum-downstream-gateway-e2e
+spec:
+  controllerName: gateway.envoyproxy.io/datum-downstream-gateway
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: datum-downstream-gateway
+    namespace: datum-downstream-gateway
diff --git a/config/e2e-downstream/error-pages.yaml b/config/e2e-downstream/error-pages.yaml
new file mode 100644
index 00000000..5edec26a
--- /dev/null
+++ b/config/e2e-downstream/error-pages.yaml
@@ -0,0 +1,16 @@
+# Branded 5xx error page, mounted at /etc/datum/error-pages. The body carries a
+# known marker so the suite can tell the branded page apart from the proxy's
+# default 5xx body by content.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-error-pages
+  namespace: network-services-operator-system
+data:
+  error-5xx.html: |
+    <!-- X-Datum-Branded-Page: v1 -->
+    <!DOCTYPE html>
+    <html>
+      <head><title>Service Unavailable</title></head>
+      <body><h1>This service is temporarily unavailable.</h1></body>
+    </html>
diff --git a/config/e2e-downstream/extserver-base/kustomization.yaml b/config/e2e-downstream/extserver-base/kustomization.yaml
new file mode 100644
index 00000000..14e55681
--- /dev/null
+++ b/config/e2e-downstream/extserver-base/kustomization.yaml
@@ -0,0 +1,32 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# Ext-server, namespaced + prefixed so the Service FQDN matches the EG
+# extensionManager fqdn and the CSI dns-names baked into the base deployment.
+namespace: network-services-operator-system
+namePrefix: network-services-operator-
+
+resources:
+  - ../../extension-server
+
+patches:
+  - path: patches/extserver-tls.yaml
+    target:
+      kind: Deployment
+      name: envoy-gateway-extension-server
+  - path: patches/extserver-serverconfig.yaml
+    target:
+      kind: Deployment
+      name: envoy-gateway-extension-server
+  - path: patches/extserver-clientcert-issuer.yaml
+    target:
+      kind: Certificate
+      name: envoy-gateway-extension-server-eg-client-tls
+  - path: patches/extserver-ca-bundle.yaml
+    target:
+      kind: Deployment
+      name: envoy-gateway-extension-server
+  - path: patches/extserver-programmed-set.yaml
+    target:
+      kind: Deployment
+      name: envoy-gateway-extension-server
diff --git a/config/e2e-downstream/extserver-base/patches/extserver-ca-bundle.yaml b/config/e2e-downstream/extserver-base/patches/extserver-ca-bundle.yaml
new file mode 100644
index 00000000..6e85fc0f
--- /dev/null
+++ b/config/e2e-downstream/extserver-base/patches/extserver-ca-bundle.yaml
@@ -0,0 +1,18 @@
+# Point the ext-server CA bundle volume at the e2e CA ConfigMap (carrying the
+# ca.crt that signed the EG client cert), replacing placeholder-ca-bundle. The
+# ConfigMap is published by the bring-up (test-infra:extserver-ca-bundle) from
+# the e2e-extension-server-ca cert-manager secret.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: envoy-gateway-extension-server
+spec:
+  template:
+    spec:
+      volumes:
+        - name: tls-ca
+          configMap:
+            name: extension-server-ca-bundle
+            items:
+              - key: ca.crt
+                path: ca.crt
diff --git a/config/e2e-downstream/extserver-base/patches/extserver-clientcert-issuer.yaml b/config/e2e-downstream/extserver-base/patches/extserver-clientcert-issuer.yaml
new file mode 100644
index 00000000..9710265e
--- /dev/null
+++ b/config/e2e-downstream/extserver-base/patches/extserver-clientcert-issuer.yaml
@@ -0,0 +1,11 @@
+# Point the EG client cert (CN=envoy-gateway) at the e2e CA ClusterIssuer,
+# replacing the base certificate's placeholder-issuer.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: envoy-gateway-extension-server-eg-client-tls
+spec:
+  issuerRef:
+    name: e2e-extension-server-ca
+    kind: ClusterIssuer
+    group: cert-manager.io
diff --git a/config/e2e-downstream/extserver-base/patches/extserver-programmed-set.yaml b/config/e2e-downstream/extserver-base/patches/extserver-programmed-set.yaml
new file mode 100644
index 00000000..aa4ebfc4
--- /dev/null
+++ b/config/e2e-downstream/extserver-base/patches/extserver-programmed-set.yaml
@@ -0,0 +1,17 @@
+# Turn on the read-only /debug/programmed-set endpoint so the parity test can
+# confirm the proxy is running exactly the set the build intended. The base
+# deployment reads --enable-programmed-set from this env var, defaulting off in
+# production; flip it to "true" here for the test environment. Strategic-merge
+# on env (matched by name).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: envoy-gateway-extension-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: envoy-gateway-extension-server
+          env:
+            - name: ENABLE_PROGRAMMED_SET
+              value: "true"
diff --git a/config/e2e-downstream/extserver-base/patches/extserver-serverconfig.yaml b/config/e2e-downstream/extserver-base/patches/extserver-serverconfig.yaml
new file mode 100644
index 00000000..2c9701d9
--- /dev/null
+++ b/config/e2e-downstream/extserver-base/patches/extserver-serverconfig.yaml
@@ -0,0 +1,26 @@
+# Mount the operator config ConfigMap and set SERVER_CONFIG to its path so the
+# ext-server loads Coraza + branded-error-page settings. Strategic-merge on env
+# (matched by name) and on volumes/volumeMounts.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: envoy-gateway-extension-server
+spec:
+  template:
+    spec:
+      containers:
+        - name: envoy-gateway-extension-server
+          env:
+            - name: SERVER_CONFIG
+              value: /etc/datum/server-config/config.yaml
+          volumeMounts:
+            - name: server-config
+              mountPath: /etc/datum/server-config
+              readOnly: true
+      volumes:
+        - name: server-config
+          configMap:
+            name: extension-server-config
+            items:
+              - key: config.yaml
+                path: config.yaml
diff --git a/config/e2e-downstream/extserver-base/patches/extserver-tls.yaml b/config/e2e-downstream/extserver-base/patches/extserver-tls.yaml
new file mode 100644
index 00000000..c190ac81
--- /dev/null
+++ b/config/e2e-downstream/extserver-base/patches/extserver-tls.yaml
@@ -0,0 +1,21 @@
+# Point the ext-server server-cert CSI volume at the e2e CA-backed ClusterIssuer,
+# replacing the base deployment's placeholder-issuer.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: envoy-gateway-extension-server
+spec:
+  template:
+    spec:
+      volumes:
+        - name: tls
+          csi:
+            driver: csi.cert-manager.io
+            readOnly: true
+            volumeAttributes:
+              csi.cert-manager.io/issuer-kind: ClusterIssuer
+              csi.cert-manager.io/issuer-name: e2e-extension-server-ca
+              csi.cert-manager.io/common-name: envoy-gateway-extension-server
+              csi.cert-manager.io/dns-names: "network-services-operator-envoy-gateway-extension-server.network-services-operator-system.svc,network-services-operator-envoy-gateway-extension-server.network-services-operator-system.svc.cluster.local"
+              csi.cert-manager.io/key-usages: server auth
+              csi.cert-manager.io/fs-group: "65532"
diff --git a/config/e2e-downstream/extserver-config.yaml b/config/e2e-downstream/extserver-config.yaml
new file mode 100644
index 00000000..f5828a0c
--- /dev/null
+++ b/config/e2e-downstream/extserver-config.yaml
@@ -0,0 +1,21 @@
+# Extension server config for the e2e edge.
+#
+# The WAF is enabled so its rules reach the proxy, and the branded 5xx page is
+# pointed at the mounted error-pages volume so the suite can assert the branded
+# body by content. The connector-tunnel listener name is left at its default so
+# the connector fixtures find the listener by the same name production uses.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: extension-server-config
+  namespace: network-services-operator-system
+data:
+  config.yaml: |
+    apiVersion: apiserver.config.datumapis.com/v1alpha1
+    kind: NetworkServicesOperator
+    gateway:
+      coraza:
+        disabled: false
+      errorPage:
+        enabled: true
+        bodyPath: /etc/datum/error-pages/error-5xx.html
diff --git a/config/e2e-downstream/issuer.yaml b/config/e2e-downstream/issuer.yaml
new file mode 100644
index 00000000..35fc7a62
--- /dev/null
+++ b/config/e2e-downstream/issuer.yaml
@@ -0,0 +1,41 @@
+# Self-signed root + CA-backed ClusterIssuer for the e2e ext-server mTLS chain.
+#
+# This issues both sides of the EG <-> ext-server handshake:
+#   - the ext-server SERVER cert (via the CSI driver, see patches/extserver-tls.yaml)
+#   - the EG CLIENT cert (envoy-gateway-extension-server-eg-client-tls, CN=envoy-gateway)
+# The CA's ca.crt is also published into the ext-server CA bundle ConfigMap
+# (so the ext-server can verify the EG client) and into the EG certificateRef
+# secret (so EG can verify the ext-server server cert).
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: e2e-extension-server-selfsigned
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: e2e-extension-server-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: e2e-extension-server-ca
+  secretName: e2e-extension-server-ca
+  duration: 8760h
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: e2e-extension-server-selfsigned
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: e2e-extension-server-ca
+spec:
+  ca:
+    secretName: e2e-extension-server-ca
diff --git a/config/e2e-downstream/kustomization.yaml b/config/e2e-downstream/kustomization.yaml
new file mode 100644
index 00000000..6ab183ae
--- /dev/null
+++ b/config/e2e-downstream/kustomization.yaml
@@ -0,0 +1,38 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# The e2e edge overlay applied to nso-downstream. Composes the ext-server
+# (prefixed/namespaced via extserver-base) with the e2e mTLS issuer chain, the
+# Coraza/branded-page server-config, the branded error page, and the test
+# EnvoyProxy (real Coraza WAF image + admin :19000) and its GatewayClass.
+#
+# The ConfigMaps / issuer / EnvoyProxy / GatewayClass are kept OUT of the
+# name-prefix so the deployment's literal references (envoy-error-pages,
+# extension-server-config) and the EG fqdn resolve unchanged.
+resources:
+- namespace.yaml
+- extserver-base
+- issuer.yaml
+- extserver-config.yaml
+- error-pages.yaml
+- envoyproxy.yaml
+
+# The NSO image tag is set by the bring-up (test-infra:extension-server) to the
+# git-SHA-built image.
+images:
+- name: ghcr.io/datum-cloud/network-services-operator
+  newName: ghcr.io/datum-cloud/network-services-operator
+  newTag: 63fa912
+
+# The default e2e path has no Prometheus operator; drop the ServiceMonitor so
+# the apply doesn't fail on the missing monitoring.coreos.com CRD. (Re-add via
+# OBSERVABILITY=1 when the Flux observability stack is enabled.)
+patches:
+- patch: |
+    $patch: delete
+    apiVersion: monitoring.coreos.com/v1
+    kind: ServiceMonitor
+    metadata:
+      name: envoy-gateway-extension-server-metrics
+  target:
+    kind: ServiceMonitor
diff --git a/config/e2e-downstream/namespace.yaml b/config/e2e-downstream/namespace.yaml
new file mode 100644
index 00000000..b27c33c1
--- /dev/null
+++ b/config/e2e-downstream/namespace.yaml
@@ -0,0 +1,6 @@
+# The ext-server namespace on the edge cluster. The base ext-server resources
+# target this namespace but do not create it.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: network-services-operator-system
diff --git a/config/extension-server/deployment.yaml b/config/extension-server/deployment.yaml
index e9e81fd9..6e4f01d0 100644
--- a/config/extension-server/deployment.yaml
+++ b/config/extension-server/deployment.yaml
@@ -58,6 +58,7 @@ spec:
             - --tls-key=$(TLS_KEY)
             - --tls-client-ca=$(TLS_CLIENT_CA)
             - --server-config=$(SERVER_CONFIG)
+            - --enable-programmed-set=$(ENABLE_PROGRAMMED_SET)
           env:
             - name: GRPC_ADDR
               value: ":5005"
@@ -73,6 +74,11 @@ spec:
             # mounted path to apply Coraza directives.
             - name: SERVER_CONFIG
               value: ""
+            # Off in production. The test-environment overlay sets this to "true"
+            # to serve the read-only /debug/programmed-set endpoint the parity
+            # test reads.
+            - name: ENABLE_PROGRAMMED_SET
+              value: "false"
           ports:
             - name: grpc
               containerPort: 5005
diff --git a/config/federation/README.md b/config/federation/README.md
new file mode 100644
index 00000000..eb464295
--- /dev/null
+++ b/config/federation/README.md
@@ -0,0 +1,41 @@
+# Federation
+
+The Datum edge runs across many clusters in many regions. Customers, though,
+work against a single control plane: they create a Gateway, a route, or a
+firewall policy in one place. **Federation is what carries that intent out to
+the edge clusters that actually serve traffic.**
+
+This directory holds the federation configuration the test environment applies,
+mirrored from production so the test edge fans configuration out the same way
+the real one does.
+
+## Why it's tested as its own concern
+
+For most of this system's history, the test environment copied configuration
+between clusters with a simple direct mechanism — nothing like production. But
+several real incidents lived specifically in the federation layer: some
+information (a backend's online/offline status) is intentionally *not* carried
+to the edge, and the timing of cross-cluster delivery created races. None of
+that is visible unless the test edge federates the way production does.
+
+So the production-fidelity environment stands up real federation and proves the
+thing customers depend on: **configuration created in the control plane actually
+arrives at the edge.** The test confirms a change made centrally shows up on a
+downstream cluster within seconds.
+
+## What's here
+
+- A propagation policy describing *which* resources travel to the edge.
+- Interpreter rules describing *how* each resource type is carried — including
+  the deliberate choice to propagate configuration but not live status, which is
+  the behavior that caused real "false offline" incidents and is now exercised
+  directly.
+
+## Implementation
+
+Federation is implemented with [Karmada](https://karmada.io/). The directory is
+named for the responsibility — fanning configuration out to the edge — rather
+than the tool, so the intent stays clear even if the underlying mechanism
+changes. The environment that applies these artifacts is described in
+[`Taskfile.test-infra.yml`](../../Taskfile.test-infra.yml) (`task
+test-infra:karmada-up`).
diff --git a/config/federation/clusterpropagationpolicy.yaml b/config/federation/clusterpropagationpolicy.yaml
new file mode 100644
index 00000000..5299bb3b
--- /dev/null
+++ b/config/federation/clusterpropagationpolicy.yaml
@@ -0,0 +1,158 @@
+apiVersion: policy.karmada.io/v1alpha1
+kind: ClusterPropagationPolicy
+metadata:
+  name: nso-resources
+spec:
+  conflictResolution: Overwrite
+  placement:
+    clusterAffinities:
+      - affinityName: gateway-enabled
+        labelSelector:
+          matchExpressions:
+          - key: infra.datum.net/gateways
+            operator: In
+            values:
+            - enabled
+  resourceSelectors:
+  - apiVersion: v1
+    kind: Namespace
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-namespace
+        operator: Exists
+  - apiVersion: v1
+    kind: ConfigMap
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-namespace
+        operator: Exists
+  - apiVersion: v1
+    kind: Secret
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-namespace
+        operator: Exists
+  # TODO(jreese) clean up dupe secret policies
+  - apiVersion: v1
+    kind: Secret
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: v1
+    kind: Secret
+    labelSelector:
+      matchExpressions:
+      - key: cert-manager.io/issuer-name
+        operator: In
+        values:
+          - nso-gateway
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: v1
+    kind: Service
+    # TODO(jreese) get labels on these patch policies
+    # labelSelector:
+    #   matchExpressions:
+    #   - key: meta.datumapis.com/upstream-cluster-name
+    #     operator: Exists
+
+  # Gateway API
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/http01-solver
+        operator: Exists
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: BackendTLSPolicy
+    # TODO(jreese) get labels on these when they are created by the httpproxy
+    # controller
+    # labelSelector:
+    #   matchExpressions:
+    #   - key: meta.datumapis.com/upstream-cluster-name
+    #     operator: Exists
+
+  # Envoy Gateway API Extensions
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: BackendTrafficPolicy
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: HTTPRouteFilter
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: HTTPRouteFilter
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/http01-solver
+        operator: Exists
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: SecurityPolicy
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyPatchPolicy
+    # TODO(jreese) get labels on these patch policies
+    # labelSelector:
+    #   matchExpressions:
+    #   - key: meta.datumapis.com/upstream-cluster-name
+    #     operator: Exists
+
+  # Network Services Operator CRDs (replicated for the extension server)
+  - apiVersion: networking.datumapis.com/v1alpha1
+    kind: Connector
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: networking.datumapis.com/v1alpha
+    kind: TrafficProtectionPolicy
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+  - apiVersion: networking.datumapis.com/v1alpha
+    kind: HTTPProxy
+    labelSelector:
+      matchExpressions:
+      - key: meta.datumapis.com/upstream-cluster-name
+        operator: Exists
+
+  # External DNS
+  - apiVersion: externaldns.k8s.io/v1alpha1
+    kind: DNSEndpoint
+    # TODO(jreese) get labels on these
+    # labelSelector:
+    #   matchExpressions:
+    #   - key: meta.datumapis.com/upstream-cluster-name
+    #     operator: Exists
diff --git a/config/federation/resourceinterpreters.yaml b/config/federation/resourceinterpreters.yaml
new file mode 100644
index 00000000..452a19ad
--- /dev/null
+++ b/config/federation/resourceinterpreters.yaml
@@ -0,0 +1,234 @@
+# Future test coverage for resource interpreters can leverage the test framework
+# once it's merged.
+#
+# See: https://github.com/karmada-io/karmada/pull/6938
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.networking.k8s.io-gateway
+spec:
+  target:
+    apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.addresses ~= nil then
+            desiredObj.status.addresses = item.status.addresses
+          end
+          if item.status.conditions ~= nil then
+            desiredObj.status.conditions = item.status.conditions
+          end
+          if item.status.listeners ~= nil then
+            desiredObj.status.listeners = item.status.listeners
+          end
+          return desiredObj
+        end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.networking.k8s.io-httproute
+spec:
+  target:
+    apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.parents ~= nil then
+            desiredObj.status.parents = item.status.parents
+          end
+          return desiredObj
+        end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.networking.k8s.io-backendtlspolicy
+spec:
+  target:
+    apiVersion: gateway.networking.k8s.io/v1
+    kind: BackendTLSPolicy
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.ancestors ~= nil then
+            desiredObj.status.ancestors = item.status.ancestors
+          end
+          return desiredObj
+        end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.envoyproxy.io-backend
+spec:
+  target:
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: Backend
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.conditions ~= nil then
+            desiredObj.status.conditions = item.status.conditions
+          end
+          return desiredObj
+        end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.envoyproxy.io-backendtrafficpolicy
+spec:
+  target:
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: BackendTrafficPolicy
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.ancestors ~= nil then
+            desiredObj.status.ancestors = item.status.ancestors
+          end
+          return desiredObj
+        end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: gateway.envoyproxy.io-envoypatchpolicy
+spec:
+  target:
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyPatchPolicy
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.ancestors ~= nil then
+            desiredObj.status.ancestors = item.status.ancestors
+          end
+          return desiredObj
+        end
+---
+apiVersion: config.karmada.io/v1alpha1
+kind: ResourceInterpreterCustomization
+metadata:
+  name: externaldns.k8s.io-dnsendpoint
+spec:
+  target:
+    apiVersion: externaldns.k8s.io/v1alpha1
+    kind: DNSEndpoint
+  customizations:
+    statusAggregation:
+      luaScript: >
+        function AggregateStatus(desiredObj, statusItems)
+          if statusItems == nil or #statusItems == 0 then
+            return desiredObj
+          end
+          if desiredObj.status == nil then
+            desiredObj.status = {}
+          end
+
+          local item = statusItems[1]
+          if item == nil or item.status == nil then
+            return desiredObj
+          end
+
+          -- TODO(jreese) implement proper aggregation logic. Would be good to
+          -- think through how to represent propagation status across clusters.
+          if item.status.observedGeneration ~= nil then
+            desiredObj.status.observedGeneration = item.status.observedGeneration
+          end
+          return desiredObj
+        end
diff --git a/config/tools/envoy-gateway-downstream/kustomization.yaml b/config/tools/envoy-gateway-downstream/kustomization.yaml
index d6cce819..9f5a2a92 100644
--- a/config/tools/envoy-gateway-downstream/kustomization.yaml
+++ b/config/tools/envoy-gateway-downstream/kustomization.yaml
@@ -6,7 +6,7 @@ helmCharts:
     includeCRDs: false
     namespace: datum-downstream-gateway
     releaseName: envoy-datum-downstream-gateway
-    version: v1.8.1
+    version: v1.7.4
     repo: oci://docker.io/envoyproxy
     valuesInline:
       config:
@@ -29,6 +29,10 @@ helmCharts:
                     - key: meta.datumapis.com/upstream-cluster-name
                       operator: Exists
           extensionManager:
+            # Match the ext-server's compiled-in 256 MiB gRPC ceiling. Without
+            # this the EG side defaults to ~4 MiB and silently freezes xDS once a
+            # translated snapshot exceeds it (~540 gateways in prod).
+            maxMessageSize: 256Mi
             policyResources:
               - group: networking.datumapis.com
                 version: v1alpha
@@ -43,9 +47,11 @@ helmCharts:
                 port: 5005
               tls:
                 certificateRef:
-                  # Placeholder — an overlay must patch this to the Secret holding the CA that issued the server cert.
-                  name: placeholder-ca
-                  namespace: placeholder-namespace
+                  # e2e: the Secret holding the CA that issued the ext-server
+                  # server cert. Published by the bring-up (test-infra:extserver-ca-bundle)
+                  # from the e2e-extension-server-ca cert-manager secret.
+                  name: e2e-extension-server-ca
+                  namespace: network-services-operator-system
                 clientCertificateRef:
                   name: envoy-gateway-extension-server-eg-client-tls
                   namespace: network-services-operator-system
diff --git a/config/tools/kind/downstream-cluster.yaml b/config/tools/kind/downstream-cluster.yaml
new file mode 100644
index 00000000..6339242a
--- /dev/null
+++ b/config/tools/kind/downstream-cluster.yaml
@@ -0,0 +1,14 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+name: nso-downstream
+networking:
+  ipFamily: dual
+nodes:
+- role: control-plane
+  extraPortMappings:
+  - containerPort: 30080
+    hostPort: 30080
+    protocol: TCP
+  - containerPort: 30443
+    hostPort: 30443
+    protocol: TCP
diff --git a/config/tools/kind/upstream-cluster.yaml b/config/tools/kind/upstream-cluster.yaml
new file mode 100644
index 00000000..be723669
--- /dev/null
+++ b/config/tools/kind/upstream-cluster.yaml
@@ -0,0 +1,15 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+name: nso-upstream
+networking:
+  ipFamily: dual
+nodes:
+- role: control-plane
+  # Expose the Karmada apiserver NodePort (32443) to the host so karmadactl —
+  # which runs on the host — can reach the Karmada apiserver during init/join.
+  # On macOS the kind docker-network IP is not host-routable, so without this
+  # mapping karmadactl times out dialing the advertised node IP:32443.
+  extraPortMappings:
+  - containerPort: 32443
+    hostPort: 32443
+    protocol: TCP
diff --git a/docs/testing/README.md b/docs/testing/README.md
new file mode 100644
index 00000000..8de1abba
--- /dev/null
+++ b/docs/testing/README.md
@@ -0,0 +1,87 @@
+# Testing the Datum edge
+
+This is the map for how we test the network-services-operator (NSO) — what we
+prove, and why it's built the way it is. It's written for anyone who wants to
+understand the safety net, not just the people who maintain it.
+
+## Why this exists
+
+NSO programs the edge: when a customer creates a Gateway, a route, a web-app
+firewall policy, or a connector, NSO turns that intent into live configuration
+on the Envoy proxies that actually serve customer traffic. The hard part isn't
+producing the configuration — it's making sure the configuration that lands on
+the running proxy *does what the customer asked*.
+
+Almost every production incident in this system has shared one shape:
+
+> **The configuration was logically correct, the platform reported success, but
+> the running proxy behaved differently than intended** — a firewall rule that
+> protected nothing, an offline backend that still returned a blank error, a
+> branded error page that never appeared, a single bad certificate that froze a
+> whole shared listener.
+
+These failures are invisible to ordinary tests. The Kubernetes resources report
+"Programmed = True," unit tests pass, and the gap only shows up when real
+traffic — often a real *attack* — arrives at the edge. So our testing is built
+around one principle:
+
+**Prove behavior at the edge with real traffic, against an environment that
+looks like production — not against the platform's own report of success.**
+
+## The two ideas everything rests on
+
+**1. Production fidelity.** The recent incidents lived precisely on the axes
+where our old test environment differed from production: the proxy version, the
+"fail closed" availability coupling, the firewall data plane, and multi-cluster
+replication. So the test environment stands up the *real* shape of the edge —
+the same proxy version, the same extension server that rewrites configuration,
+the same firewall image, and the same federation mechanism that fans
+configuration out to edge clusters. If a test passes here, it passes against
+something production actually runs. This environment is brought online with a
+single command set (`task test-infra:up`); see
+[`Taskfile.test-infra.yml`](../../Taskfile.test-infra.yml).
+
+**2. Traffic-first, with a tie-breaker.** Every test's verdict is the
+*observed behavior* of real traffic through the real proxy — a blocked attack,
+a 503 for an offline backend, the branded page in the response body. We never
+let "the platform says it worked" stand in for "the edge did the right thing."
+
+Real traffic alone has one blind spot, though: a firewall that protects nothing
+and a firewall that's simply not being attacked produce the *same* successful
+response. So traffic is backed by a **parity check** — a comparison of what the
+edge was told to do against what the running proxy is actually doing — which
+turns a surprising result into a diagnosis instead of a guess. Traffic is always
+the verdict; parity is the tie-breaker that catches the silently-inert case.
+See [`test/parity/README.md`](../../test/parity/README.md).
+
+## What we guarantee
+
+The end-to-end suite ([`test/e2e-edge/README.md`](../../test/e2e-edge/README.md)) turns
+each past incident into a standing guarantee, checked against real traffic:
+
+- **A web-app firewall actually blocks attacks** — a malicious request is
+  refused while a legitimate one still succeeds.
+- **An offline backend fails cleanly** — the customer path returns a real 503,
+  not a hang or a blank.
+- **Branded error pages reach the customer** — the styled page appears in the
+  actual response, not just in configuration.
+- **One bad certificate can't take down its neighbors** — an invalid listener
+  is isolated while the healthy listeners on the same proxy keep serving.
+
+And the federation layer ([`config/federation/README.md`](../../config/federation/README.md))
+proves that configuration created in the control plane genuinely arrives at the
+edge clusters that serve traffic.
+
+## Where things live
+
+| Area | What it covers |
+|---|---|
+| [`Taskfile.test-infra.yml`](../../Taskfile.test-infra.yml) | Brings the production-fidelity edge online and runs the suites |
+| [`test/e2e-edge/README.md`](../../test/e2e-edge/README.md) | The real-traffic guarantees, scenario by scenario |
+| [`test/parity/README.md`](../../test/parity/README.md) | The parity check that catches silently-inert configuration |
+| [`config/federation/README.md`](../../config/federation/README.md) | Fanning configuration out to edge clusters |
+
+> The design rationale that led here — the original audit of test-vs-production
+> gaps and the proposals for closing them — lives in the pull requests that
+> introduced this work, not in the repository, because it describes a plan
+> rather than the system as it stands today.
diff --git a/internal/extensionserver/cmd/run.go b/internal/extensionserver/cmd/run.go
index cac6e9f9..116d2847 100644
--- a/internal/extensionserver/cmd/run.go
+++ b/internal/extensionserver/cmd/run.go
@@ -68,13 +68,15 @@ func envBool(key string, def bool) bool {
 //	--tls-key=/tls/tls.key
 //	--tls-client-ca=/tls/ca.crt
 //	--server-config=/config/config.yaml  (optional; provides Coraza WAF config)
+//	--enable-programmed-set=false         (default off; test environments set true)
 type options struct {
-	grpcAddr      string
-	healthAddr    string
-	tlsCert       string
-	tlsKey        string
-	tlsClientCA   string
-	serverCfgFile string
+	grpcAddr            string
+	healthAddr          string
+	tlsCert             string
+	tlsKey              string
+	tlsClientCA         string
+	serverCfgFile       string
+	enableProgrammedSet bool
 }
 
 // NewCommand returns the "extension-server" subcommand.
@@ -99,6 +101,8 @@ func NewCommand() *cobra.Command {
 	fs.StringVar(&o.tlsKey, "tls-key", "", "Path to server TLS key (PEM)")
 	fs.StringVar(&o.tlsClientCA, "tls-client-ca", "", "Path to client CA certificate (PEM) for mTLS")
 	fs.StringVar(&o.serverCfgFile, "server-config", "", "Path to operator config file (optional; provides Coraza WAF settings)")
+	fs.BoolVar(&o.enableProgrammedSet, "enable-programmed-set", false,
+		"Serve the read-only /debug/programmed-set endpoint used by the parity test (test environments only)")
 
 	cmd := &cobra.Command{
 		Use:   "envoy-gateway-extension-server",
@@ -278,6 +282,9 @@ func run(o options) {
 		ConnectorInternalListener: serverConfig.Gateway.ConnectorTunnelListenerName(),
 		CorazaRouteBaseDirectives: coraza.RouteBaseDirectives,
 		LocalReply:                buildLocalReplyConfig(serverConfig.Gateway.ErrorPage, log),
+		// The programmed-set debug endpoint is for the test environment only; it
+		// stays off in production unless --enable-programmed-set is passed.
+		EnableProgrammedSet: o.enableProgrammedSet,
 	}
 
 	// --- gRPC panic recovery interceptor ---
@@ -470,6 +477,12 @@ func run(o options) {
 		}
 	})
 	mux.Handle("/metrics", promhttp.Handler())
+	// Read-only debug endpoint that reports what the last build changed, so a test
+	// can confirm the proxy is running exactly that. Test environment only; it is
+	// not served in production. Keeps only the last build.
+	if srvCfg.EnableProgrammedSet {
+		mux.HandleFunc(extserver.ProgrammedSetEndpointPath, extSrv.ProgrammedSetHandler())
+	}
 	healthServer := &http.Server{
 		Addr:    healthAddr,
 		Handler: mux,
diff --git a/internal/extensionserver/server/programmedset.go b/internal/extensionserver/server/programmedset.go
new file mode 100644
index 00000000..e4ebdf7a
--- /dev/null
+++ b/internal/extensionserver/server/programmedset.go
@@ -0,0 +1,192 @@
+package server
+
+import (
+	"encoding/json"
+	"net/http"
+	"sync"
+	"time"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+)
+
+// programmedSetEndpointPath is a read-only debug endpoint that reports the exact
+// set of changes the last build intended to make, so a test can confirm the
+// proxy is running that set and not merely the right number of things.
+const programmedSetEndpointPath = "/debug/programmed-set"
+
+// Marker strings, kept in sync with where the configuration is written, used to
+// recognize each change when reading the configuration back.
+const (
+	datumGatewayMetaKey        = "datum-gateway"
+	connectorInternalTransport = "envoy.transport_sockets.internal_upstream"
+	hcmNetworkFilterName       = "envoy.filters.network.http_connection_manager"
+)
+
+// Family names a kind of change recorded in a snapshot. The strings are stable
+// JSON keys the parity test depends on; do not rename.
+type Family string
+
+const (
+	FamilyWAFRoute         Family = "waf_route"
+	FamilyWAFHCM           Family = "waf_hcm"
+	FamilyLocalReply       Family = "local_reply"
+	FamilyConnectorCluster Family = "connector_cluster"
+	FamilyConnectorRoute   Family = "connector_route"
+	FamilyConnectorOffline Family = "connector_offline"
+	FamilyTLSPrune         Family = "tls_prune"
+)
+
+// ProgrammedSet is a snapshot of one build's intended changes. It is served as
+// JSON and read back by the parity test.
+type ProgrammedSet struct {
+	// BuildID increments once per build so a caller can tell two successive
+	// snapshots apart and know a fresh build has happened.
+	BuildID uint64 `json:"buildID"`
+	// CapturedAt is when the snapshot was recorded.
+	CapturedAt time.Time `json:"capturedAt"`
+	// Keys is, per kind of change, the identity of each thing changed. Each value
+	// is sorted and de-duplicated. The identity format is described on the
+	// record helpers below and mirrored by the parity test.
+	Keys map[Family][]string `json:"keys"`
+	// Counts holds the size of each set in Keys, plus the removed-certificate
+	// outcomes below that have no per-item identity. Used as a secondary check.
+	Counts map[Family]int `json:"counts"`
+	// Removing invalid TLS certificates is confirmed by counting outcomes rather
+	// than by identity, so the raw numbers are carried here.
+	TLSPrunedChains        int `json:"tlsPrunedChains"`
+	TLSPrunedSecrets       int `json:"tlsPrunedSecrets"`
+	TLSListenersLeftIntact int `json:"tlsListenersLeftIntact"`
+}
+
+// programmedRecorder holds the most recent snapshot under a lock, shared between
+// the build that writes it and the endpoint that reads it. Only the last build
+// is kept; each recording replaces the previous one.
+type programmedRecorder struct {
+	mu      sync.RWMutex
+	buildID uint64
+	last    *ProgrammedSet
+}
+
+// newProgrammedRecorder returns an empty recorder. Before the first build it
+// reports a valid empty snapshot with a zero build count, so callers can tell
+// "no build yet" from a real build.
+func newProgrammedRecorder() *programmedRecorder {
+	return &programmedRecorder{}
+}
+
+// snapshot returns the last recorded set, or an empty one if no build has run.
+// The returned value is a copy safe to serialize without the lock.
+func (r *programmedRecorder) snapshot() ProgrammedSet {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	if r.last == nil {
+		return ProgrammedSet{Keys: map[Family][]string{}, Counts: map[Family]int{}}
+	}
+	return *r.last
+}
+
+// record reads the configuration the build just produced and stores a snapshot
+// of it. It only reads, never changes the configuration, and holds the write
+// lock just long enough to store the result so it doesn't slow the build.
+func (r *programmedRecorder) record(
+	listeners []*listenerv3.Listener,
+	routes []*routev3.RouteConfiguration,
+	clusters []*clusterv3.Cluster,
+	corazaFilterName string,
+	tlsPrunedChains, tlsPrunedSecrets, tlsListenersLeftIntact int,
+) {
+	ps := buildProgrammedSet(listeners, routes, clusters, corazaFilterName,
+		tlsPrunedChains, tlsPrunedSecrets, tlsListenersLeftIntact)
+
+	r.mu.Lock()
+	r.buildID++
+	ps.BuildID = r.buildID
+	r.last = &ps
+	r.mu.Unlock()
+}
+
+// buildProgrammedSet walks the produced configuration and extracts an identity
+// for each change. It is a pure function so it can be unit tested directly. The
+// identity formats must match what the parity test looks for; keep both sides
+// in lockstep.
+func buildProgrammedSet(
+	listeners []*listenerv3.Listener,
+	routes []*routev3.RouteConfiguration,
+	clusters []*clusterv3.Cluster,
+	corazaFilterName string,
+	tlsPrunedChains, tlsPrunedSecrets, tlsListenersLeftIntact int,
+) ProgrammedSet {
+	keys := map[Family][]string{}
+	add := func(f Family, k string) { keys[f] = append(keys[f], k) }
+
+	for _, rc := range routes {
+		rcName := rc.GetName()
+		for _, vh := range rc.GetVirtualHosts() {
+			vhName := vh.GetName()
+			for _, rt := range vh.GetRoutes() {
+				// The identity includes the protection policy governing the route,
+				// so a route protected by the wrong policy shows up as a mismatch.
+				if ns, name, mode, ok := datumGatewayTPP(rt); ok {
+					add(FamilyWAFRoute, wafRouteKey(rcName, vhName, rt.GetName(), ns, name, mode))
+				}
+				if isConnectRoute(rt) {
+					add(FamilyConnectorRoute, connectorRouteKey(rcName, vhName, rt.GetName()))
+				}
+				if isOfflineDirectResponse(rt) {
+					add(FamilyConnectorOffline, connectorRouteKey(rcName, vhName, rt.GetName()))
+				}
+			}
+		}
+	}
+
+	for _, cl := range clusters {
+		if isReplacedConnectorCluster(cl) {
+			add(FamilyConnectorCluster, cl.GetName())
+		}
+	}
+
+	for _, l := range listeners {
+		lName := l.GetName()
+		eachHCM(l, func(fcName string, hcm *hcmv3.HttpConnectionManager) {
+			if corazaFilterName != "" && hcmHasFilterAtZero(hcm, corazaFilterName) {
+				add(FamilyWAFHCM, listenerChainKey(lName, fcName))
+			}
+			if hcm.GetLocalReplyConfig() != nil {
+				add(FamilyLocalReply, listenerChainKey(lName, fcName))
+			}
+		})
+	}
+
+	// Sort and de-duplicate so the output can be compared as a set.
+	counts := map[Family]int{}
+	for f := range keys {
+		keys[f] = sortDedup(keys[f])
+		counts[f] = len(keys[f])
+	}
+	// Removed certificates are recorded by count, since they have no identity.
+	counts[FamilyTLSPrune] = tlsPrunedChains
+
+	return ProgrammedSet{
+		CapturedAt:             time.Now().UTC(),
+		Keys:                   keys,
+		Counts:                 counts,
+		TLSPrunedChains:        tlsPrunedChains,
+		TLSPrunedSecrets:       tlsPrunedSecrets,
+		TLSListenersLeftIntact: tlsListenersLeftIntact,
+	}
+}
+
+// programmedSetHandler serves the latest snapshot as JSON. It is a read-only,
+// test-only debug endpoint and returns an empty snapshot before the first build.
+func (r *programmedRecorder) programmedSetHandler() http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		ps := r.snapshot()
+		w.Header().Set("Content-Type", "application/json")
+		enc := json.NewEncoder(w)
+		enc.SetIndent("", "  ")
+		_ = enc.Encode(ps)
+	}
+}
diff --git a/internal/extensionserver/server/programmedset_scan.go b/internal/extensionserver/server/programmedset_scan.go
new file mode 100644
index 00000000..ad41abf2
--- /dev/null
+++ b/internal/extensionserver/server/programmedset_scan.go
@@ -0,0 +1,160 @@
+package server
+
+import (
+	"sort"
+	"strings"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+)
+
+// These read-only scanners extract an identity for each change the build made.
+// They mirror, in reverse, how the configuration is written, and they define
+// the exact identity format the parity test must reproduce. The "##" separator
+// is used because it cannot appear in any of the names it joins.
+
+const keySep = "##"
+
+// wafRouteKey is the identity of a route protected by a firewall:
+//
+//	<routeConfig>##<virtualHost>##<routeName>##<policyNamespace>/<policyName>/<mode>
+//
+// The governing policy is part of the identity, so a route protected by the
+// wrong policy produces a different identity and is caught as a mismatch.
+func wafRouteKey(rc, vh, rt, tppNS, tppName, mode string) string {
+	return strings.Join([]string{rc, vh, rt, tppNS + "/" + tppName + "/" + mode}, keySep)
+}
+
+// connectorRouteKey is the identity of a connector route (online or offline):
+//
+//	<routeConfig>##<virtualHost>##<routeName>
+func connectorRouteKey(rc, vh, rt string) string {
+	return strings.Join([]string{rc, vh, rt}, keySep)
+}
+
+// listenerChainKey is the identity of a changed listener filter chain:
+//
+//	<listenerName>##<filterChainName>
+func listenerChainKey(listener, chain string) string {
+	return strings.Join([]string{listener, chain}, keySep)
+}
+
+// datumGatewayTPP returns the protection policy governing a route (namespace,
+// name, mode). ok is false when the route carries no such marker, meaning it is
+// not protected.
+func datumGatewayTPP(rt *routev3.Route) (ns, name, mode string, ok bool) {
+	md := rt.GetMetadata()
+	if md == nil {
+		return "", "", "", false
+	}
+	dg := md.GetFilterMetadata()[datumGatewayMetaKey]
+	if dg == nil {
+		return "", "", "", false
+	}
+	res := dg.GetFields()["resources"].GetListValue()
+	if res == nil || len(res.GetValues()) == 0 {
+		return "", "", "", false
+	}
+	f := res.GetValues()[0].GetStructValue().GetFields()
+	return f["namespace"].GetStringValue(),
+		f["name"].GetStringValue(),
+		f["mode"].GetStringValue(),
+		true
+}
+
+// isConnectRoute reports whether a route is an online connector tunnel route.
+func isConnectRoute(rt *routev3.Route) bool {
+	ra := rt.GetRoute()
+	if ra == nil {
+		return false
+	}
+	for _, uc := range ra.GetUpgradeConfigs() {
+		if strings.EqualFold(uc.GetUpgradeType(), "CONNECT") {
+			return true
+		}
+	}
+	return false
+}
+
+// isOfflineDirectResponse reports whether a route directly returns the
+// tunnel-offline 503 response, covering both the dedicated offline route and
+// user-facing routes rewritten to it.
+func isOfflineDirectResponse(rt *routev3.Route) bool {
+	dr := rt.GetDirectResponse()
+	if dr == nil {
+		return false
+	}
+	if dr.GetStatus() != 503 {
+		return false
+	}
+	return dr.GetBody().GetInlineString() == offlineBodyMarker
+}
+
+// offlineBodyMarker is the response body the connector offline path writes,
+// duplicated here so the scanner needs no import dependency.
+const offlineBodyMarker = "Tunnel not online"
+
+// isReplacedConnectorCluster reports whether a connector cluster has been
+// replaced with its tunnel form. A cluster that has not been replaced means the
+// substitution failed.
+func isReplacedConnectorCluster(cl *clusterv3.Cluster) bool {
+	if cl.GetType() != clusterv3.Cluster_STATIC {
+		return false
+	}
+	return cl.GetTransportSocket().GetName() == connectorInternalTransport
+}
+
+// eachHCM invokes fn for every connection manager across all of the listener's
+// filter chains, including the default chain. One that can't be decoded is
+// skipped, since recording must never fail the build.
+func eachHCM(l *listenerv3.Listener, fn func(chainName string, hcm *hcmv3.HttpConnectionManager)) {
+	chains := make([]*listenerv3.FilterChain, 0, len(l.GetFilterChains())+1)
+	chains = append(chains, l.GetFilterChains()...)
+	if dfc := l.GetDefaultFilterChain(); dfc != nil {
+		chains = append(chains, dfc)
+	}
+	for _, fc := range chains {
+		for _, f := range fc.GetFilters() {
+			if f.GetName() != hcmNetworkFilterName {
+				continue
+			}
+			tc := f.GetTypedConfig()
+			if tc == nil {
+				continue
+			}
+			hcm := &hcmv3.HttpConnectionManager{}
+			if err := tc.UnmarshalTo(hcm); err != nil {
+				continue
+			}
+			fn(fc.GetName(), hcm)
+		}
+	}
+}
+
+// hcmHasFilterAtZero reports whether the first filter is named filterName. The
+// firewall is always inserted first, so checking the first position is the
+// precise signal that it was injected.
+func hcmHasFilterAtZero(hcm *hcmv3.HttpConnectionManager, filterName string) bool {
+	fs := hcm.GetHttpFilters()
+	return len(fs) > 0 && fs[0].GetName() == filterName
+}
+
+// sortDedup returns a sorted, de-duplicated copy of in.
+func sortDedup(in []string) []string {
+	if len(in) == 0 {
+		return in
+	}
+	seen := make(map[string]struct{}, len(in))
+	out := make([]string, 0, len(in))
+	for _, s := range in {
+		if _, ok := seen[s]; ok {
+			continue
+		}
+		seen[s] = struct{}{}
+		out = append(out, s)
+	}
+	sort.Strings(out)
+	return out
+}
diff --git a/internal/extensionserver/server/programmedset_test.go b/internal/extensionserver/server/programmedset_test.go
new file mode 100644
index 00000000..a18cc253
--- /dev/null
+++ b/internal/extensionserver/server/programmedset_test.go
@@ -0,0 +1,363 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	pb "github.com/envoyproxy/gateway/proto/extension"
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	internalupstreamv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/internal_upstream/v3"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/structpb"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client/fake"
+	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gatewayv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+
+	networkingv1alpha "go.datum.net/network-services-operator/api/v1alpha"
+	networkingv1alpha1 "go.datum.net/network-services-operator/api/v1alpha1"
+)
+
+// --- buildProgrammedSet (pure function) ---
+
+// mkWAFRoute builds a route already carrying the datum-gateway metadata and a
+// coraza typed_per_filter_config, simulating a route after ApplyTPPRouteConfig.
+func mkWAFRoute(t *testing.T, tppNS, tppName string) *routev3.Route {
+	t.Helper()
+	meta, err := structpb.NewStruct(map[string]any{
+		"resources": []any{
+			map[string]any{
+				"kind":      "TrafficProtectionPolicy",
+				"namespace": tppNS,
+				"name":      tppName,
+				"mode":      "Observe",
+			},
+		},
+	})
+	require.NoError(t, err)
+	return &routev3.Route{
+		Name: "fwd",
+		Metadata: &corev3.Metadata{
+			FilterMetadata: map[string]*structpb.Struct{datumGatewayMetaKey: meta},
+		},
+	}
+}
+
+// mkCorazaHCMListener builds a listener whose HCM has the coraza filter at
+// position 0 and a local_reply_config, simulating a fully-mutated listener.
+func mkCorazaHCMListener(t *testing.T, name, corazaFilter string, withLocalReply bool) *listenerv3.Listener {
+	t.Helper()
+	hcm := &hcmv3.HttpConnectionManager{
+		RouteSpecifier: &hcmv3.HttpConnectionManager_Rds{Rds: &hcmv3.Rds{RouteConfigName: name}},
+		HttpFilters: []*hcmv3.HttpFilter{
+			{Name: corazaFilter, Disabled: true},
+			{Name: "envoy.filters.http.router"},
+		},
+	}
+	if withLocalReply {
+		hcm.LocalReplyConfig = &hcmv3.LocalReplyConfig{}
+	}
+	hcmAny, err := anypb.New(hcm)
+	require.NoError(t, err)
+	return &listenerv3.Listener{
+		Name: name,
+		FilterChains: []*listenerv3.FilterChain{{
+			Name: "fc",
+			Filters: []*listenerv3.Filter{{
+				Name:       hcmNetworkFilterName,
+				ConfigType: &listenerv3.Filter_TypedConfig{TypedConfig: hcmAny},
+			}},
+		}},
+	}
+}
+
+// mkReplacedConnectorCluster builds a STATIC internal-upstream cluster matching
+// what buildConnectorCluster produces.
+func mkReplacedConnectorCluster(t *testing.T, name string) *clusterv3.Cluster {
+	t.Helper()
+	ts, err := anypb.New(&internalupstreamv3.InternalUpstreamTransport{})
+	require.NoError(t, err)
+	return &clusterv3.Cluster{
+		Name:                 name,
+		ClusterDiscoveryType: &clusterv3.Cluster_Type{Type: clusterv3.Cluster_STATIC},
+		LoadAssignment:       &endpointv3.ClusterLoadAssignment{ClusterName: name},
+		TransportSocket: &corev3.TransportSocket{
+			Name:       connectorInternalTransport,
+			ConfigType: &corev3.TransportSocket_TypedConfig{TypedConfig: ts},
+		},
+	}
+}
+
+func TestBuildProgrammedSet_AllFamilies(t *testing.T) {
+	const corazaFilter = "coraza-waf"
+
+	listeners := []*listenerv3.Listener{
+		mkCorazaHCMListener(t, "gw/https", corazaFilter, true),
+	}
+	routes := []*routev3.RouteConfiguration{{
+		Name: "gw/https",
+		VirtualHosts: []*routev3.VirtualHost{{
+			Name: "vh",
+			Routes: []*routev3.Route{
+				// online CONNECT route
+				{
+					Name: "connector-connect-vh",
+					Action: &routev3.Route_Route{Route: &routev3.RouteAction{
+						UpgradeConfigs: []*routev3.RouteAction_UpgradeConfig{{UpgradeType: "CONNECT"}},
+					}},
+				},
+				// WAF-governed forwarding route
+				mkWAFRoute(t, "proj-ns", "test-tpp"),
+			},
+		}},
+	}}
+	clusters := []*clusterv3.Cluster{
+		mkReplacedConnectorCluster(t, "httproute/proj-ns/proxy/rule/0"),
+		{Name: "infra-cluster"}, // not a connector cluster
+	}
+
+	ps := buildProgrammedSet(listeners, routes, clusters, corazaFilter, 2, 1, 0)
+
+	assert.Equal(t, []string{wafRouteKey("gw/https", "vh", "fwd", "proj-ns", "test-tpp", "Observe")},
+		ps.Keys[FamilyWAFRoute])
+	assert.Equal(t, 1, ps.Counts[FamilyWAFRoute])
+
+	assert.Equal(t, []string{listenerChainKey("gw/https", "fc")}, ps.Keys[FamilyWAFHCM])
+	assert.Equal(t, []string{listenerChainKey("gw/https", "fc")}, ps.Keys[FamilyLocalReply])
+
+	assert.Equal(t, []string{"httproute/proj-ns/proxy/rule/0"}, ps.Keys[FamilyConnectorCluster])
+	assert.Equal(t, []string{connectorRouteKey("gw/https", "vh", "connector-connect-vh")},
+		ps.Keys[FamilyConnectorRoute])
+
+	// TLS prune outcome carried directly.
+	assert.Equal(t, 2, ps.TLSPrunedChains)
+	assert.Equal(t, 1, ps.TLSPrunedSecrets)
+	assert.Equal(t, 0, ps.TLSListenersLeftIntact)
+	assert.Equal(t, 2, ps.Counts[FamilyTLSPrune])
+}
+
+func TestBuildProgrammedSet_OfflineConnector(t *testing.T) {
+	routes := []*routev3.RouteConfiguration{{
+		Name: "gw/https",
+		VirtualHosts: []*routev3.VirtualHost{{
+			Name: "vh",
+			Routes: []*routev3.Route{
+				{
+					Name: "connector-offline-vh",
+					Action: &routev3.Route_DirectResponse{DirectResponse: &routev3.DirectResponseAction{
+						Status: 503,
+						Body:   &corev3.DataSource{Specifier: &corev3.DataSource_InlineString{InlineString: offlineBodyMarker}},
+					}},
+				},
+			},
+		}},
+	}}
+
+	ps := buildProgrammedSet(nil, routes, nil, "coraza-waf", 0, 0, 0)
+	assert.Equal(t, []string{connectorRouteKey("gw/https", "vh", "connector-offline-vh")},
+		ps.Keys[FamilyConnectorOffline])
+	// A 503 with a different body is NOT an offline connector marker.
+	assert.Empty(t, ps.Keys[FamilyConnectorRoute])
+}
+
+// TestBuildProgrammedSet_WrongKeyedOracle proves the WAF route key changes when
+// the governing TPP changes even though the route count is identical — the
+// wrong-keyed class the gate exists to catch.
+func TestBuildProgrammedSet_WrongKeyedOracle(t *testing.T) {
+	routesRight := []*routev3.RouteConfiguration{{
+		Name:         "gw/https",
+		VirtualHosts: []*routev3.VirtualHost{{Name: "vh", Routes: []*routev3.Route{mkWAFRoute(t, "proj-a", "tpp-a")}}},
+	}}
+	routesWrong := []*routev3.RouteConfiguration{{
+		Name:         "gw/https",
+		VirtualHosts: []*routev3.VirtualHost{{Name: "vh", Routes: []*routev3.Route{mkWAFRoute(t, "proj-b", "tpp-b")}}},
+	}}
+
+	right := buildProgrammedSet(nil, routesRight, nil, "coraza-waf", 0, 0, 0)
+	wrong := buildProgrammedSet(nil, routesWrong, nil, "coraza-waf", 0, 0, 0)
+
+	assert.Equal(t, right.Counts[FamilyWAFRoute], wrong.Counts[FamilyWAFRoute],
+		"counts identical — count-only gate would pass")
+	assert.NotEqual(t, right.Keys[FamilyWAFRoute], wrong.Keys[FamilyWAFRoute],
+		"key set differs — wrong-keyed must be detectable")
+}
+
+func TestBuildProgrammedSet_NoCorazaFilterName(t *testing.T) {
+	// With an empty filter name the WAF HCM family must not be recorded even
+	// though the HCM happens to carry a position-0 filter.
+	listeners := []*listenerv3.Listener{mkCorazaHCMListener(t, "gw/https", "coraza-waf", false)}
+	ps := buildProgrammedSet(listeners, nil, nil, "", 0, 0, 0)
+	assert.Empty(t, ps.Keys[FamilyWAFHCM])
+}
+
+// --- recorder + endpoint ---
+
+func TestProgrammedRecorder_EmptyBeforeFirstBuild(t *testing.T) {
+	r := newProgrammedRecorder()
+	ps := r.snapshot()
+	assert.Equal(t, uint64(0), ps.BuildID)
+	assert.NotNil(t, ps.Keys)
+	assert.NotNil(t, ps.Counts)
+}
+
+func TestProgrammedRecorder_BuildIDIncrements(t *testing.T) {
+	r := newProgrammedRecorder()
+	r.record(nil, nil, nil, "coraza-waf", 0, 0, 0)
+	first := r.snapshot()
+	r.record(nil, nil, nil, "coraza-waf", 0, 0, 0)
+	second := r.snapshot()
+	assert.Equal(t, uint64(1), first.BuildID)
+	assert.Equal(t, uint64(2), second.BuildID)
+}
+
+func TestProgrammedSetHandler_ServesJSON(t *testing.T) {
+	r := newProgrammedRecorder()
+	routes := []*routev3.RouteConfiguration{{
+		Name:         "gw/https",
+		VirtualHosts: []*routev3.VirtualHost{{Name: "vh", Routes: []*routev3.Route{mkWAFRoute(t, "proj-a", "tpp-a")}}},
+	}}
+	r.record(nil, routes, nil, "coraza-waf", 0, 0, 0)
+
+	req := httptest.NewRequest(http.MethodGet, programmedSetEndpointPath, nil)
+	w := httptest.NewRecorder()
+	r.programmedSetHandler()(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	assert.Equal(t, "application/json", w.Header().Get("Content-Type"))
+
+	var got ProgrammedSet
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &got))
+	assert.Equal(t, uint64(1), got.BuildID)
+	assert.Equal(t, []string{wafRouteKey("gw/https", "vh", "fwd", "proj-a", "tpp-a", "Observe")},
+		got.Keys[FamilyWAFRoute])
+}
+
+// TestPostTranslateModify_RecordsProgrammedSet drives the full hook with the
+// same fixture as TestPostTranslateModify_FullSnapshot and asserts the
+// programmed-set endpoint reflects the build (1 WAF route, 1 WAF HCM, 1
+// connector cluster, 1 connector route).
+func TestPostTranslateModify_RecordsProgrammedSet(t *testing.T) {
+	const (
+		upstreamNS    = "test-project"
+		dsNS          = upstreamNS
+		gwName        = "pset-gw"
+		proxyName     = "test-proxy"
+		connectorName = "test-connector"
+		nodeID        = "test-node-id"
+		connCluster   = "httproute/" + dsNS + "/" + proxyName + "/rule/0"
+	)
+	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: upstreamNS}}
+	tpp := &networkingv1alpha.TrafficProtectionPolicy{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-tpp", Namespace: upstreamNS},
+		Spec: networkingv1alpha.TrafficProtectionPolicySpec{
+			Mode: networkingv1alpha.TrafficProtectionPolicyObserve,
+			TargetRefs: []gatewayv1alpha2.LocalPolicyTargetReferenceWithSectionName{{
+				LocalPolicyTargetReference: gatewayv1.LocalPolicyTargetReference{
+					Kind: "Gateway", Name: gatewayv1.ObjectName(gwName),
+				},
+			}},
+			RuleSets: []networkingv1alpha.TrafficProtectionPolicyRuleSet{{
+				Type: networkingv1alpha.TrafficProtectionPolicyOWASPCoreRuleSet,
+				OWASPCoreRuleSet: networkingv1alpha.OWASPCRS{
+					ParanoiaLevels:  networkingv1alpha.ParanoiaLevels{Blocking: 1, Detection: 1},
+					ScoreThresholds: networkingv1alpha.OWASPScoreThresholds{Inbound: 5, Outbound: 4},
+				},
+			}},
+		},
+	}
+	proxy := &networkingv1alpha.HTTPProxy{
+		ObjectMeta: metav1.ObjectMeta{Name: proxyName, Namespace: upstreamNS},
+		Spec: networkingv1alpha.HTTPProxySpec{
+			Rules: []networkingv1alpha.HTTPProxyRule{{
+				Backends: []networkingv1alpha.HTTPProxyRuleBackend{{
+					Endpoint:  "http://backend.example.com:9000",
+					Connector: &networkingv1alpha.ConnectorReference{Name: connectorName},
+				}},
+			}},
+		},
+	}
+	connector := &networkingv1alpha1.Connector{
+		ObjectMeta: metav1.ObjectMeta{Name: connectorName, Namespace: upstreamNS},
+		Status: networkingv1alpha1.ConnectorStatus{
+			Conditions: []metav1.Condition{{
+				Type: networkingv1alpha1.ConnectorConditionReady, Status: metav1.ConditionTrue,
+				Reason: "Ready", LastTransitionTime: metav1.Now(),
+			}},
+			ConnectionDetails: &networkingv1alpha1.ConnectorConnectionDetails{
+				Type:      networkingv1alpha1.PublicKeyConnectorConnectionType,
+				PublicKey: &networkingv1alpha1.ConnectorConnectionDetailsPublicKey{Id: nodeID},
+			},
+		},
+	}
+
+	scheme := testServerScheme(t)
+	cl := fake.NewClientBuilder().WithScheme(scheme).
+		WithObjects(ns, tpp, proxy).
+		WithStatusSubresource(connector).WithObjects(connector).Build()
+	// Recording only happens when the test-environment endpoint is enabled.
+	cfg := testServerConfig()
+	cfg.EnableProgrammedSet = true
+	srv := New(cl, cfg, discardLogger())
+
+	req := &pb.PostTranslateModifyRequest{
+		Clusters: []*clusterv3.Cluster{{Name: connCluster}, {Name: "infra-cluster"}},
+		Listeners: []*listenerv3.Listener{
+			mkListenerWithHCM(t),
+			mkListenerWithStaticRoute(t, "envoy-gateway-proxy-ready-0.0.0.0-19003"),
+		},
+		Routes: []*routev3.RouteConfiguration{{
+			Name: "consumer-gw/pset-gw/https",
+			VirtualHosts: []*routev3.VirtualHost{{
+				Name: "vh", Domains: []string{"app.example.com"}, Metadata: egGatewayMeta(t, dsNS, gwName),
+				Routes: []*routev3.Route{{
+					Name: "fwd",
+					Action: &routev3.Route_Route{Route: &routev3.RouteAction{
+						ClusterSpecifier: &routev3.RouteAction_Cluster{Cluster: connCluster},
+					}},
+				}},
+			}},
+		}},
+	}
+
+	_, err := srv.PostTranslateModify(context.Background(), req)
+	require.NoError(t, err)
+
+	ps := srv.programmed.snapshot()
+	assert.Equal(t, uint64(1), ps.BuildID)
+	assert.Equal(t, 1, ps.Counts[FamilyWAFRoute], "one WAF-governed route")
+	assert.Equal(t, 1, ps.Counts[FamilyWAFHCM], "coraza injected into the one RDS HCM, not the readiness listener")
+	assert.Equal(t, 1, ps.Counts[FamilyConnectorCluster], "one connector cluster replaced")
+	assert.Equal(t, 1, ps.Counts[FamilyConnectorRoute], "one CONNECT route prepended")
+
+	// The WAF route key must name the governing TPP (wrong-keyed oracle).
+	require.Len(t, ps.Keys[FamilyWAFRoute], 1)
+	assert.Contains(t, ps.Keys[FamilyWAFRoute][0], "test-project/test-tpp/Observe")
+}
+
+// TestPostTranslateModify_NoRecordingWhenDisabled proves the production default:
+// with the test-only endpoint off, a build records nothing, so the snapshot
+// stays empty and no per-build work is done.
+func TestPostTranslateModify_NoRecordingWhenDisabled(t *testing.T) {
+	cl := fake.NewClientBuilder().WithScheme(testServerScheme(t)).Build()
+	// testServerConfig() leaves EnableProgrammedSet at its false default.
+	srv := New(cl, testServerConfig(), discardLogger())
+
+	_, err := srv.PostTranslateModify(context.Background(), &pb.PostTranslateModifyRequest{})
+	require.NoError(t, err)
+
+	ps := srv.programmed.snapshot()
+	assert.Equal(t, uint64(0), ps.BuildID, "no build was recorded")
+	assert.Empty(t, ps.Keys, "nothing recorded while the endpoint is disabled")
+}
diff --git a/internal/extensionserver/server/server.go b/internal/extensionserver/server/server.go
index 5fc21315..57a53cb1 100644
--- a/internal/extensionserver/server/server.go
+++ b/internal/extensionserver/server/server.go
@@ -7,6 +7,7 @@ package server
 import (
 	"context"
 	"log/slog"
+	"net/http"
 	"time"
 
 	pb "github.com/envoyproxy/gateway/proto/extension"
@@ -36,6 +37,12 @@ type ServerConfig struct {
 	// empty, local-reply injection is a no-op. Sourced from
 	// GatewayConfig.ErrorPage + the embedded/override HTML body.
 	LocalReply mutate.LocalReplyConfig
+	// EnableProgrammedSet turns on the read-only /debug/programmed-set endpoint
+	// and the per-build recording that backs it. It exists only to let a test
+	// confirm the proxy is running exactly the set the build intended, so it is
+	// off in production and enabled only in the test environment. When off, the
+	// build does no extra work and the endpoint is not served.
+	EnableProgrammedSet bool
 }
 
 // Server implements pb.EnvoyGatewayExtensionServer for the NSO production
@@ -51,15 +58,29 @@ type Server struct {
 	client client.Client
 	cfg    ServerConfig
 	log    *slog.Logger
+	// programmed records what the last build changed, so a test can ask the proxy
+	// to prove it is running exactly that. Always non-nil; capturing it only reads
+	// what was already produced.
+	programmed *programmedRecorder
 }
 
 // New returns a production extension server backed by the given cache client.
 // In production, cl is the ctrl.Manager.GetClient() from NewManager().
 // In tests, cl is a fake client pre-populated with the test objects.
 func New(cl client.Client, cfg ServerConfig, log *slog.Logger) *Server {
-	return &Server{client: cl, cfg: cfg, log: log}
+	return &Server{client: cl, cfg: cfg, log: log, programmed: newProgrammedRecorder()}
 }
 
+// ProgrammedSetHandler serves what the last build changed, so a test can confirm
+// the proxy is running exactly that. Read-only.
+func (s *Server) ProgrammedSetHandler() http.HandlerFunc {
+	return s.programmed.programmedSetHandler()
+}
+
+// ProgrammedSetEndpointPath is exported so the server and the test tooling share
+// one definition of where this endpoint lives.
+const ProgrammedSetEndpointPath = programmedSetEndpointPath
+
 // PostTranslateModify applies the TPP/WAF and Connector mutation families to
 // the full xDS snapshot and returns the complete (mutated) resource set.
 // Secrets are passed through unchanged — the response replaces EG's entire
@@ -317,6 +338,16 @@ func (s *Server) PostTranslateModify(
 	extmetrics.ConnectorRoutesTotal.Add(float64(vhCount))
 	extmetrics.ConnectorOfflineRoutesTotal.Add(float64(offlineRtCount))
 
+	// In the test environment, record what this build changed so a test can later
+	// confirm the proxy is running exactly that. This only reads the configuration
+	// just produced; it changes nothing. Off in production, where it does no work.
+	if s.cfg.EnableProgrammedSet {
+		s.programmed.record(
+			listeners, routes, clusters, s.cfg.Coraza.FilterName,
+			prunedChains, prunedSecrets, listenersLeftIntact,
+		)
+	}
+
 	s.log.Info("PostTranslateModify",
 		"clusters", len(clusters),
 		"listeners", len(listeners),
diff --git a/test/e2e-edge/README.md b/test/e2e-edge/README.md
new file mode 100644
index 00000000..952e28ea
--- /dev/null
+++ b/test/e2e-edge/README.md
@@ -0,0 +1,87 @@
+# End-to-end edge guarantees
+
+These tests prove that the Datum edge *behaves* the way customers expect, by
+sending real traffic through the real proxy and checking what actually comes
+back. They are the standing guarantees described in
+[`docs/testing/README.md`](../../docs/testing/README.md).
+
+## How a guarantee is checked
+
+Every scenario follows the same three-part check, in priority order:
+
+1. **The traffic verdict (always decisive).** The test makes a real request and
+   asserts on the real response — a blocked attack, a 503, a branded page, a
+   200 from a healthy listener. If the edge behaves wrongly, this fails. A test
+   is never satisfied by the platform merely *reporting* success.
+2. **The configuration is genuinely present.** A
+   [parity check](../parity/README.md) confirms the running proxy actually
+   carries the configuration it was told to — closing the blind spot where a
+   successful-looking response hides a rule that protects nothing.
+3. **It's the right configuration serving the request.** A build marker
+   confirms the response came from the configuration under test, not from stale
+   config left over from a previous state — so a pass can't be a timing fluke.
+
+The first is the point; the second and third exist so a surprising result
+becomes a diagnosis rather than a mystery.
+
+## The scenarios
+
+Each one corresponds to a past production incident, now held in place.
+
+### Web-app firewall enforcement
+A malicious request (matching the firewall's attack rules) must be refused,
+while a legitimate request to the same endpoint still succeeds. The test also
+flips the policy into observe-only mode and confirms the same attack is then
+*allowed* — proving the block is genuinely driven by the customer's firewall
+policy and not by some unrelated default. This guards the customer's actual
+protection, and the risk that a single bad firewall rule wedges the whole
+listener.
+
+### Offline backend returns a clean 503
+When a backend connector is offline, the customer-facing path must return a
+real 503 — not hang, and not serve a blank. This is checked as an observed
+response on the user path, because that's what a customer experiences.
+
+### Branded error page reaches the customer
+When the edge serves an error, the customer must receive Datum's styled page,
+confirmed by finding the page's content in the actual response body — not by
+trusting that the configuration was applied. Production once needed manual
+restarts to make this take effect, exactly the kind of inert-configuration gap
+this scenario now catches.
+
+### One bad certificate can't break its neighbors
+A single invalid certificate must not take down the other, healthy listeners
+sharing the same proxy. The test introduces a genuinely bad certificate and
+confirms its listener is isolated while sibling listeners keep serving real
+traffic — the "one bad resource freezes everything" failure mode, contained.
+
+## Running them
+
+The scenarios run against the production-fidelity environment:
+
+```
+task test-infra:up        # bring the edge online (proxy + extension server + firewall)
+task test-infra:smoke     # quick confidence check: real traffic serves
+task test-infra:e2e       # the full guarantee suite above
+```
+
+See [`Taskfile.test-infra.yml`](../../Taskfile.test-infra.yml) for the
+environment these assume.
+
+## Layout
+
+- Scenario folders (`waf-enforcement/`, `connector-offline-503/`,
+  `branded-error-page/`, `atomic-reject-isolation/`) — one guarantee each.
+- `_steps/` — shared, reusable checks (send-a-request, confirm-configuration,
+  capture-the-build-marker) so every scenario asserts behavior the same way.
+- `_fixtures/` — the supporting pieces a scenario needs (a sample backend, an
+  attack corpus, a pre-made bad certificate, the offline-backend stand-in).
+
+## A note on honesty
+
+Where the edge genuinely cannot yet do something, the suite says so rather than
+papering over it. The "offline backend recovers" path is deliberately held back
+because the edge today does not reliably re-apply configuration when a backend
+comes *back* online — and the test proves that gap exists instead of pretending
+it's closed. A guarantee we can't keep is documented as a gap, not asserted as
+a pass.
diff --git a/test/e2e-edge/_fixtures/certs/expired-cert-secret.yaml b/test/e2e-edge/_fixtures/certs/expired-cert-secret.yaml
new file mode 100644
index 00000000..305c8583
--- /dev/null
+++ b/test/e2e-edge/_fixtures/certs/expired-cert-secret.yaml
@@ -0,0 +1,14 @@
+# GENERATED by gen-certs.sh — do not edit by hand; re-run the script to refresh.
+#
+# A pre-minted EXPIRED certificate for bad.e2e.env.datum.net. Its validity window
+# (20260621000000Z .. 20260622000000Z) is in the past, so the extension server
+# drops the listener that references it while sibling listeners keep serving.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: expired-leaf-tls
+  namespace: default
+type: kubernetes.io/tls
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ0ekNDQVY2Z0F3SUJBZ0lVTW5lMFBkKzczaDFPcFh0YWo1eDlIbzRxR2Fjd0NnWUlLb1pJemowRUF3SXcKSURFZU1Cd0dBMVVFQXd3VlltRmtMbVV5WlM1bGJuWXVaR0YwZFcwdWJtVjBNQjRYRFRJMk1EWXlNVEF3TURBdwpNRm9YRFRJMk1EWXlNakF3TURBd01Gb3dJREVlTUJ3R0ExVUVBd3dWWW1Ga0xtVXlaUzVsYm5ZdVpHRjBkVzB1CmJtVjBNRmt3RXdZSEtvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVKWEYyV0U1UmZzN2lJbkpmVWRWZHNRa0IKWU9aRWk1TmV3cmZ5T3hkRWdiZ2ViNnRGMkpUbHA5L2tMNUYweEkvSWpYeXpFWlF1YU9vMVNwWCtYd0pWS3FOMgpNSFF3SUFZRFZSMFJCQmt3RjRJVlltRmtMbVV5WlM1bGJuWXVaR0YwZFcwdWJtVjBNQXdHQTFVZEV3RUIvd1FDCk1BQXdEZ1lEVlIwUEFRSC9CQVFEQWdXZ01CTUdBMVVkSlFRTU1Bb0dDQ3NHQVFVRkJ3TUJNQjBHQTFVZERnUVcKQkJTaTRpOTB2VkEwdmlQU0k2aW9WdFFEdXFhOE5qQUtCZ2dxaGtqT1BRUURBZ05IQURCRUFpQTJmalMvbGVmNQpTRHFEMEt5UWJRV1hENlltMHg4NDJnU2VPMS9XZ041MHpnSWdYVHd4MWZwSTNVc0U1UXI4bkNXWk0wd044b0cyCkU4a0ttZUo1a3BDL3lFST0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+  tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUM3Ri9qbkVFSTBYQk12emg4K0lCaVVycG5MMnVGeEpFSUlMQWkyd1Q4eXlvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSlhGMldFNVJmczdpSW5KZlVkVmRzUWtCWU9aRWk1TmV3cmZ5T3hkRWdiZ2ViNnRGMkpUbApwOS9rTDVGMHhJL0lqWHl6RVpRdWFPbzFTcFgrWHdKVktnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
diff --git a/test/e2e-edge/_fixtures/certs/gen-certs.sh b/test/e2e-edge/_fixtures/certs/gen-certs.sh
new file mode 100755
index 00000000..8d5a5d9b
--- /dev/null
+++ b/test/e2e-edge/_fixtures/certs/gen-certs.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Regenerate the pre-minted EXPIRED TLS certificate the invalid-certificate test
+# relies on.
+#
+# The test needs a certificate that is already expired at test time so the
+# extension server drops the listener that references it while sibling listeners
+# keep serving. cert-manager cannot help here: it renews before expiry, so it
+# cannot hold a certificate in the expired state. We instead mint a self-signed
+# certificate whose validity window is in the past.
+#
+# This is a listener certificate for the customer hostname under test, entirely
+# separate from the certificate authority securing the extension server's own
+# connection to the gateway; do not wire it to that authority.
+#
+# Output: expired-cert-secret.yaml — a Secret with the expired certificate and
+# key inline. The committed Secret is what the test consumes, so a live run needs
+# no openssl; re-run this script only to refresh it.
+#
+# Usage: ./gen-certs.sh [HOSTNAME] [SECRET_NAME] [SECRET_NAMESPACE]
+set -euo pipefail
+
+HOST="${1:-bad.e2e.env.datum.net}"
+SECRET_NAME="${2:-expired-leaf-tls}"
+SECRET_NS="${3:-default}"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "${WORK}"' EXIT
+
+# ECDSA P-256 key.
+openssl ecparam -name prime256v1 -genkey -noout -out "${WORK}/tls.key"
+
+# A self-signed certificate whose validity window is entirely in the past. We set
+# the exact start and end times with OpenSSL 3.x's -not_before/-not_after so the
+# certificate is already expired by the time the test runs.
+NOT_BEFORE="20260621000000Z"
+NOT_AFTER="20260622000000Z"
+
+cat > "${WORK}/leaf.cnf" <<EOF
+[req]
+distinguished_name = dn
+prompt = no
+x509_extensions = v3
+[dn]
+CN = ${HOST}
+[v3]
+subjectAltName = DNS:${HOST}
+basicConstraints = critical, CA:FALSE
+keyUsage = critical, digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+EOF
+
+openssl req -new -x509 \
+  -key "${WORK}/tls.key" \
+  -out "${WORK}/tls.crt" \
+  -config "${WORK}/leaf.cnf" \
+  -not_before "${NOT_BEFORE}" \
+  -not_after "${NOT_AFTER}" \
+  -sha256
+
+echo "minted leaf for ${HOST}:"
+openssl x509 -in "${WORK}/tls.crt" -noout -subject -dates
+
+CRT_B64="$(base64 < "${WORK}/tls.crt" | tr -d '\n')"
+KEY_B64="$(base64 < "${WORK}/tls.key" | tr -d '\n')"
+
+cat > "${SCRIPT_DIR}/expired-cert-secret.yaml" <<EOF
+# GENERATED by gen-certs.sh — do not edit by hand; re-run the script to refresh.
+#
+# A pre-minted EXPIRED certificate for ${HOST}. Its validity window
+# (${NOT_BEFORE} .. ${NOT_AFTER}) is in the past, so the extension server drops
+# the listener that references it while sibling listeners keep serving.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${SECRET_NAME}
+  namespace: ${SECRET_NS}
+type: kubernetes.io/tls
+data:
+  tls.crt: ${CRT_B64}
+  tls.key: ${KEY_B64}
+EOF
+
+echo "wrote ${SCRIPT_DIR}/expired-cert-secret.yaml"
diff --git a/test/e2e-edge/_fixtures/connector-tunnel/Dockerfile b/test/e2e-edge/_fixtures/connector-tunnel/Dockerfile
new file mode 100644
index 00000000..24bf6f6a
--- /dev/null
+++ b/test/e2e-edge/_fixtures/connector-tunnel/Dockerfile
@@ -0,0 +1,13 @@
+# CONNECT-proxy stand-in for the connector tunnel.
+# Single static binary, no dependencies beyond the standard library.
+FROM golang:1.23-alpine AS build
+WORKDIR /src
+COPY go.mod .
+COPY main.go .
+# Standard library only; go.mod just gives the build a module context.
+RUN CGO_ENABLED=0 go build -o /connect-proxy .
+
+FROM gcr.io/distroless/static:nonroot
+COPY --from=build /connect-proxy /connect-proxy
+USER nonroot:nonroot
+ENTRYPOINT ["/connect-proxy"]
diff --git a/test/e2e-edge/_fixtures/connector-tunnel/go.mod b/test/e2e-edge/_fixtures/connector-tunnel/go.mod
new file mode 100644
index 00000000..1da9bd86
--- /dev/null
+++ b/test/e2e-edge/_fixtures/connector-tunnel/go.mod
@@ -0,0 +1,3 @@
+module connect-proxy
+
+go 1.23
diff --git a/test/e2e-edge/_fixtures/connector-tunnel/main.go b/test/e2e-edge/_fixtures/connector-tunnel/main.go
new file mode 100644
index 00000000..e5265582
--- /dev/null
+++ b/test/e2e-edge/_fixtures/connector-tunnel/main.go
@@ -0,0 +1,94 @@
+// connect-proxy is a stand-in for the real connector tunnel. It exercises the
+// proxy-side CONNECT wiring and the 503<->200 liveness swap, but not real tunnel
+// establishment or NAT traversal.
+//
+// When a connector is online, the extension server points its backend at a path
+// that issues an HTTP CONNECT toward the connector's target, which in the test
+// is this pod's Service. On a CONNECT, this proxy dials the configured upstream
+// (the echo backend) and blindly splices bytes both ways — a minimal forward
+// proxy.
+//
+// Liveness is driven entirely by the connector's annotation on the control plane
+// (see _steps/flip-connector-liveness.yaml); this proxy is always up. It exists
+// so an online request can only succeed via the tunnel, never via a direct
+// fallback route — which is what makes the 503->200 transition meaningful.
+package main
+
+import (
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"time"
+)
+
+func main() {
+	listen := envOr("LISTEN_ADDR", ":8080")
+	// Where CONNECT requests are forwarded. Default to the echo backend Service.
+	// The proxy ignores the CONNECT target host and always dials this upstream,
+	// so the test controls the destination via UPSTREAM_ADDR rather than the
+	// host the proxy sends.
+	upstream := envOr("UPSTREAM_ADDR", "echo-backend.default.svc.cluster.local:8080")
+
+	srv := &http.Server{
+		Addr:        listen,
+		ReadTimeout: 0, // tunnels are long-lived; no read deadline on the hijacked conn
+		Handler:     &proxy{upstream: upstream},
+	}
+	log.Printf("connect-proxy listening on %s, forwarding CONNECT -> %s", listen, upstream)
+	if err := srv.ListenAndServe(); err != nil {
+		log.Fatalf("server exited: %v", err)
+	}
+}
+
+type proxy struct {
+	upstream string
+}
+
+func (p *proxy) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodConnect {
+		// A plain GET is handy as a liveness/readiness probe.
+		w.WriteHeader(http.StatusOK)
+		_, _ = io.WriteString(w, "connect-proxy ready\n")
+		return
+	}
+
+	dst, err := net.DialTimeout("tcp", p.upstream, 10*time.Second)
+	if err != nil {
+		log.Printf("CONNECT %s: dial upstream %s failed: %v", r.Host, p.upstream, err)
+		http.Error(w, "upstream unavailable", http.StatusBadGateway)
+		return
+	}
+	defer dst.Close()
+
+	hj, ok := w.(http.Hijacker)
+	if !ok {
+		http.Error(w, "hijacking unsupported", http.StatusInternalServerError)
+		return
+	}
+	client, _, err := hj.Hijack()
+	if err != nil {
+		log.Printf("CONNECT %s: hijack failed: %v", r.Host, err)
+		return
+	}
+	defer client.Close()
+
+	// Tell the client the tunnel is established, then splice bytes both ways.
+	if _, err := client.Write([]byte("HTTP/1.1 200 Connection Established\r\n\r\n")); err != nil {
+		log.Printf("CONNECT %s: write 200 failed: %v", r.Host, err)
+		return
+	}
+
+	done := make(chan struct{}, 2)
+	go func() { _, _ = io.Copy(dst, client); done <- struct{}{} }()
+	go func() { _, _ = io.Copy(client, dst); done <- struct{}{} }()
+	<-done
+}
+
+func envOr(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}
diff --git a/test/e2e-edge/_fixtures/connector-tunnel/manifest.yaml b/test/e2e-edge/_fixtures/connector-tunnel/manifest.yaml
new file mode 100644
index 00000000..d6595904
--- /dev/null
+++ b/test/e2e-edge/_fixtures/connector-tunnel/manifest.yaml
@@ -0,0 +1,66 @@
+# Connector tunnel stand-in deployment.
+#
+# The image is built from this directory's Dockerfile and loaded into the
+# downstream cluster, e.g.:
+#   docker build -t connect-proxy:e2e test/e2e/_fixtures/connector-tunnel
+#   kind load docker-image connect-proxy:e2e --name <downstream-cluster>
+#
+# When a connector is online, the extension server points it at the connector's
+# target. Point that target at this Service so an online request can only succeed
+# through the tunnel — there is no direct fallback route to the echo backend.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: connect-proxy
+  namespace: default
+  labels:
+    purpose: connect-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      purpose: connect-proxy
+  template:
+    metadata:
+      labels:
+        purpose: connect-proxy
+    spec:
+      containers:
+        - name: connect-proxy
+          image: connect-proxy:e2e
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: LISTEN_ADDR
+              value: ":8080"
+            # Forward CONNECT to the echo backend Service.
+            - name: UPSTREAM_ADDR
+              value: "echo-backend.default.svc.cluster.local:8080"
+          ports:
+            - containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8080
+            initialDelaySeconds: 1
+            periodSeconds: 2
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+      terminationGracePeriodSeconds: 0
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: connect-proxy
+  namespace: default
+spec:
+  ports:
+    - name: connect
+      port: 8080
+      targetPort: 8080
+  selector:
+    purpose: connect-proxy
diff --git a/test/e2e-edge/_fixtures/echo-backend.yaml b/test/e2e-edge/_fixtures/echo-backend.yaml
new file mode 100644
index 00000000..8806317d
--- /dev/null
+++ b/test/e2e-edge/_fixtures/echo-backend.yaml
@@ -0,0 +1,46 @@
+# Echo / HTTP backend fixture.
+#
+# go-httpbin gives deterministic endpoints the suite leans on:
+#   /status/<code>  -> returns that status (drive 200 and 5xx)
+#   /get            -> echoes the request (drive WAF benign/malicious probes)
+# Plain HTTP only: the edge proxy terminates TLS per listener and forwards
+# plaintext to this backend.
+#
+# Applied rather than freshly created so scenarios that share the downstream
+# cluster coexist regardless of run order.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: echo-backend
+  namespace: default
+  labels:
+    purpose: echo-backend
+spec:
+  containers:
+    - name: backend
+      image: ghcr.io/mccutchen/go-httpbin:2.18.1
+      command: ["/bin/go-httpbin"]
+      args: ["-host", "0.0.0.0", "-port", "8080"]
+      ports:
+        - containerPort: 8080
+      resources:
+        requests:
+          cpu: 50m
+          memory: 64Mi
+        limits:
+          cpu: 100m
+          memory: 128Mi
+  terminationGracePeriodSeconds: 0
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: echo-backend
+  namespace: default
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+  selector:
+    purpose: echo-backend
diff --git a/test/e2e-edge/_fixtures/waf-corpus.txt b/test/e2e-edge/_fixtures/waf-corpus.txt
new file mode 100644
index 00000000..c9621630
--- /dev/null
+++ b/test/e2e-edge/_fixtures/waf-corpus.txt
@@ -0,0 +1,30 @@
+# WAF request corpus.
+#
+# Format (tab- or space-separated; lines starting with # are comments):
+#   <verdict>  <request-path>  <label>
+# where <verdict> is the expected HTTP status when the firewall is enforcing:
+#   200  -> benign, must pass
+#   403  -> malicious, must be blocked
+#
+# Assert on the 403 outcome, never on a specific firewall rule id, since rule ids
+# shift between rule-set versions. Each malicious payload must actually return
+# 403 against the pinned firewall image; drop any that does not rather than
+# weakening the assertion.
+#
+# Paths target go-httpbin's /get so the query string carries the payload and the
+# request is otherwise a normal, routable GET.
+
+# --- benign: must return 200 ---
+200  /get                                              benign-plain
+200  /status/200                                       benign-status
+200  /get?q=hello&page=2                               benign-querystring
+
+# --- SQL injection: must return 403 ---
+403  /get?id=1%27%20OR%20%271%27%3D%271                sqli-tautology
+403  /get?q=UNION%20SELECT%20username%2Cpassword%20FROM%20users  sqli-union
+
+# --- path traversal: must return 403 ---
+403  /get?file=..%2F..%2F..%2Fetc%2Fpasswd             traversal-etc-passwd
+
+# --- cross-site scripting: must return 403 ---
+403  /get?x=%3Cscript%3Ealert(1)%3C%2Fscript%3E        xss-script-tag
diff --git a/test/e2e-edge/_steps/assert-config-dump.yaml b/test/e2e-edge/_steps/assert-config-dump.yaml
new file mode 100644
index 00000000..3e444039
--- /dev/null
+++ b/test/e2e-edge/_steps/assert-config-dump.yaml
@@ -0,0 +1,156 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/step-template-chainsaw-v1alpha1.json
+#
+# Reusable step that asserts the proxy's live configuration matches what the
+# extension server reports it programmed — the same routes, listeners, and
+# clusters, by both count and key, with no rejected configuration update.
+#
+# It runs cmd/parity-check, which reads the extension server's expected set,
+# fetches the proxy's live configuration, then compares and classifies any
+# difference, exiting non-zero on failure.
+#
+# The step retries until the live configuration converges to the expected set or
+# the attempt budget runs out, so it is deterministic rather than a fixed sleep.
+#
+# Use it from a scenario step:
+#
+#   - name: WAF config landed at the edge
+#     use:
+#       template: ../_steps/assert-config-dump.yaml
+#       with:
+#         bindings:
+#           - { name: envoyPodSelector,   value: "gateway.envoyproxy.io/owning-gatewayclass=my-class" }
+#           - { name: extServerSelector,  value: "app.kubernetes.io/component=envoy-gateway-extension-server" }
+#           - { name: extServerNamespace, value: network-services-operator-system }
+#
+# Required bindings:
+#   envoyPodSelector  — label selector for the edge proxy pod. This env runs one
+#     shared proxy per gateway class, so select by gateway class, not by gateway
+#     name (which matches no pod here). Any one shared-proxy pod carries the full
+#     merged configuration, so the step takes the first.
+#   extServerSelector — label selector resolving ALL extension-server replicas.
+#     The env runs two replicas, but only the one the gateway is connected to does
+#     the work; parity-check queries every matched pod and uses the authoritative
+#     one. Do NOT pass a single pod name here.
+#   extServerNamespace — namespace of the extension-server pods.
+# Optional (defaulted below): envoyNamespace, envoyContainer, corazaFilter,
+#   attempts, sleepSeconds, dataplaneCluster, expectMinBuildID.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: StepTemplate
+metadata:
+  name: assert-config-dump
+spec:
+  bindings:
+    - name: envoyNamespace
+      value: envoy-gateway-system
+    - name: envoyContainer
+      value: envoy
+    - name: corazaFilter
+      value: coraza-waf
+    - name: attempts
+      value: "24"
+    - name: sleepSeconds
+      value: "5"
+    # The edge cluster where the proxy and the extension server live.
+    - name: dataplaneCluster
+      value: nso-downstream
+    # When greater than zero, require the extension server's build ID to be at
+    # least this value. Capture the build ID before a change, then set this to
+    # one past it afterward to prove the configuration was actually rebuilt.
+    - name: expectMinBuildID
+      value: "0"
+  try:
+    - description: Build parity-check, then assert the live config_dump matches the ext-server programmed-set.
+      script:
+        # Owns its own retry timing, so allow attempts*sleepSeconds plus build and
+        # fetch time. The chainsaw default is far too short.
+        timeout: 420s
+        cluster: ($dataplaneCluster)
+        env:
+          - name: ENVOY_POD_SELECTOR
+            value: ($envoyPodSelector)
+          - name: ENVOY_NS
+            value: ($envoyNamespace)
+          - name: ENVOY_CONTAINER
+            value: ($envoyContainer)
+          - name: EXT_SELECTOR
+            value: ($extServerSelector)
+          - name: EXT_NS
+            value: ($extServerNamespace)
+          - name: CORAZA_FILTER
+            value: ($corazaFilter)
+          - name: ATTEMPTS
+            value: ($attempts)
+          - name: SLEEP_SECONDS
+            value: ($sleepSeconds)
+          - name: EXPECT_MIN_BUILD_ID
+            value: ($expectMinBuildID)
+        content: |
+          set -eu
+          # Build the parity-check binary. chainsaw runs script steps from the
+          # test directory, not the repo root, so a relative path would not
+          # resolve; find the repo root and build from there. A prebuilt binary
+          # can be supplied via PARITY_CHECK_BIN to skip the build.
+          BIN="${PARITY_CHECK_BIN:-}"
+          if [ -z "${BIN}" ]; then
+            ROOT="$(git rev-parse --show-toplevel)"
+            BIN="${ROOT}/bin/parity-check"
+            go build -o "${BIN}" "${ROOT}/cmd/parity-check"
+          fi
+
+          # Retry until the live configuration converges to the expected set.
+          # parity-check exits 1 on a parity failure and 2 on a tool error; only
+          # retry on parity failure.
+          #
+          # The edge proxy pod is re-resolved each attempt: the shared proxy pod
+          # is recreated whenever a gateway is added or removed, so it can be
+          # terminating or absent exactly when this step runs (e.g. right after a
+          # second gateway is added). An empty result simply retries rather than
+          # failing.
+          ok=""
+          for i in $(seq 1 "${ATTEMPTS}"); do
+            echo "--- parity attempt ${i}/${ATTEMPTS} ---"
+            # Pick a shared-proxy pod that is Ready and not terminating. Ready and
+            # no deletion timestamp is the precise "serving" test; a terminating
+            # pod can still report itself running, so filtering on running alone
+            # would not exclude it. Absence of a match just retries.
+            ENVOY_POD="$(kubectl -n "${ENVOY_NS}" get pods \
+              -l "${ENVOY_POD_SELECTOR}" \
+              -o go-template='{{range $p := .items}}{{if not $p.metadata.deletionTimestamp}}{{range $p.status.conditions}}{{if (and (eq .type "Ready") (eq .status "True"))}}{{$p.metadata.name}}{{"\n"}}{{end}}{{end}}{{end}}{{end}}' \
+              2>/dev/null | head -n1 || true)"
+            if [ -z "${ENVOY_POD}" ]; then
+              echo "  no Ready Envoy proxy pod yet (selector ${ENVOY_POD_SELECTOR} in ${ENVOY_NS}); merged proxy may be mid-roll, retrying"
+              sleep "${SLEEP_SECONDS}"
+              continue
+            fi
+            echo "  edge Envoy pod: ${ENVOY_POD}"
+            # Capture the parity-check output so the failure reason and the
+            # offending keys land in the chainsaw log on failure instead of being
+            # swallowed. The last attempt's report is echoed if we never pass.
+            set +e
+            LAST_REPORT="$("${BIN}" \
+              --coraza-filter "${CORAZA_FILTER}" \
+              --expect-min-build-id "${EXPECT_MIN_BUILD_ID}" \
+              --timeout 120s \
+              --admin-exec-pod "${ENVOY_POD}" \
+              --admin-exec-namespace "${ENVOY_NS}" \
+              --admin-exec-container "${ENVOY_CONTAINER}" \
+              --ext-exec-selector "${EXT_SELECTOR}" \
+              --ext-exec-namespace "${EXT_NS}" 2>&1)"
+            rc=$?
+            set -e
+            printf '%s\n' "${LAST_REPORT}"
+            if [ "${rc}" = "0" ]; then
+              ok="yes"; break
+            fi
+            if [ "${rc}" = "2" ]; then
+              echo "  tool error (rc=2); retrying"
+            fi
+            sleep "${SLEEP_SECONDS}"
+          done
+          if [ -z "${ok}" ]; then
+            echo "ERROR: config-dump parity did not converge after ${ATTEMPTS} attempts"
+            echo "--- last parity-check report (classification + offending keys) ---"
+            printf '%s\n' "${LAST_REPORT}"
+            exit 1
+          fi
+          echo "OK: config-dump parity gate passed"
diff --git a/test/e2e-edge/_steps/assert-http-response.yaml b/test/e2e-edge/_steps/assert-http-response.yaml
new file mode 100644
index 00000000..03df79c3
--- /dev/null
+++ b/test/e2e-edge/_steps/assert-http-response.yaml
@@ -0,0 +1,152 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/step-template-chainsaw-v1alpha1.json
+#
+# Reusable "assert real HTTP response" step. Drives a real request from the
+# long-lived `conntest` pod and retries until the response matches, or fails.
+# Scenarios assert observed proxy behaviour through this helper rather than
+# Kubernetes status, so it is the most-reused step in the suite.
+#
+# Use it from a scenario step:
+#
+#   - name: good hostname serves 200
+#     use:
+#       template: ../_steps/assert-http-response.yaml
+#       with:
+#         bindings:
+#           - { name: host,        value: good.e2e.env.datum.net }
+#           - { name: path,        value: /status/200 }
+#           - { name: resolveIP,   value: ($gatewayIP) }
+#           - { name: scheme,      value: https }
+#           - { name: expectCode,  value: "200" }
+#
+# Required bindings: host, path, resolveIP, scheme(http|https), expectCode.
+# Optional (defaulted below): port, expectBodySubstring, attempts, sleepSeconds,
+# maxTime, conntestNamespace, conntestPod, dataplaneCluster.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: StepTemplate
+metadata:
+  name: assert-http-response
+spec:
+  # Defaults so callers only pass what varies. A caller binding for the same name
+  # overrides the default.
+  bindings:
+    - name: port
+      value: "443"
+    - name: expectBodySubstring
+      value: ""
+    - name: attempts
+      value: "24"
+    - name: sleepSeconds
+      value: "5"
+    - name: maxTime
+      value: "10"
+    - name: conntestNamespace
+      value: default
+    - name: conntestPod
+      value: conntest
+    # The edge cluster where the conntest pod and the edge proxy service live.
+    - name: dataplaneCluster
+      value: nso-downstream
+    # The edge IP is resolved inside this step, because a value resolved in a
+    # prior step is not visible here. By default we look up the edge proxy
+    # service's cluster IP by its gateway-class label; a caller may pass an
+    # explicit resolveIP to skip the lookup.
+    - name: resolveIP
+      value: ""
+    - name: envoyPodSelector
+      value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e
+    - name: envoyNamespace
+      value: datum-downstream-gateway
+  try:
+    - description: Drive the request and retry until it matches the expected outcome.
+      script:
+        # The retry loop owns its own timing, so allow enough wall clock for
+        # attempts*sleepSeconds plus per-request maxTime. The chainsaw default is
+        # far too short.
+        timeout: 360s
+        cluster: ($dataplaneCluster)
+        env:
+          - name: HOST
+            value: ($host)
+          - name: REQ_PATH
+            value: ($path)
+          - name: RESOLVE_IP
+            value: ($resolveIP)
+          - name: ENVOY_SELECTOR
+            value: ($envoyPodSelector)
+          - name: ENVOY_NS
+            value: ($envoyNamespace)
+          - name: SCHEME
+            value: ($scheme)
+          - name: PORT
+            value: ($port)
+          - name: EXPECT_CODE
+            value: ($expectCode)
+          - name: EXPECT_BODY
+            value: ($expectBodySubstring)
+          - name: ATTEMPTS
+            value: ($attempts)
+          - name: SLEEP_SECONDS
+            value: ($sleepSeconds)
+          - name: MAX_TIME
+            value: ($maxTime)
+          - name: CONNTEST_NS
+            value: ($conntestNamespace)
+          - name: CONNTEST_POD
+            value: ($conntestPod)
+        content: |
+          set -eu
+          # The edge proxy is reached by its in-cluster service IP; --resolve maps
+          # the customer hostname to that IP so hostname routing works exactly as
+          # it would at the edge. The body is captured so we can assert on it: a
+          # right status code with the wrong body (e.g. a generic 503 instead of
+          # the connector "Tunnel not online") is a different bug and must fail.
+          #
+          # If the caller passed an explicit RESOLVE_IP, use it; otherwise look up
+          # the edge proxy service IP by its gateway-class label. That service is
+          # created lazily once a gateway attaches, so retry the lookup briefly.
+          RESOLVE_IP="${RESOLVE_IP:-}"
+          if [ -z "${RESOLVE_IP}" ]; then
+            for j in $(seq 1 30); do
+              RESOLVE_IP=$(kubectl get svc -n "${ENVOY_NS}" -l "${ENVOY_SELECTOR}" \
+                -o jsonpath='{.items[0].spec.clusterIP}' 2>/dev/null || true)
+              [ -n "${RESOLVE_IP}" ] && [ "${RESOLVE_IP}" != "None" ] && break
+              echo "waiting for edge Envoy service (${ENVOY_SELECTOR} in ${ENVOY_NS})... ${j}"
+              sleep 5
+            done
+            if [ -z "${RESOLVE_IP}" ]; then
+              echo "ERROR: could not resolve edge Envoy service IP for ${ENVOY_SELECTOR} in ${ENVOY_NS}"
+              exit 1
+            fi
+          fi
+          echo "edge IP: ${RESOLVE_IP}"
+          ok=""
+          last_code=""
+          for i in $(seq 1 "${ATTEMPTS}"); do
+            code=$(kubectl -n "${CONNTEST_NS}" exec "${CONNTEST_POD}" -- \
+              curl -ksS -o /tmp/body -w '%{http_code}' --max-time "${MAX_TIME}" \
+              --resolve "${HOST}:${PORT}:${RESOLVE_IP}" \
+              "${SCHEME}://${HOST}${REQ_PATH}" 2>/dev/null || true)
+            last_code="${code}"
+            echo "attempt ${i}: ${SCHEME}://${HOST}${REQ_PATH} -> ${code}"
+            if [ "${code}" = "${EXPECT_CODE}" ]; then
+              if [ -z "${EXPECT_BODY}" ]; then
+                ok="yes"; break
+              fi
+              if kubectl -n "${CONNTEST_NS}" exec "${CONNTEST_POD}" -- \
+                   grep -qF -- "${EXPECT_BODY}" /tmp/body 2>/dev/null; then
+                ok="yes"; break
+              fi
+              echo "  status matched but body missing substring: ${EXPECT_BODY}"
+            fi
+            sleep "${SLEEP_SECONDS}"
+          done
+          if [ -z "${ok}" ]; then
+            echo "ERROR: ${HOST}${REQ_PATH} expected ${EXPECT_CODE}" \
+                 "${EXPECT_BODY:+(body contains '${EXPECT_BODY}')}," \
+                 "last status ${last_code}"
+            echo "--- last response body ---"
+            kubectl -n "${CONNTEST_NS}" exec "${CONNTEST_POD}" -- \
+              sh -c 'cat /tmp/body 2>/dev/null | head -c 2000' || true
+            exit 1
+          fi
+          echo "OK: ${HOST}${REQ_PATH} -> ${EXPECT_CODE}${EXPECT_BODY:+ (body matched)}"
diff --git a/test/e2e-edge/_steps/capture-build-id.yaml b/test/e2e-edge/_steps/capture-build-id.yaml
new file mode 100644
index 00000000..f38f9d4a
--- /dev/null
+++ b/test/e2e-edge/_steps/capture-build-id.yaml
@@ -0,0 +1,115 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/step-template-chainsaw-v1alpha1.json
+#
+# Reusable step that captures the extension server's current build ID and emits
+# it as an output binding.
+#
+# It is the "before" half of proving a configuration rebuild actually happened:
+# capture the build ID, perform a change (e.g. flip connector liveness), then
+# call assert-config-dump.yaml with expectMinBuildID set to one past it — the
+# parity check then fails unless the configuration was genuinely rebuilt. This is
+# something a status or traffic check cannot show: it proves a new build ran, not
+# merely that the end state looks right.
+#
+# The build ID increments once per build and starts at 1, so a "before" of 0
+# means no build had run yet.
+#
+# The env runs two extension-server replicas, but only the one the gateway is
+# connected to does the work and carries the real build ID; the idle replica
+# sits at 0. This step resolves all replicas and takes the highest build ID — the
+# authoritative one. assert-config-dump.yaml resolves the same way, so capture
+# and assert agree on the active replica.
+#
+# Use it from a scenario:
+#
+#   # 1. capture the BuildID before the change
+#   - name: capture build id before liveness flip
+#     use:
+#       template: ../_steps/capture-build-id.yaml
+#       with:
+#         bindings:
+#           - { name: extServerSelector,  value: "app.kubernetes.io/component=envoy-gateway-extension-server" }
+#           - { name: extServerNamespace, value: network-services-operator-system }
+#     # this step emits output bindings `buildID` and `minNextBuildID` (strings)
+#
+#   # 2. ... perform the change (flip-connector-liveness.yaml etc.) ...
+#
+#   # 3. assert the post-change build advanced AND the config is correct.
+#   #    Pass the captured `minNextBuildID` straight into expectMinBuildID:
+#   - name: re-translation fired and config landed
+#     use:
+#       template: ../_steps/assert-config-dump.yaml
+#       with:
+#         bindings:
+#           - { name: envoyPodSelector,   value: "gateway.envoyproxy.io/owning-gatewayclass=($downstreamGatewayClass)" }
+#           - { name: extServerSelector,  value: "app.kubernetes.io/component=envoy-gateway-extension-server" }
+#           - { name: extServerNamespace, value: network-services-operator-system }
+#           # require a build strictly newer than the captured one:
+#           - { name: expectMinBuildID,   value: ($minNextBuildID) }
+#
+# Required bindings: extServerSelector (resolves ALL replicas), extServerNamespace.
+# Optional (defaulted below): dataplaneCluster.
+# Emits output bindings:
+#   buildID         — highest build ID across replicas at capture time (string;
+#                     "0" if no build has run anywhere).
+#   minNextBuildID  — buildID+1 (string); feed directly into the post-change
+#                     assert-config-dump call's expectMinBuildID. Incremented
+#                     in-script so callers need no arithmetic of their own.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: StepTemplate
+metadata:
+  name: capture-build-id
+spec:
+  bindings:
+    - name: dataplaneCluster
+      value: nso-downstream
+  try:
+    - description: Resolve the authoritative ext-server replica's BuildID via parity-check and emit it as an output binding.
+      script:
+        timeout: 120s
+        cluster: ($dataplaneCluster)
+        env:
+          - name: EXT_SELECTOR
+            value: ($extServerSelector)
+          - name: EXT_NS
+            value: ($extServerNamespace)
+        content: |
+          set -eu
+          # Delegate to the parity-check binary's --print-build-id mode, which
+          # resolves all extension-server replicas and prints the highest build
+          # ID. Reusing the binary keeps this identical to how
+          # assert-config-dump.yaml reads it.
+          #
+          # chainsaw runs script steps from the test directory, not the repo root,
+          # so find the root and build from there. PARITY_CHECK_BIN skips the
+          # build if a prebuilt binary is supplied.
+          BIN="${PARITY_CHECK_BIN:-}"
+          if [ -z "${BIN}" ]; then
+            ROOT="$(git rev-parse --show-toplevel)"
+            BIN="${ROOT}/bin/parity-check"
+            go build -o "${BIN}" "${ROOT}/cmd/parity-check"
+          fi
+
+          BUILD_ID="$("${BIN}" \
+            --print-build-id \
+            --ext-exec-selector "${EXT_SELECTOR}" \
+            --ext-exec-namespace "${EXT_NS}" \
+            --timeout 90s)"
+          # Strip any stray whitespace; parity-check prints just the integer.
+          BUILD_ID="$(printf '%s' "${BUILD_ID}" | tr -dc '0-9')"
+          if [ -z "${BUILD_ID}" ]; then
+            echo "ERROR: parity-check --print-build-id returned no BuildID" >&2
+            exit 1
+          fi
+          echo "authoritative ext-server BuildID=${BUILD_ID}" >&2
+          # Increment here so callers need no arithmetic of their own. Emit both
+          # values as a small JSON object; the outputs below parse each field.
+          NEXT=$((BUILD_ID + 1))
+          printf '{"buildID":%s,"minNextBuildID":%s}' "${BUILD_ID}" "${NEXT}"
+        outputs:
+          # Bindings consumed by a later assert-config-dump call. Values are
+          # stringified so they drop straight into the string-typed
+          # expectMinBuildID binding.
+          - name: buildID
+            value: (to_string(json_parse($stdout).buildID))
+          - name: minNextBuildID
+            value: (to_string(json_parse($stdout).minNextBuildID))
diff --git a/test/e2e-edge/_steps/flip-connector-liveness.yaml b/test/e2e-edge/_steps/flip-connector-liveness.yaml
new file mode 100644
index 00000000..7d9dce66
--- /dev/null
+++ b/test/e2e-edge/_steps/flip-connector-liveness.yaml
@@ -0,0 +1,78 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/step-template-chainsaw-v1alpha1.json
+#
+# Reusable step that flips a connector between online and offline by patching its
+# `networking.datumapis.com/upstream-status` annotation. This mirrors production:
+# the federation layer propagates annotations but not status to the edge, so the
+# edge reads connector liveness from this annotation rather than from live
+# status.
+#
+# `state: online` writes a Ready=True status whose connection details carry the
+# tunnel fixture's node id; `state: offline` writes Ready=False with none. The
+# extension server reads liveness from this annotation, so flipping it is what
+# drives the 503<->200 swap at the edge.
+#
+# Use it from a scenario step:
+#
+#   - name: bring the connector online
+#     use:
+#       template: ../_steps/flip-connector-liveness.yaml
+#       with:
+#         bindings:
+#           - { name: state,         value: online }
+#           - { name: connectorName, value: test-connector }
+#           - { name: nodeID,        value: ($tunnelNodeID) }
+#
+# Required bindings: state(online|offline), connectorName. nodeID required when
+# state=online. Optional (defaulted): connectorNamespace, upstreamCluster.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: StepTemplate
+metadata:
+  name: flip-connector-liveness
+spec:
+  bindings:
+    - name: connectorNamespace
+      value: ($namespace)
+    - name: nodeID
+      value: ""
+    # The connector lives on the upstream cluster; its annotation is propagated
+    # to the edge by the federation layer.
+    - name: upstreamCluster
+      value: nso-upstream
+  try:
+    - description: Patch the connector's upstream-status annotation to the requested liveness.
+      script:
+        cluster: ($upstreamCluster)
+        env:
+          - name: STATE
+            value: ($state)
+          - name: CONNECTOR
+            value: ($connectorName)
+          - name: CONNECTOR_NS
+            value: ($connectorNamespace)
+          - name: NODE_ID
+            value: ($nodeID)
+        content: |
+          set -eu
+          # The annotation holds the connector's status as JSON. The transition
+          # time is fixed and irrelevant to liveness — only the Ready condition and
+          # connection details matter.
+          #
+          # The annotation value must itself be a JSON string, so we build the
+          # status and escape its quotes by hand. Doing the escaping inline keeps
+          # the runner free of extra tooling.
+          if [ "${STATE}" = "online" ]; then
+            if [ -z "${NODE_ID}" ]; then
+              echo "ERROR: state=online requires nodeID (the tunnel fixture node id)"; exit 1
+            fi
+            STATUS='{"conditions":[{"type":"Ready","status":"True","reason":"ConnectorReady","lastTransitionTime":"2026-06-23T00:00:00Z"}],"connectionDetails":{"type":"PublicKey","publicKey":{"id":"'"${NODE_ID}"'"}}}'
+          elif [ "${STATE}" = "offline" ]; then
+            STATUS='{"conditions":[{"type":"Ready","status":"False","reason":"ConnectorNotReady","lastTransitionTime":"2026-06-23T00:00:00Z"}]}'
+          else
+            echo "ERROR: state must be online or offline, got: ${STATE}"; exit 1
+          fi
+          # Escape the status JSON so it can be embedded as a string value.
+          ESCAPED=$(printf '%s' "${STATUS}" | sed 's/\\/\\\\/g; s/"/\\"/g')
+          PATCH=$(printf '{"metadata":{"annotations":{"networking.datumapis.com/upstream-status":"%s"}}}' "${ESCAPED}")
+          echo "patching connector ${CONNECTOR} -> ${STATE}"
+          kubectl -n "${CONNECTOR_NS}" patch connector "${CONNECTOR}" \
+            --type=merge -p "${PATCH}"
diff --git a/test/e2e-edge/_steps/wait-config-settle.yaml b/test/e2e-edge/_steps/wait-config-settle.yaml
new file mode 100644
index 00000000..9971369b
--- /dev/null
+++ b/test/e2e-edge/_steps/wait-config-settle.yaml
@@ -0,0 +1,85 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/step-template-chainsaw-v1alpha1.json
+#
+# Wait for the edge configuration to settle before a parity assertion.
+#
+# The parity gate compares what the extension server reports it programmed
+# against the proxy's live configuration. Both move while the configuration is
+# being rebuilt — e.g. right after a scenario adds a second gateway, which rolls
+# the shared proxy and triggers fresh builds — and the live configuration lags
+# behind. This step polls the extension server's build ID until it stops changing
+# for a stable window, then returns. Run it immediately before a `use:` of
+# assert-config-dump.
+#
+# The gate has its own retry loop, but on CI runs where one test's teardown
+# overlaps a fresh run this explicit settle is cheap insurance.
+#
+# Required bindings: extServerSelector, extServerNamespace.
+# Optional (defaulted below): dataplaneCluster, stableReads, intervalSeconds,
+#   maxAttempts.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: StepTemplate
+metadata:
+  name: wait-config-settle
+spec:
+  bindings:
+    - name: dataplaneCluster
+      value: nso-downstream
+    # Require this many consecutive identical BuildID reads to call it settled.
+    - name: stableReads
+      value: "3"
+    - name: intervalSeconds
+      value: "5"
+    - name: maxAttempts
+      value: "36"
+  try:
+    - description: Poll the ext-server programmed-set BuildID until it stops changing.
+      script:
+        timeout: 240s
+        cluster: ($dataplaneCluster)
+        env:
+          - name: EXT_SELECTOR
+            value: ($extServerSelector)
+          - name: EXT_NS
+            value: ($extServerNamespace)
+          - name: STABLE_READS
+            value: ($stableReads)
+          - name: INTERVAL
+            value: ($intervalSeconds)
+          - name: MAX_ATTEMPTS
+            value: ($maxAttempts)
+        content: |
+          set -eu
+          # Build parity-check once; its --print-build-id mode resolves the
+          # authoritative replica and reads its build ID.
+          ROOT="$(git rev-parse --show-toplevel)"
+          BIN="${ROOT}/bin/parity-check"
+          [ -x "${BIN}" ] || go build -o "${BIN}" "${ROOT}/cmd/parity-check"
+
+          read_build() {
+            "${BIN}" --print-build-id \
+              --ext-exec-selector "${EXT_SELECTOR}" \
+              --ext-exec-namespace "${EXT_NS}" 2>/dev/null \
+              | tr -dc '0-9'
+          }
+
+          last=""
+          stable=0
+          for i in $(seq 1 "${MAX_ATTEMPTS}"); do
+            cur="$(read_build || true)"
+            [ -z "${cur}" ] && cur="?"
+            echo "attempt ${i}: BuildID=${cur} (stable streak ${stable}/${STABLE_READS})"
+            if [ "${cur}" != "?" ] && [ "${cur}" = "${last}" ]; then
+              stable=$((stable + 1))
+              if [ "${stable}" -ge "${STABLE_READS}" ]; then
+                echo "OK: config settled at BuildID=${cur} (stable for ${STABLE_READS} reads)"
+                exit 0
+              fi
+            else
+              stable=0
+            fi
+            last="${cur}"
+            sleep "${INTERVAL}"
+          done
+          # Not fatal: the parity gate has its own retry. A non-settled exit just
+          # means the configuration was still changing; let the gate try anyway.
+          echo "WARN: BuildID did not fully settle after ${MAX_ATTEMPTS} reads; proceeding to parity"
diff --git a/test/e2e-edge/atomic-reject-isolation/chainsaw-test.yaml b/test/e2e-edge/atomic-reject-isolation/chainsaw-test.yaml
new file mode 100644
index 00000000..cd5a0159
--- /dev/null
+++ b/test/e2e-edge/atomic-reject-isolation/chainsaw-test.yaml
@@ -0,0 +1,672 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+#
+# One bad certificate must not break its neighbors.
+#
+# Two sub-tests, both asserting observed data-plane behavior (served responses
+# and the proxy's own counters), never gateway status.
+#
+#   First: a gateway with a valid-certificate listener, an expired-certificate
+#   listener, and a plain HTTP listener. The edge drops the bad listener, the
+#   rest of the config stays accepted, and the siblings keep serving.
+#
+#   Second: a route configuration the edge proxy genuinely rejects. A healthy
+#   sibling keeps serving 200, and nothing falsely reports the gateway as
+#   programmed over a rejected config — asserted against the proxy's
+#   rejected-update counter, not the gateway condition that lied during a live
+#   incident.
+#
+# The expired-certificate sub-test: the operator's upstream certificate check
+# would hold an expired certificate back before it ever reaches the edge, so the
+# drop we want to observe would never run on the normal path. We therefore create
+# the gateway directly on the downstream cluster, bypassing that upstream check,
+# so the expired certificate reaches the edge and the drop genuinely runs. The
+# namespace must carry the gateway-watch label
+# meta.datumapis.com/upstream-cluster-name at creation, because the gateway only
+# watches namespaces that already have the label.
+#
+# Cluster names are inline; downstreamGatewayClass is as in the other tests;
+# adminPort is the proxy's admin endpoint (:19000).
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: atomic-reject-isolation
+spec:
+  concurrent: false
+  bindings:
+    - name: clusterIssuerName
+      value: (join('-', ['e2e', $namespace]))
+    - name: gatewayClassName
+      value: (join('-', ['e2e', $namespace]))
+    - name: downstreamGatewayClass
+      value: datum-downstream-gateway-e2e
+    - name: adminPort
+      value: "19000"
+    # Inputs for the config-presence check, which resolves the extension server
+    # pods by label selector (one per replica).
+    - name: extServerSelector
+      value: app.kubernetes.io/component=envoy-gateway-extension-server
+    - name: extServerNamespace
+      value: network-services-operator-system
+    - name: envoyPodSelector
+      value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e
+    # Namespace holding the data-plane proxy and its admin endpoint.
+    - name: envoyNamespace
+      value: datum-downstream-gateway
+    # Gate the proxy-reject sub-test until its route configuration is confirmed
+    # to actually reach and be rejected by the edge (see header). The
+    # expired-certificate sub-test runs unconditionally.
+    - name: nackTestEnabled
+      value: "false"
+  cluster: nso-upstream
+  steps:
+    - name: Create CA on the downstream cluster
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'issuer']))
+              spec:
+                selfSigned: {}
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              spec:
+                isCA: true
+                commonName: (join('-', [$clusterIssuerName, 'ca']))
+                secretName: ($clusterIssuerName)
+                privateKey:
+                  algorithm: ECDSA
+                  size: 256
+                issuerRef:
+                  name: (join('-', [$clusterIssuerName, 'issuer']))
+                  kind: ClusterIssuer
+                  group: cert-manager.io
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: ($clusterIssuerName)
+              spec:
+                ca:
+                  secretName: ($clusterIssuerName)
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
+    - name: Create the upstream GatewayClass (downstream class/EnvoyProxy are pre-provisioned)
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: ($gatewayClassName)
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+        # The downstream gateway class and its proxy are provisioned once by the
+        # test environment; tests must not recreate them. Only ensure the
+        # hostname-accounting namespace here.
+        - apply:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: datum-downstream-gateway-hostnames
+
+    - name: Create the echo backend
+      try:
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/echo-backend.yaml
+
+    - name: Provision and verify the Domain
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: Domain
+              metadata:
+                name: test-domain
+              spec:
+                domainName: e2e.env.datum.net
+        - description: Stand in for the Domain controller's HTTP/DNS verification.
+          script:
+            content: |
+              kubectl -n $NAMESPACE patch domain test-domain \
+                --subresource=status --type=merge \
+                -p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
+
+    # ---- Expired certificate is isolated ----
+    # The operator's upstream certificate check would hold an expired certificate
+    # back before the edge sees it, so the drop we want to observe would never run
+    # on the normal path. We therefore create the gateway directly on the
+    # downstream cluster: a gateway with a valid-certificate listener, an
+    # expired-certificate listener, and a plain HTTP sibling. The edge drops the
+    # expired listener while the siblings keep serving. The namespace must carry
+    # the gateway-watch label meta.datumapis.com/upstream-cluster-name at creation,
+    # because the gateway only watches namespaces that already have it.
+    - name: D1 - hand-deliver a downstream gateway with good, expired, and HTTP listeners
+      try:
+        - description: The gateway only watches namespaces carrying this label; it must be present at creation.
+          create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: (join('-', ['d1', $namespace]))
+                labels:
+                  meta.datumapis.com/upstream-cluster-name: cluster-single
+        # Valid certificate: a self-signed leaf issued on the downstream cluster.
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Issuer
+              metadata:
+                name: d1-selfsigned
+                namespace: (join('-', ['d1', $namespace]))
+              spec:
+                selfSigned: {}
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: d1-good
+                namespace: (join('-', ['d1', $namespace]))
+              spec:
+                secretName: d1-good-tls
+                commonName: d1-good.e2e.env.datum.net
+                dnsNames: [d1-good.e2e.env.datum.net]
+                issuerRef:
+                  name: d1-selfsigned
+                  kind: Issuer
+        - assert:
+            timeout: 90s
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: d1-good
+                namespace: (join('-', ['d1', $namespace]))
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+        # Expired certificate: a pre-created TLS Secret shipped as a committed
+        # fixture (regenerated by test/e2e-edge/_fixtures/certs/gen-certs.sh), applied
+        # into this sub-test's namespace.
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/certs/expired-cert-secret.yaml
+        # Copy the fixture's secret into this namespace under the name the
+        # listener references (the fixture targets default/expired-leaf-tls).
+        - script:
+            cluster: nso-downstream
+            env:
+              - name: D1_NS
+                value: (join('-', ['d1', $namespace]))
+            content: |
+              set -eu
+              kubectl get secret expired-leaf-tls -n default -o json \
+                | kubectl create -f - --dry-run=client -o json \
+                | sed 's/"namespace": "default"/"namespace": "'"${D1_NS}"'"/; s/"name": "expired-leaf-tls"/"name": "d1-bad-tls"/' \
+                | kubectl -n "${D1_NS}" apply -f -
+        # Echo backend in this namespace (the route targets it by Service name).
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: echo-backend
+                namespace: (join('-', ['d1', $namespace]))
+                labels:
+                  purpose: d1-echo
+              spec:
+                containers:
+                  - name: backend
+                    image: ghcr.io/mccutchen/go-httpbin:2.18.1
+                    command: ["/bin/go-httpbin"]
+                    args: ["-host", "0.0.0.0", "-port", "8080"]
+                terminationGracePeriodSeconds: 0
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Service
+              metadata:
+                name: echo-backend
+                namespace: (join('-', ['d1', $namespace]))
+              spec:
+                ports:
+                  - name: http
+                    port: 8080
+                    targetPort: 8080
+                selector:
+                  purpose: d1-echo
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: d1-gateway
+                namespace: (join('-', ['d1', $namespace]))
+              spec:
+                gatewayClassName: ($downstreamGatewayClass)
+                listeners:
+                  - name: http
+                    protocol: HTTP
+                    port: 80
+                    hostname: d1-good.e2e.env.datum.net
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                  - name: https-good
+                    protocol: HTTPS
+                    port: 443
+                    hostname: d1-good.e2e.env.datum.net
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    tls:
+                      mode: Terminate
+                      certificateRefs:
+                        - kind: Secret
+                          name: d1-good-tls
+                  - name: https-bad
+                    protocol: HTTPS
+                    port: 443
+                    hostname: d1-bad.e2e.env.datum.net
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    tls:
+                      mode: Terminate
+                      certificateRefs:
+                        - kind: Secret
+                          name: d1-bad-tls
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: d1-route
+                namespace: (join('-', ['d1', $namespace]))
+              spec:
+                parentRefs:
+                  - name: d1-gateway
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backendRefs:
+                      - name: echo-backend
+                        port: 8080
+        # The good listeners are programmed; the expired-certificate listener is
+        # not — the edge holds it back. This checks the isolation at the listener
+        # status level; the traffic asserts below prove it at the data plane.
+        - assert:
+            timeout: 120s
+            cluster: nso-downstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: d1-gateway
+                namespace: (join('-', ['d1', $namespace]))
+              status:
+                (listeners[?name == 'https-good'] | [0]):
+                  (conditions[?type == 'Programmed']):
+                    - status: "True"
+                (listeners[?name == 'https-bad'] | [0]):
+                  (conditions[?type == 'Programmed']):
+                    - status: "False"
+      catch:
+        - script:
+            cluster: nso-downstream
+            env:
+              - name: D1_NS
+                value: (join('-', ['d1', $namespace]))
+            content: |
+              kubectl -n "$D1_NS" get gateway,httproute,secret -o yaml
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/component=envoy-gateway-extension-server --tail=80 | grep -i prune || true
+
+    - name: Stand up the long-lived conntest client
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              spec:
+                containers:
+                  - name: curl
+                    image: curlimages/curl:8.11.1
+                    command: ["sleep", "infinity"]
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 64Mi
+                      limits:
+                        cpu: 100m
+                        memory: 128Mi
+                terminationGracePeriodSeconds: 0
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              status:
+                phase: Running
+
+    - name: D1 - the good HTTPS sibling serves 200
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: d1-good.e2e.env.datum.net }
+            - { name: path, value: /status/200 }
+            - { name: scheme, value: https }
+            - { name: expectCode, value: "200" }
+
+    - name: D1 - the plain-HTTP sibling serves 200 (never gated by a cert)
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: d1-good.e2e.env.datum.net }
+            - { name: path, value: /status/200 }
+            - { name: scheme, value: http }
+            - { name: port, value: "80" }
+            - { name: expectCode, value: "200" }
+
+    - name: D1 - the expired-cert hostname is NOT served (prune dropped its chain)
+      description: |
+        The bad hostname must not be served — the edge dropped its listener while
+        the siblings kept serving. A TLS handshake against it fails rather than
+        returning 200. Anything but a non-200 means the expired listener was
+        served and the drop failed.
+      try:
+        - script:
+            timeout: 120s
+            cluster: nso-downstream
+            env:
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              set -eu
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=${OWNING_GC} \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              code=$(kubectl -n default exec conntest -- \
+                curl -ksS -o /dev/null -w '%{http_code}' --max-time 10 \
+                --resolve d1-bad.e2e.env.datum.net:443:"${IP}" \
+                https://d1-bad.e2e.env.datum.net/status/200 2>/dev/null || true)
+              echo "bad hostname -> ${code:-<conn-failed>}"
+              if [ "${code}" = "200" ]; then
+                echo "ERROR: expired-cert hostname was served; the prune did not isolate it"; exit 1
+              fi
+              echo "OK: expired-cert hostname not served (prune isolated it); siblings serve 200"
+
+    # Let the edge config settle after the gateway is provisioned before the
+    # config-presence check compares.
+    - name: D1 - wait for the edge config to settle before the parity gate
+      use:
+        template: ../_steps/wait-config-settle.yaml
+        with:
+          bindings:
+            - { name: extServerSelector, value: app.kubernetes.io/component=envoy-gateway-extension-server }
+            - { name: extServerNamespace, value: network-services-operator-system }
+
+    - name: D1 - config-presence - the snapshot is clean after the prune (parity gate)
+      description: |
+        The edge drops the expired listener and keeps the rest of the config
+        accepted. This asserts the live config matches what the extension server
+        reports it programmed, with no rejection — proving the bad listener was
+        isolated rather than breaking the whole gateway. The traffic asserts above
+        already prove the isolation; this confirms the config is present.
+      use:
+        template: ../_steps/assert-config-dump.yaml
+        with:
+          # Values are inlined, not referenced as ($envoyNamespace) etc.: a
+          # with-binding whose name matches a template default resolves ($name)
+          # against the template default, not this test's value.
+          bindings:
+            - { name: envoyPodSelector, value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e }
+            - { name: envoyNamespace, value: datum-downstream-gateway }
+            - { name: extServerSelector, value: app.kubernetes.io/component=envoy-gateway-extension-server }
+            - { name: extServerNamespace, value: network-services-operator-system }
+            - { name: dataplaneCluster, value: nso-downstream }
+
+    # ---- A rejected route configuration must not break a healthy sibling ----
+    - name: D2 - provoke a duplicate-localhost-domain RDS reject on a healthy gateway
+      description: |
+        The goal is a route configuration the edge proxy genuinely rejects, with
+        a healthy sibling hostname on the same gateway still serving 200 and
+        nothing falsely reporting the gateway as programmed over the rejected
+        config.
+
+        Why this stays gated ($nackTestEnabled=false): the duplicate-domain
+        collision that once caused this can no longer be reproduced through any
+        supported path. Two listeners with the same hostname on one gateway are
+        rejected by the Gateway API webhook, and the connector path that
+        originally triggered it now appends a unique per-route domain, with every
+        other hostname path de-duplicating. So there is no operator path left that
+        emits a duplicate domain; the collision is structurally prevented.
+        Forcing it would require reverting that fix or hand-injecting a raw
+        duplicate-domain patch (which tests the proxy, not the operator), neither
+        of which is a faithful regression test. This step provisions only a
+        healthy gateway so the gated assertions below have a target.
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl get ns $NAMESPACE -o json
+            outputs:
+              - name: downstreamNamespaceName
+                value: (join('-', ['ns', json_parse($stdout).metadata.uid]))
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: nack-gateway
+              spec:
+                gatewayClassName: ($gatewayClassName)
+                listeners:
+                  - protocol: HTTPS
+                    port: 443
+                    name: https-healthy
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    hostname: healthy.e2e.env.datum.net
+                    tls:
+                      mode: Terminate
+                      options:
+                        gateway.networking.datumapis.com/certificate-issuer: ($clusterIssuerName)
+        # Upstream backend slice for the nack-route, pointing at the downstream
+        # echo backend by name.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: discovery.k8s.io/v1
+              kind: EndpointSlice
+              metadata:
+                name: nack-slice
+              addressType: FQDN
+              endpoints:
+                - addresses:
+                    - echo-backend.default.svc.cluster.local
+                  conditions:
+                    ready: true
+                    serving: true
+                    terminating: false
+              ports:
+                - name: http
+                  appProtocol: http
+                  port: 8080
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: nack-route
+              spec:
+                parentRefs:
+                  - name: nack-gateway
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: nack-slice
+                        port: 8080
+        - assert:
+            timeout: 120s
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: nack-gateway
+              status:
+                (addresses[?type == 'Hostname'] | [0]):
+                  type: Hostname
+      catch:
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n $NAMESPACE get gateway,httproute -o yaml
+
+    - name: D2 - the healthy sibling keeps serving 200 despite the RDS reject
+      description: |
+        Gated behind ($nackTestEnabled): asserts the rejected route configuration
+        is isolated so the sibling still serves. Until the rejection is confirmed
+        to reach the edge and be isolated, running this unconditionally would fail
+        whenever the collision breaks the whole gateway.
+      try:
+        - script:
+            timeout: 200s
+            cluster: nso-downstream
+            env:
+              - name: ENABLED
+                value: ($nackTestEnabled)
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              set -eu
+              if [ "${ENABLED}" != "true" ]; then
+                echo "SKIP: nackTestEnabled=false (D2 isolation unverified; see header)"
+                exit 0
+              fi
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              HOST=healthy.e2e.env.datum.net
+              ok=""
+              for i in $(seq 1 30); do
+                code=$(kubectl -n default exec conntest -- \
+                  curl -ksS -o /dev/null -w '%{http_code}' --max-time 10 \
+                  --resolve "${HOST}:443:${IP}" "https://${HOST}/status/200" 2>/dev/null || true)
+                echo "attempt ${i}: ${HOST} -> ${code}"
+                [ "${code}" = "200" ] && { ok="yes"; break; }
+                sleep 5
+              done
+              [ -n "${ok}" ] || { echo "ERROR: healthy sibling did not serve 200 (RDS reject not isolated)"; exit 1; }
+              echo "OK: healthy sibling still serves 200 despite the duplicate-localhost RDS reject"
+
+    - name: D2 - the edge reports update_rejected and NOTHING claims Programmed over a NACK
+      description: |
+        Guards against a false-positive status. Query the proxy's rejected-update
+        counter; if the gateway can report itself programmed while that counter is
+        non-zero, this fails — the exact regression a live freeze produced. Gated
+        behind ($nackTestEnabled) until the rejected configuration is confirmed to
+        reach the edge (see header).
+      try:
+        - script:
+            timeout: 120s
+            cluster: nso-downstream
+            env:
+              - name: ENABLED
+                value: ($nackTestEnabled)
+              - name: ADMIN_PORT
+                value: ($adminPort)
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              set -eu
+              if [ "${ENABLED}" != "true" ]; then
+                echo "SKIP: nackTestEnabled=false (awaiting confirmation the duplicate-localhost collision reaches the edge RDS)"
+                exit 0
+              fi
+              POD=$(kubectl get pods -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=${OWNING_GC} \
+                -o jsonpath='{.items[0].metadata.name}')
+              echo "edge pod: ${POD}"
+              STATS=$(kubectl -n datum-downstream-gateway exec "${POD}" -c envoy -- \
+                curl -s "http://127.0.0.1:${ADMIN_PORT}/stats?filter=update_rejected" 2>/dev/null || true)
+              echo "--- update_rejected stats ---"
+              echo "${STATS}"
+              # A genuine rejection must surface as a non-zero rejected-update
+              # counter. This asserts we observe the rejection at the data plane
+              # rather than trusting a green status.
+              REJECTED=$(echo "${STATS}" | awk -F': ' '/rds.*update_rejected|lds.update_rejected/ {s+=$2} END{print s+0}')
+              echo "total update_rejected: ${REJECTED}"
+              if [ "${REJECTED}" -eq 0 ]; then
+                echo "ERROR: expected a non-zero update_rejected from the duplicate-localhost RDS reject; got 0"
+                exit 1
+              fi
+              echo "OK: edge observed the NACK (update_rejected=${REJECTED}); healthy sibling still served 200"
+      catch:
+        - script:
+            cluster: nso-downstream
+            env:
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              kubectl -n datum-downstream-gateway logs -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC -c envoy --tail=150
diff --git a/test/e2e-edge/branded-error-page/chainsaw-test.yaml b/test/e2e-edge/branded-error-page/chainsaw-test.yaml
new file mode 100644
index 00000000..23f08174
--- /dev/null
+++ b/test/e2e-edge/branded-error-page/chainsaw-test.yaml
@@ -0,0 +1,480 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+#
+# Branded error page reaches the customer.
+#
+# Checks that a 5xx served by the edge carries the branded error page, and — the
+# important part — that this still works for a gateway provisioned after the
+# fact, without restarting anything. Activating the branded page in production
+# once needed a manual restart, which a status-based or restart-then-check test
+# would have missed.
+#
+# Two assertions:
+#   1. The branded body is present on a 5xx (identified by the sentinel
+#      X-Datum-Branded-Page: v1) and absent on a benign 200, proving branding is
+#      scoped to 5xx responses.
+#   2. Provision a second gateway and route after the edge is already running,
+#      without restarting anything, and assert its 5xx is also branded. If
+#      branding only takes effect on a restart, the fresh path serves an
+#      unbranded 5xx and this fails.
+#
+# The 5xx is produced by pointing a route at a backend Service with no ready
+# endpoints, so the proxy returns the error itself (the path the branded page
+# hooks). No connector is involved.
+#
+# The mounted error-page body must contain the sentinel X-Datum-Branded-Page: v1;
+# the test environment wires that body and this test only greps for it.
+#
+# Cluster names are inline; downstreamGatewayClass is as in waf-enforcement.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: branded-error-page
+spec:
+  concurrent: false
+  bindings:
+    - name: clusterIssuerName
+      value: (join('-', ['e2e', $namespace]))
+    - name: gatewayClassName
+      value: (join('-', ['e2e', $namespace]))
+    - name: downstreamGatewayClass
+      value: datum-downstream-gateway-e2e
+    # The sentinel substring the test environment mounts into the error-page body.
+    - name: sentinel
+      value: "X-Datum-Branded-Page: v1"
+    # Inputs for the config-presence check, which resolves the extension server
+    # pods by label selector (one per replica).
+    - name: extServerSelector
+      value: app.kubernetes.io/component=envoy-gateway-extension-server
+    - name: extServerNamespace
+      value: network-services-operator-system
+    - name: envoyPodSelector
+      value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e
+    # Namespace holding the data-plane proxy and its admin endpoint.
+    - name: envoyNamespace
+      value: datum-downstream-gateway
+  cluster: nso-upstream
+  steps:
+    - name: Create CA on the downstream cluster
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'issuer']))
+              spec:
+                selfSigned: {}
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              spec:
+                isCA: true
+                commonName: (join('-', [$clusterIssuerName, 'ca']))
+                secretName: ($clusterIssuerName)
+                privateKey:
+                  algorithm: ECDSA
+                  size: 256
+                issuerRef:
+                  name: (join('-', [$clusterIssuerName, 'issuer']))
+                  kind: ClusterIssuer
+                  group: cert-manager.io
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: ($clusterIssuerName)
+              spec:
+                ca:
+                  secretName: ($clusterIssuerName)
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
+    - name: Create the upstream GatewayClass (downstream class/EnvoyProxy are pre-provisioned)
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: ($gatewayClassName)
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+        # The downstream gateway class and its proxy are provisioned once by the
+        # test environment; tests must not recreate them. Only ensure the
+        # hostname-accounting namespace here.
+        - apply:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: datum-downstream-gateway-hostnames
+
+    - name: Create the echo backend (for the benign 200 control)
+      try:
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/echo-backend.yaml
+
+    - name: Provision and verify the Domain
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: Domain
+              metadata:
+                name: test-domain
+              spec:
+                domainName: e2e.env.datum.net
+        - description: Stand in for the Domain controller's HTTP/DNS verification.
+          script:
+            content: |
+              kubectl -n $NAMESPACE patch domain test-domain \
+                --subresource=status --type=merge \
+                -p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
+
+    - name: Provision the first Gateway with a 5xx route and a benign 200 route
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl get ns $NAMESPACE -o json
+            outputs:
+              - name: downstreamNamespaceName
+                value: (join('-', ['ns', json_parse($stdout).metadata.uid]))
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              spec:
+                gatewayClassName: ($gatewayClassName)
+                listeners:
+                  - protocol: HTTPS
+                    port: 443
+                    name: https-brand
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    hostname: brand.e2e.env.datum.net
+                    tls:
+                      mode: Terminate
+                      options:
+                        gateway.networking.datumapis.com/certificate-issuer: ($clusterIssuerName)
+        # Benign backend (echo) for the 200 control on /ok.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: discovery.k8s.io/v1
+              kind: EndpointSlice
+              metadata:
+                name: ok-slice
+              addressType: FQDN
+              endpoints:
+                - addresses:
+                    - echo-backend.default.svc.cluster.local
+                  conditions:
+                    ready: true
+                    serving: true
+                    terminating: false
+              ports:
+                - name: http
+                  appProtocol: http
+                  port: 8080
+        # A backend with no ready endpoints: the proxy returns a 5xx itself,
+        # which is exactly the path the branded page hooks.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: discovery.k8s.io/v1
+              kind: EndpointSlice
+              metadata:
+                name: dead-slice
+              addressType: FQDN
+              endpoints:
+                - addresses:
+                    - no-such-backend.default.svc.cluster.local
+                  conditions:
+                    ready: false
+                    serving: false
+                    terminating: false
+              ports:
+                - name: http
+                  appProtocol: http
+                  port: 8080
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: test-route
+              spec:
+                parentRefs:
+                  - name: test-gateway
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /ok
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: ok-slice
+                        port: 8080
+                    filters:
+                      - type: URLRewrite
+                        urlRewrite:
+                          path:
+                            type: ReplacePrefixMatch
+                            replacePrefixMatch: /
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: dead-slice
+                        port: 8080
+        - assert:
+            timeout: 120s
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              status:
+                (addresses[?type == 'Hostname'] | [0]):
+                  type: Hostname
+      catch:
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/name=network-services-operator --tail=200
+              kubectl -n $NAMESPACE get gateway,httproute -o yaml
+
+    - name: Stand up the long-lived conntest client and resolve the edge IP
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              spec:
+                containers:
+                  - name: curl
+                    image: curlimages/curl:8.11.1
+                    command: ["sleep", "infinity"]
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 64Mi
+                      limits:
+                        cpu: 100m
+                        memory: 128Mi
+                terminationGracePeriodSeconds: 0
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              status:
+                phase: Running
+    - name: The 5xx response carries the branded sentinel body
+      description: |
+        A real request to the dead-backend route returns 5xx and the body
+        contains the branded sentinel. If the branded config never applied, the
+        body is a stock 5xx and this fails.
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: brand.e2e.env.datum.net }
+            - { name: path, value: / }
+            - { name: scheme, value: https }
+            # 503 is the typical response with no healthy backend; the body
+            # substring is what makes this branded-specific.
+            - { name: expectCode, value: "503" }
+            - { name: expectBodySubstring, value: ($sentinel) }
+
+    - name: A benign 200 response does NOT carry the sentinel (branding is scoped to 5xx)
+      try:
+        - description: |
+            Branding must apply only to 5xx responses. A 200 body must not
+            contain the sentinel; if it does, branding is mis-scoped.
+          script:
+            timeout: 120s
+            cluster: nso-downstream
+            env:
+              - name: SENTINEL
+                value: ($sentinel)
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              set -eu
+              HOST=brand.e2e.env.datum.net
+              # Resolve the edge IP here; output bindings don't cross steps.
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              # Wait for the 200 path to be live, then assert its body lacks the
+              # sentinel.
+              ok=""
+              for i in $(seq 1 24); do
+                code=$(kubectl -n default exec conntest -- \
+                  curl -ksS -o /tmp/ok -w '%{http_code}' --max-time 10 \
+                  --resolve "${HOST}:443:${IP}" \
+                  "https://${HOST}/ok/status/200" 2>/dev/null || true)
+                echo "attempt ${i}: /ok -> ${code}"
+                if [ "${code}" = "200" ]; then ok="yes"; break; fi
+                sleep 5
+              done
+              [ -n "${ok}" ] || { echo "ERROR: benign 200 route never served"; exit 1; }
+              if kubectl -n default exec conntest -- grep -qF -- "${SENTINEL}" /tmp/ok 2>/dev/null; then
+                echo "ERROR: branded sentinel leaked into a 200 response body"; exit 1
+              fi
+              echo "OK: 200 body is clean (no sentinel), branding scoped to 5xx"
+
+    - name: Inert-detection - a NEW gateway translated with no restart is also branded
+      try:
+        - description: |
+            Provision a second gateway and dead-backend route after the edge is
+            already running, without restarting anything, and assert its 5xx is
+            branded too. If branding only takes effect on a restart, this fresh
+            path serves an unbranded 5xx and the next step fails.
+          create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway-2
+              spec:
+                gatewayClassName: ($gatewayClassName)
+                listeners:
+                  - protocol: HTTPS
+                    port: 443
+                    name: https-brand2
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    hostname: brand2.e2e.env.datum.net
+                    tls:
+                      mode: Terminate
+                      options:
+                        gateway.networking.datumapis.com/certificate-issuer: ($clusterIssuerName)
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: test-route-2
+              spec:
+                parentRefs:
+                  - name: test-gateway-2
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: dead-slice
+                        port: 8080
+        - assert:
+            timeout: 120s
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway-2
+              status:
+                (addresses[?type == 'Hostname'] | [0]):
+                  type: Hostname
+      catch:
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n $NAMESPACE get gateway,httproute -o yaml
+
+    - name: The newly translated gateway's 5xx is ALSO branded (no restart)
+      description: |
+        The new gateway's path must carry the branded body without any restart.
+        A miss here means branding only takes effect on a restart.
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: brand2.e2e.env.datum.net }
+            - { name: path, value: / }
+            - { name: scheme, value: https }
+            - { name: expectCode, value: "503" }
+            - { name: expectBodySubstring, value: ($sentinel) }
+
+    # Let the edge config settle after the second gateway is provisioned before
+    # the config-presence check compares.
+    - name: Wait for the edge config to settle before the parity gate
+      use:
+        template: ../_steps/wait-config-settle.yaml
+        with:
+          bindings:
+            - { name: extServerSelector, value: app.kubernetes.io/component=envoy-gateway-extension-server }
+            - { name: extServerNamespace, value: network-services-operator-system }
+
+    - name: Config-presence - the new listener's HCM carries local_reply_config (parity gate)
+      description: |
+        Confirms the branded error-page config is actually present at the edge
+        for the new gateway: the live config carries the branded-page mapping the
+        extension server reports it programmed, and the proxy accepted the
+        update. Catches config that is present in the operator but never reaches
+        the edge.
+      use:
+        template: ../_steps/assert-config-dump.yaml
+        with:
+          # Values are inlined, not referenced as ($envoyNamespace) etc.: a
+          # with-binding whose name matches a template default resolves ($name)
+          # against the template default, not this test's value. Literals avoid
+          # that self-reference.
+          bindings:
+            - { name: envoyPodSelector, value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e }
+            - { name: envoyNamespace, value: datum-downstream-gateway }
+            - { name: extServerSelector, value: app.kubernetes.io/component=envoy-gateway-extension-server }
+            - { name: extServerNamespace, value: network-services-operator-system }
+            - { name: dataplaneCluster, value: nso-downstream }
diff --git a/test/e2e-edge/connector-offline-503/chainsaw-test.yaml b/test/e2e-edge/connector-offline-503/chainsaw-test.yaml
new file mode 100644
index 00000000..d51fc722
--- /dev/null
+++ b/test/e2e-edge/connector-offline-503/chainsaw-test.yaml
@@ -0,0 +1,546 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+#
+# Offline backend returns a clean 503.
+#
+# When a connector is offline a user request returns 503 with the body
+# "Tunnel not online"; when it comes online and the edge picks up the change the
+# same request returns 200 through the tunnel; flipping back returns 503. The
+# 503-to-200 transition is the headline assertion: if the edge never picks up
+# the change when the connector comes online, the online phase hangs at 503 and
+# fails.
+#
+# The test drives the tunnel through a stand-in proxy; it does not exercise real
+# tunnel establishment or NAT traversal.
+#
+# The online phase depends on the edge re-applying config when the connector's
+# state changes, which is not yet confirmed on this edge version. Until it is,
+# the online-phase assertions are gated behind ($connectorTestEnabled): leave it
+# false to run only the offline 503 check (which needs no config re-apply), or
+# set it true once the re-apply is confirmed. If the re-apply turns out not to
+# fire, repurpose the online assertion to confirm the response stays 503.
+#
+# The online phase also needs the connect-proxy image built and loaded:
+#   docker build -t connect-proxy:e2e test/e2e-edge/_fixtures/connector-tunnel
+#   kind load docker-image connect-proxy:e2e --name <downstream-cluster>
+#
+# Cluster names are inline; downstreamGatewayClass is as in the other tests.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: connector-offline-503
+spec:
+  concurrent: false
+  bindings:
+    - name: clusterIssuerName
+      value: (join('-', ['e2e', $namespace]))
+    - name: gatewayClassName
+      value: (join('-', ['e2e', $namespace]))
+    - name: downstreamGatewayClass
+      value: datum-downstream-gateway-e2e
+    # The node id the tunnel fixture advertises; the online connector annotation
+    # carries this so the connector is classified online.
+    - name: tunnelNodeID
+      value: e2e-connect-proxy-node
+    # Gate the online-phase assertions until the edge re-apply is confirmed and
+    # the connect-proxy image is available (see header).
+    - name: connectorTestEnabled
+      value: "false"
+    # Extension server selector/namespace used to confirm the edge re-applied
+    # config; resolves all replicas and takes the highest build number.
+    - name: extServerSelector
+      value: app.kubernetes.io/component=envoy-gateway-extension-server
+    - name: extServerNamespace
+      value: network-services-operator-system
+  cluster: nso-upstream
+  steps:
+    - name: Create CA on the downstream cluster
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'issuer']))
+              spec:
+                selfSigned: {}
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              spec:
+                isCA: true
+                commonName: (join('-', [$clusterIssuerName, 'ca']))
+                secretName: ($clusterIssuerName)
+                privateKey:
+                  algorithm: ECDSA
+                  size: 256
+                issuerRef:
+                  name: (join('-', [$clusterIssuerName, 'issuer']))
+                  kind: ClusterIssuer
+                  group: cert-manager.io
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: ($clusterIssuerName)
+              spec:
+                ca:
+                  secretName: ($clusterIssuerName)
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
+    - name: Create the upstream GatewayClass (downstream class/EnvoyProxy are pre-provisioned)
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: ($gatewayClassName)
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+        # The HTTPProxy controller builds its gateway with the operator-configured
+        # class (default "datum-external-global-proxy"), not our per-test class.
+        # That class must exist or the proxy's gateway waits for a controller
+        # forever. Cluster-scoped and shared, so apply is idempotent.
+        - apply:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: datum-external-global-proxy
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+        # The downstream gateway class and its proxy are provisioned once by the
+        # test environment; tests must not recreate them. Only ensure the
+        # hostname-accounting namespace here.
+        - apply:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: datum-downstream-gateway-hostnames
+
+    - name: Create the echo backend and the CONNECT-proxy tunnel stand-in
+      try:
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/echo-backend.yaml
+        # The connect-proxy is the tunnel target: when the connector is online
+        # the edge dials this proxy Service, which forwards to the echo backend.
+        # An online request can only succeed through this path; there is no
+        # direct fallback route.
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/connector-tunnel/manifest.yaml
+
+    - name: Provision and verify the Domain
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: Domain
+              metadata:
+                name: test-domain
+              spec:
+                domainName: e2e.env.datum.net
+        - description: Stand in for the Domain controller's HTTP/DNS verification.
+          script:
+            content: |
+              kubectl -n $NAMESPACE patch domain test-domain \
+                --subresource=status --type=merge \
+                -p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
+
+    - name: Provision the ConnectorClass, Connector (offline), and connector-backed HTTPProxy
+      try:
+        # A Connector must reference an existing ConnectorClass to be accepted.
+        # ConnectorClass is cluster-scoped; apply (not create) so a leftover from
+        # a prior run does not fail the step.
+        - apply:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha1
+              kind: ConnectorClass
+              metadata:
+                name: test-connector-class
+              spec: {}
+        # Start offline: the upstream-status annotation carries Ready=False with
+        # no connection details. The connector's online/offline state rides on
+        # this annotation because only metadata is propagated to the edge, not
+        # status.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha1
+              kind: Connector
+              metadata:
+                name: test-connector
+                annotations:
+                  networking.datumapis.com/upstream-status: |
+                    {"conditions":[{"type":"Ready","status":"False","reason":"ConnectorNotReady","lastTransitionTime":"2026-06-23T00:00:00Z"}]}
+              spec:
+                connectorClassName: test-connector-class
+        # The HTTPProxy backend references the connector; its endpoint URL points
+        # at the connect-proxy Service so the online path tunnels there.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: HTTPProxy
+              metadata:
+                name: test-proxy
+              spec:
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backends:
+                      - endpoint: http://connect-proxy.default.svc.cluster.local:8080
+                        connector:
+                          name: test-connector
+        # Wait for the HTTPProxy to publish its canonical hostname, which tells us
+        # it reconciled and the downstream gateway and route exist. Poll in a
+        # script because the field is empty until the proxy's gateway gets an
+        # address, and a plain assert on it errors instead of retrying.
+        - script:
+            timeout: 180s
+            cluster: nso-upstream
+            content: |
+              set -eu
+              for i in $(seq 1 36); do
+                H=$(kubectl -n $NAMESPACE get httpproxy test-proxy \
+                  -o jsonpath='{.status.canonicalHostname}' 2>/dev/null || true)
+                # printf (no trailing newline) so $stdout is exactly the hostname.
+                if [ -n "${H}" ]; then printf '%s' "${H}"; exit 0; fi
+                echo "waiting for HTTPProxy canonicalHostname... ${i}" >&2
+                sleep 5
+              done
+              echo "ERROR: HTTPProxy never published a canonicalHostname" >&2
+              exit 1
+            outputs:
+              - name: proxyHostname
+                value: ($stdout)
+      catch:
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/name=network-services-operator --tail=200
+              kubectl -n $NAMESPACE get connector,connectorclass,httpproxy -o yaml
+
+    - name: Stand up the long-lived conntest client and resolve the edge IP
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              spec:
+                containers:
+                  - name: curl
+                    image: curlimages/curl:8.11.1
+                    command: ["sleep", "infinity"]
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 64Mi
+                      limits:
+                        cpu: 100m
+                        memory: 128Mi
+                terminationGracePeriodSeconds: 0
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              status:
+                phase: Running
+    - name: Phase 1 (offline) - the user path returns 503 (connector offline route applied)
+      description: |
+        Runs unconditionally: the offline state needs no edge config re-apply.
+        The hostname and edge IP are resolved within this step. Probes the plain
+        HTTP listener on port 80 because the HTTPS listener has no issued
+        certificate in this environment, and the offline 503 route applies on
+        both protocols.
+
+        Body contract: the offline route returns a 503 whose body is
+        "Tunnel not online", but when the branded error page is active (it is, by
+        default) it rewrites every 5xx body to the branded page. So the offline
+        body may be either the raw "Tunnel not online" or the branded page; we
+        accept either as proof of the offline route, and reject a 503 with
+        neither (that would be a different upstream error).
+      try:
+        # Resolve the connector hostname from the upstream HTTPProxy; the output
+        # binding is available to later operations in this same step.
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl -n $NAMESPACE get httpproxy test-proxy \
+                -o jsonpath='{.status.canonicalHostname}'
+            outputs:
+              - name: proxyHostname
+                value: ($stdout)
+        - script:
+            timeout: 300s
+            cluster: nso-downstream
+            env:
+              - name: HOST
+                value: ($proxyHostname)
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+              - name: SENTINEL
+                value: "X-Datum-Branded-Page: v1"
+            content: |
+              set -eu
+              echo "connector hostname: ${HOST}"
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              echo "edge IP: ${IP}"
+              ok=""
+              for i in $(seq 1 30); do
+                code=$(kubectl -n default exec conntest -- \
+                  curl -ksS -o /tmp/body -w '%{http_code}' --max-time 10 \
+                  --resolve "${HOST}:80:${IP}" \
+                  "http://${HOST}/" 2>/dev/null || true)
+                echo "attempt ${i}: offline ${HOST} -> ${code}"
+                if [ "${code}" = "503" ]; then
+                  # Accept the raw offline body or the branded override of it;
+                  # reject a 503 carrying neither (a different upstream error).
+                  if kubectl -n default exec conntest -- grep -qF -- "Tunnel not online" /tmp/body 2>/dev/null \
+                     || kubectl -n default exec conntest -- grep -qF -- "${SENTINEL}" /tmp/body 2>/dev/null; then
+                    ok="yes"; break
+                  fi
+                  echo "  got 503 but body has neither 'Tunnel not online' nor the branded sentinel"
+                fi
+                sleep 5
+              done
+              if [ -z "${ok}" ]; then
+                echo "ERROR: offline connector did not return the expected 503 offline response"
+                kubectl -n default exec conntest -- sh -c 'cat /tmp/body 2>/dev/null | head -c 1000' || true
+                exit 1
+              fi
+              echo "OK: offline connector returns 503 (offline route applied; body is the offline/branded reply)"
+
+    - name: Phase 2 (online) - flip the connector online, then 503->200 with a BuildID advance
+      description: |
+        The headline assertion, self-contained in one step. Capture the
+        extension server's build number, bring the connector online, then require
+        both the 503-to-200 transition and an advance in the build number. The
+        new build proves the edge actually re-applied config, not just that the
+        end state happens to look right. Gated behind ($connectorTestEnabled);
+        if the edge turns out not to re-apply on the change, repoint this to
+        assert the response stays 503.
+      try:
+        # Step 1 (downstream): resolve hostname and capture the build number
+        # before the connector comes online.
+        - script:
+            cluster: nso-downstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            env:
+              - name: EXT_SELECTOR
+                value: ($extServerSelector)
+              - name: EXT_NS
+                value: ($extServerNamespace)
+            content: |
+              set -eu
+              PODS="$(kubectl -n "${EXT_NS}" get pods -l "${EXT_SELECTOR}" \
+                --field-selector=status.phase=Running \
+                -o jsonpath='{.items[*].metadata.name}')"
+              MAX=0
+              for p in ${PODS}; do
+                BODY="$(kubectl -n "${EXT_NS}" exec "${p}" -- \
+                  curl -sS --max-time 10 http://localhost:8080/debug/programmed-set 2>/dev/null || true)"
+                ID="$(printf '%s' "${BODY}" | tr -d ' \n' | sed -n 's/.*"buildID":\([0-9][0-9]*\).*/\1/p')"
+                [ -z "${ID}" ] && ID=0
+                [ "${ID}" -gt "${MAX}" ] && MAX="${ID}"
+              done
+              printf '%s' "${MAX}"
+            outputs:
+              - name: buildIDBefore
+                value: ($stdout)
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl -n $NAMESPACE get httpproxy test-proxy \
+                -o jsonpath='{.status.canonicalHostname}'
+            outputs:
+              - name: proxyHostname
+                value: ($stdout)
+        # Step 2 (upstream): bring the connector online.
+        - script:
+            cluster: nso-upstream
+            env:
+              - name: ENABLED
+                value: ($connectorTestEnabled)
+              - name: NODE_ID
+                value: ($tunnelNodeID)
+            content: |
+              set -eu
+              [ "${ENABLED}" = "true" ] || { echo "SKIP: connectorTestEnabled=false"; exit 0; }
+              STATUS='{"conditions":[{"type":"Ready","status":"True","reason":"ConnectorReady","lastTransitionTime":"2026-06-23T00:00:00Z"}],"connectionDetails":{"type":"PublicKey","publicKey":{"id":"'"${NODE_ID}"'"}}}'
+              ESCAPED=$(printf '%s' "${STATUS}" | sed 's/\\/\\\\/g; s/"/\\"/g')
+              kubectl -n $NAMESPACE patch connector test-connector --type=merge \
+                -p "{\"metadata\":{\"annotations\":{\"networking.datumapis.com/upstream-status\":\"${ESCAPED}\"}}}"
+        # Step 3 (downstream): require the 503-to-200 transition and a build
+        # number advance.
+        - script:
+            timeout: 220s
+            cluster: nso-downstream
+            env:
+              - name: ENABLED
+                value: ($connectorTestEnabled)
+              - name: HOST
+                value: ($proxyHostname)
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+              - name: EXT_SELECTOR
+                value: ($extServerSelector)
+              - name: EXT_NS
+                value: ($extServerNamespace)
+              - name: BEFORE
+                value: ($buildIDBefore)
+            content: |
+              set -eu
+              if [ "${ENABLED}" != "true" ]; then
+                echo "SKIP: connectorTestEnabled=false (awaiting B0 outcome + connect-proxy image)"
+                exit 0
+              fi
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              echo "edge IP: ${IP}; BuildID before flip: ${BEFORE}"
+              ok=""
+              for i in $(seq 1 30); do
+                code=$(kubectl -n default exec conntest -- \
+                  curl -ksS -o /dev/null -w '%{http_code}' --max-time 10 \
+                  --resolve "${HOST}:443:${IP}" \
+                  "https://${HOST}/status/200" 2>/dev/null || true)
+                echo "attempt ${i}: online ${HOST} -> ${code}"
+                if [ "${code}" = "200" ]; then ok="yes"; break; fi
+                sleep 5
+              done
+              if [ -z "${ok}" ]; then
+                echo "ERROR: connector came online but the user path never reached 200"
+                echo "       (the edge did not re-translate on the liveness flip — the re-translation gap)"
+                exit 1
+              fi
+              echo "OK: 503->200 transition observed; edge re-translated on liveness flip"
+
+              # The extension server's build number must have advanced past BEFORE.
+              PODS="$(kubectl -n "${EXT_NS}" get pods -l "${EXT_SELECTOR}" \
+                --field-selector=status.phase=Running \
+                -o jsonpath='{.items[*].metadata.name}')"
+              AFTER=0
+              for p in ${PODS}; do
+                BODY="$(kubectl -n "${EXT_NS}" exec "${p}" -- \
+                  curl -sS --max-time 10 http://localhost:8080/debug/programmed-set 2>/dev/null || true)"
+                ID="$(printf '%s' "${BODY}" | tr -d ' \n' | sed -n 's/.*"buildID":\([0-9][0-9]*\).*/\1/p')"
+                [ -z "${ID}" ] && ID=0
+                [ "${ID}" -gt "${AFTER}" ] && AFTER="${ID}"
+              done
+              echo "BuildID after flip: ${AFTER} (require > ${BEFORE})"
+              if [ "${AFTER}" -le "${BEFORE}" ]; then
+                echo "ERROR: BuildID did not advance (no new build); traffic may have"
+                echo "       changed but re-translation did not fire — the #208/#209 gap"
+                exit 1
+              fi
+              echo "OK: BuildID advanced ${BEFORE}->${AFTER}; re-translation genuinely fired"
+      catch:
+        - script:
+            cluster: nso-downstream
+            env:
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              kubectl -n datum-downstream-gateway logs -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC -c envoy --tail=150
+
+    - name: Phase 3 (back offline) - flip Ready False, the request returns to 503
+      description: |
+        Self-contained step. Take the connector offline, then assert the user
+        path returns to 503. Gated behind ($connectorTestEnabled): the return to
+        503 also depends on the edge re-applying config on the change.
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl -n $NAMESPACE get httpproxy test-proxy \
+                -o jsonpath='{.status.canonicalHostname}'
+            outputs:
+              - name: proxyHostname
+                value: ($stdout)
+        - script:
+            cluster: nso-upstream
+            env:
+              - name: ENABLED
+                value: ($connectorTestEnabled)
+            content: |
+              set -eu
+              [ "${ENABLED}" = "true" ] || { echo "SKIP: connectorTestEnabled=false"; exit 0; }
+              kubectl -n $NAMESPACE patch connector test-connector --type=merge \
+                -p '{"metadata":{"annotations":{"networking.datumapis.com/upstream-status":"{\"conditions\":[{\"type\":\"Ready\",\"status\":\"False\",\"reason\":\"ConnectorNotReady\",\"lastTransitionTime\":\"2026-06-23T00:00:00Z\"}]}"}}}'
+        - script:
+            timeout: 200s
+            cluster: nso-downstream
+            env:
+              - name: ENABLED
+                value: ($connectorTestEnabled)
+              - name: HOST
+                value: ($proxyHostname)
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              set -eu
+              if [ "${ENABLED}" != "true" ]; then
+                echo "SKIP: connectorTestEnabled=false (awaiting B0 outcome + connect-proxy image)"
+                exit 0
+              fi
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              ok=""
+              for i in $(seq 1 30); do
+                code=$(kubectl -n default exec conntest -- \
+                  curl -ksS -o /dev/null -w '%{http_code}' --max-time 10 \
+                  --resolve "${HOST}:443:${IP}" \
+                  "https://${HOST}/status/200" 2>/dev/null || true)
+                echo "attempt ${i}: back-offline ${HOST} -> ${code}"
+                if [ "${code}" = "503" ]; then ok="yes"; break; fi
+                sleep 5
+              done
+              [ -n "${ok}" ] || { echo "ERROR: connector went offline but the path never returned to 503"; exit 1; }
+              echo "OK: returned to 503 after the connector went offline"
diff --git a/test/e2e-edge/extension-server-smoke/chainsaw-test.yaml b/test/e2e-edge/extension-server-smoke/chainsaw-test.yaml
new file mode 100644
index 00000000..8f077b4c
--- /dev/null
+++ b/test/e2e-edge/extension-server-smoke/chainsaw-test.yaml
@@ -0,0 +1,337 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+#
+# M2 functional confirmation for the prod-fidelity test-infra env.
+#
+# Drives an upstream Gateway + HTTPRoute through the production wiring — the
+# dedicated downstream Envoy Gateway (v1.7.4) + the NSO extension server
+# (failOpen:false, PostTranslateModify hook) on the real Coraza data plane — and
+# asserts a real HTTP 200 from the data plane. This is the path the default e2e
+# run never exercised (vanilla EG, no ext-server).
+#
+# Cluster names: nso-upstream (control) / nso-downstream (edge).
+# Downstream GatewayClass: datum-downstream-gateway-e2e (controllerName
+# gateway.envoyproxy.io/datum-downstream-gateway — the dedicated downstream EG).
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: extension-server-smoke
+spec:
+  bindings:
+    - name: gatewayClassName
+      value: (join('-', ['e2e', $namespace]))
+  cluster: nso-upstream
+  steps:
+    - name: Upstream GatewayClass (NSO-managed)
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: ($gatewayClassName)
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+
+    - name: Backend pod + service (edge)
+      try:
+        - description: Hostname-accounting namespace the gateway controller writes into.
+          apply:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: datum-downstream-gateway-hostnames
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: backend-pod
+                namespace: default
+                labels:
+                  purpose: backend-pod
+              spec:
+                containers:
+                  - name: test-plaintext
+                    image: ghcr.io/mccutchen/go-httpbin:2.18.1
+                    command: ["/bin/go-httpbin"]
+                    args: ["-host", "0.0.0.0", "-port", "8080"]
+                    resources:
+                      requests: { cpu: 100m, memory: 128Mi }
+                      limits: { cpu: 100m, memory: 128Mi }
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Service
+              metadata:
+                name: backend-service
+                namespace: default
+              spec:
+                ports:
+                  - name: http
+                    port: 8080
+                    targetPort: 8080
+                selector:
+                  purpose: backend-pod
+
+    - name: Provision Domain
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: Domain
+              metadata:
+                name: test-domain
+              spec:
+                domainName: e2e.env.datum.net
+        - script:
+            content: |
+              kubectl -n $NAMESPACE patch domain test-domain \
+                --subresource=status --type=merge \
+                -p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
+
+    - name: Provision Gateway (HTTP) and confirm it programs through the ext-server
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl get ns $NAMESPACE -o json
+            outputs:
+              - name: downstreamNamespaceName
+                value: (join('-', ['ns', json_parse($stdout).metadata.uid]))
+
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              spec:
+                gatewayClassName: ($gatewayClassName)
+                listeners:
+                  - protocol: HTTP
+                    port: 80
+                    name: http-test-e2e
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    hostname: test.e2e.env.datum.net
+
+        # Wait for the operator to publish the canonical hostname.
+        - assert:
+            timeout: 120s
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              status:
+                (addresses[?type == 'Hostname'] | [0]):
+                  type: Hostname
+
+        # The gateway must report ready. Because the edge is configured to refuse
+        # updates the extension server hasn't accepted, a ready gateway proves the
+        # extension server is in the path and working.
+        - assert:
+            timeout: 180s
+            cluster: nso-downstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+                namespace: ($downstreamNamespaceName)
+              status:
+                (conditions[?type == 'Accepted']):
+                  - status: "True"
+                (conditions[?type == 'Programmed']):
+                  - status: "True"
+
+    - name: Provision HTTPRoute
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl get ns $NAMESPACE -o json
+            outputs:
+              - name: downstreamNamespaceName
+                value: (join('-', ['ns', json_parse($stdout).metadata.uid]))
+
+        - create:
+            cluster: nso-upstream
+            resource:
+              kind: EndpointSlice
+              metadata:
+                name: test-slice-1
+              addressType: FQDN
+              apiVersion: discovery.k8s.io/v1
+              endpoints:
+                - addresses:
+                    - backend-service.default.svc.cluster.local
+                  conditions:
+                    ready: true
+                    serving: true
+                    terminating: false
+              ports:
+                - name: http
+                  appProtocol: http
+                  port: 8080
+
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: test-route
+              spec:
+                parentRefs:
+                  - name: test-gateway
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /plaintext
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: test-slice-1
+                        port: 8080
+                    filters:
+                      - type: URLRewrite
+                        urlRewrite:
+                          path:
+                            type: ReplacePrefixMatch
+                            replacePrefixMatch: /
+
+        - assert:
+            timeout: 120s
+            cluster: nso-downstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: test-route
+                namespace: ($downstreamNamespaceName)
+              status:
+                parents:
+                  - conditions:
+                      - reason: Accepted
+                        status: "True"
+                        type: Accepted
+                      - reason: ResolvedRefs
+                        status: "True"
+                        type: ResolvedRefs
+
+    - name: Real HTTP 200 through the data plane
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl -n $NAMESPACE get gateway test-gateway -o json
+            outputs:
+              - name: upstreamGateway
+                value: (json_parse($stdout))
+              - name: primaryHostname
+                value: ($upstreamGateway.status.addresses[?type == 'Hostname'].value | [0])
+
+        # The dedicated downstream EG provisions the merged data-plane Service in
+        # its own namespace (datum-downstream-gateway), labeled by owning
+        # gatewayclass — NOT in envoy-gateway-system.
+        - script:
+            cluster: nso-downstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl get svc -n datum-downstream-gateway -l gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e -o json
+            outputs:
+              - name: gatewayService
+                value: (json_parse($stdout).items | [0])
+
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: backend-pod
+                namespace: default
+              status:
+                phase: Running
+
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: test-pod
+                namespace: default
+              spec:
+                containers:
+                  - name: connectivity-test
+                    image: alpine:3.21.3
+                    command: ["/bin/sh", "-c", "sleep infinity"]
+                    resources:
+                      requests: { cpu: 100m, memory: 128Mi }
+                      limits: { cpu: 100m, memory: 1Gi }
+                    env:
+                      - name: GATEWAY_SERVICE_NAME
+                        value: ($gatewayService.metadata.name)
+                      - name: GATEWAY_SERVICE_NAMESPACE
+                        value: ($gatewayService.metadata.namespace)
+                      - name: PRIMARY_HOSTNAME
+                        value: ($primaryHostname)
+                    lifecycle:
+                      postStart:
+                        exec:
+                          command: ["apk", "add", "curl"]
+                terminationGracePeriodSeconds: 0
+
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: test-pod
+                namespace: default
+              status:
+                phase: Running
+
+        # Give the proxies a moment to pick up the latest configuration.
+        - sleep:
+            duration: 15s
+
+        - script:
+            cluster: nso-downstream
+            content: |
+              kubectl -n default exec -i test-pod -- sh -c " \
+                set -x; \
+                curl -svf -H \"Host: \${PRIMARY_HOSTNAME}\" http://\${GATEWAY_SERVICE_NAME}.\${GATEWAY_SERVICE_NAMESPACE}.svc.cluster.local/plaintext/status/200; \
+              "
+      catch:
+        - script:
+            cluster: nso-downstream
+            content: |
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/component=envoy-gateway-extension-server --tail=80 || true
+              kubectl -n datum-downstream-gateway logs deploy/envoy-datum-downstream-gateway --tail=80 || true
+              kubectl -n envoy-gateway-system get pods -o wide || true
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/name=network-services-operator --tail=80 || true
diff --git a/test/e2e-edge/trafficprotectionpolicy-enforce/chainsaw-test.yaml b/test/e2e-edge/trafficprotectionpolicy-enforce/chainsaw-test.yaml
new file mode 100644
index 00000000..061b2513
--- /dev/null
+++ b/test/e2e-edge/trafficprotectionpolicy-enforce/chainsaw-test.yaml
@@ -0,0 +1,291 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+#
+# TrafficProtectionPolicy Enforce mode must not take the gateway offline.
+#
+# Regression for issue #243: the branded error page NSO injects into Envoy's
+# local_reply_config is a SubstitutionFormatString, so an unescaped '%' in the
+# page (e.g. CSS "height: 100%") makes Envoy reject the whole listener and, with
+# failOpen:false, drops the xDS update — every request then fails with an empty
+# reply instead of the backend's 200. This drives a real benign request through
+# a WAF gateway carrying an Enforce-mode policy and requires a 200, asserted on
+# the wire rather than on Gateway.status (EG reports Programmed from its own
+# translation, independent of Envoy's xDS ACK).
+#
+# This lives in the edge suite, not test/e2e, because it needs the real WAF data
+# plane (extension server + Coraza on the datum-downstream-gateway class) the
+# single-stack environment does not have. The two cluster names are written
+# inline (nso-upstream / nso-downstream) because chainsaw cannot bind a cluster
+# name. Runs alone (concurrent: false) because it shares cluster-wide downstream
+# config with the other data-plane tests.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: trafficprotectionpolicy-enforce-serves-traffic
+spec:
+  concurrent: false
+  bindings:
+    - name: clusterIssuerName
+      value: (join('-', ['e2e', $namespace]))
+    - name: gatewayClassName
+      value: (join('-', ['e2e', $namespace]))
+    # The downstream gateway class wired to the extension server.
+    - name: downstreamGatewayClass
+      value: datum-downstream-gateway-e2e
+    - name: hostname
+      value: tpp-enforce.e2e.env.datum.net
+  cluster: nso-upstream
+  steps:
+    - name: Create CA on the downstream cluster
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'issuer']))
+              spec:
+                selfSigned: {}
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              spec:
+                isCA: true
+                commonName: (join('-', [$clusterIssuerName, 'ca']))
+                secretName: ($clusterIssuerName)
+                privateKey:
+                  algorithm: ECDSA
+                  size: 256
+                issuerRef:
+                  name: (join('-', [$clusterIssuerName, 'issuer']))
+                  kind: ClusterIssuer
+                  group: cert-manager.io
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: ($clusterIssuerName)
+              spec:
+                ca:
+                  secretName: ($clusterIssuerName)
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
+    - name: Create the upstream GatewayClass (downstream class/EnvoyProxy are pre-provisioned)
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: ($gatewayClassName)
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+        - apply:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: datum-downstream-gateway-hostnames
+
+    - name: Create the echo backend
+      try:
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/echo-backend.yaml
+
+    - name: Provision and verify the Domain
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: Domain
+              metadata:
+                name: test-domain
+              spec:
+                domainName: e2e.env.datum.net
+        - description: Stand in for the Domain controller's HTTP/DNS verification.
+          script:
+            content: |
+              kubectl -n $NAMESPACE patch domain test-domain \
+                --subresource=status --type=merge \
+                -p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
+
+    - name: Provision a Gateway, route, and an Enforce-mode TrafficProtectionPolicy
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              spec:
+                gatewayClassName: ($gatewayClassName)
+                listeners:
+                  - protocol: HTTPS
+                    port: 443
+                    name: https-waf
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    hostname: ($hostname)
+                    tls:
+                      mode: Terminate
+                      options:
+                        gateway.networking.datumapis.com/certificate-issuer: ($clusterIssuerName)
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: discovery.k8s.io/v1
+              kind: EndpointSlice
+              metadata:
+                name: test-slice-1
+              addressType: FQDN
+              endpoints:
+                - addresses:
+                    - echo-backend.default.svc.cluster.local
+                  conditions:
+                    ready: true
+                    serving: true
+                    terminating: false
+              ports:
+                - name: http
+                  appProtocol: http
+                  port: 8080
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: test-route
+              spec:
+                parentRefs:
+                  - name: test-gateway
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: test-slice-1
+                        port: 8080
+        # Enforce mode: the policy is live and can block. The regression is that
+        # it must not, by itself, break the listener for benign traffic.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: TrafficProtectionPolicy
+              metadata:
+                name: test-waf
+              spec:
+                targetRefs:
+                  - group: gateway.networking.k8s.io
+                    kind: Gateway
+                    name: test-gateway
+                mode: Enforce
+                ruleSets:
+                  - type: OWASPCoreRuleSet
+                    owaspCoreRuleSet: {}
+        - assert:
+            timeout: 120s
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              status:
+                (addresses[?type == 'Hostname'] | [0]):
+                  type: Hostname
+      catch:
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/name=network-services-operator --tail=200
+              kubectl -n $NAMESPACE get gateway,httproute,trafficprotectionpolicy -o yaml
+
+    - name: Stand up the long-lived conntest client
+      try:
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: echo-backend
+                namespace: default
+              status:
+                phase: Running
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              spec:
+                containers:
+                  - name: curl
+                    image: curlimages/curl:8.11.1
+                    command: ["sleep", "infinity"]
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 64Mi
+                      limits:
+                        cpu: 100m
+                        memory: 128Mi
+                terminationGracePeriodSeconds: 0
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              status:
+                phase: Running
+
+    - name: Benign traffic still returns 200 under an Enforce-mode policy (issue #243)
+      description: >
+        The core regression check: with an Enforce-mode policy attached and the
+        branded error page in the proxy's local_reply_config, a benign request
+        must still reach the backend. Before the fix the listener is rejected and
+        this returns 000 / empty reply; after the fix it returns the backend's
+        200.
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: tpp-enforce.e2e.env.datum.net }
+            - { name: path, value: /get }
+            - { name: scheme, value: https }
+            - { name: expectCode, value: "200" }
diff --git a/test/e2e-edge/waf-enforcement/chainsaw-test.yaml b/test/e2e-edge/waf-enforcement/chainsaw-test.yaml
new file mode 100644
index 00000000..7d0e1448
--- /dev/null
+++ b/test/e2e-edge/waf-enforcement/chainsaw-test.yaml
@@ -0,0 +1,440 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
+#
+# Web-app firewall enforcement.
+#
+# Checks that the firewall blocks a malicious request with 403 while a benign
+# request still returns 200 — asserted on the real HTTP responses, never on
+# gateway status, because the firewall rule can be accepted in config yet never
+# actually apply to traffic.
+#
+# The benign-after-malicious request also guards against a bad firewall rule
+# breaking the listener, and the Observe-mode flip at the end proves the 403 is
+# driven by the policy and not some unrelated default.
+#
+# The two cluster names are written inline (nso-upstream / nso-downstream)
+# because chainsaw cannot bind a cluster name. downstreamGatewayClass is both
+# the gateway class created here and the label the edge proxy service is
+# selected by; confirm it against the test environment before a live run.
+#
+# Runs alone (concurrent: false) because it shares cluster-wide downstream
+# config with the other data-plane tests.
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: waf-enforcement
+spec:
+  concurrent: false
+  bindings:
+    - name: clusterIssuerName
+      value: (join('-', ['e2e', $namespace]))
+    - name: gatewayClassName
+      value: (join('-', ['e2e', $namespace]))
+    # The downstream gateway class wired to the extension server.
+    - name: downstreamGatewayClass
+      value: datum-downstream-gateway-e2e
+    # Inputs for the config-presence check, which resolves the extension server
+    # pods by label selector (one per replica).
+    - name: extServerSelector
+      value: app.kubernetes.io/component=envoy-gateway-extension-server
+    - name: extServerNamespace
+      value: network-services-operator-system
+    - name: envoyPodSelector
+      value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e
+    # Namespace holding the data-plane proxy and its admin endpoint.
+    - name: envoyNamespace
+      value: datum-downstream-gateway
+  cluster: nso-upstream
+  steps:
+    - name: Create CA on the downstream cluster
+      try:
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'issuer']))
+              spec:
+                selfSigned: {}
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              spec:
+                isCA: true
+                commonName: (join('-', [$clusterIssuerName, 'ca']))
+                secretName: ($clusterIssuerName)
+                privateKey:
+                  algorithm: ECDSA
+                  size: 256
+                issuerRef:
+                  name: (join('-', [$clusterIssuerName, 'issuer']))
+                  kind: ClusterIssuer
+                  group: cert-manager.io
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: ClusterIssuer
+              metadata:
+                name: ($clusterIssuerName)
+              spec:
+                ca:
+                  secretName: ($clusterIssuerName)
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: cert-manager.io/v1
+              kind: Certificate
+              metadata:
+                name: (join('-', [$clusterIssuerName, 'ca']))
+                namespace: cert-manager
+              status:
+                conditions:
+                  - type: Ready
+                    status: "True"
+
+    - name: Create the upstream GatewayClass (downstream class/EnvoyProxy are pre-provisioned)
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: GatewayClass
+              metadata:
+                name: ($gatewayClassName)
+              spec:
+                controllerName: gateway.networking.datumapis.com/external-global-proxy-controller
+        # The downstream gateway class and its proxy are provisioned once by the
+        # test environment; tests must not recreate them. Only ensure the
+        # hostname-accounting namespace here.
+        - apply:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Namespace
+              metadata:
+                name: datum-downstream-gateway-hostnames
+
+    - name: Create the echo backend
+      try:
+        - apply:
+            cluster: nso-downstream
+            file: ../_fixtures/echo-backend.yaml
+
+    - name: Provision and verify the Domain
+      try:
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: Domain
+              metadata:
+                name: test-domain
+              spec:
+                domainName: e2e.env.datum.net
+        - description: Stand in for the Domain controller's HTTP/DNS verification.
+          script:
+            content: |
+              kubectl -n $NAMESPACE patch domain test-domain \
+                --subresource=status --type=merge \
+                -p '{"status":{"conditions":[{"type": "Verified", "status": "True", "reason": "Test", "message": "test", "lastTransitionTime": "2025-02-24T23:59:09Z"}]}}'
+
+    - name: Provision a Gateway, route, and an Enforce-mode TrafficProtectionPolicy
+      try:
+        - script:
+            cluster: nso-upstream
+            skipCommandOutput: true
+            skipLogOutput: true
+            content: |
+              kubectl get ns $NAMESPACE -o json
+            outputs:
+              - name: downstreamNamespaceName
+                value: (join('-', ['ns', json_parse($stdout).metadata.uid]))
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              spec:
+                gatewayClassName: ($gatewayClassName)
+                listeners:
+                  - protocol: HTTPS
+                    port: 443
+                    name: https-waf
+                    allowedRoutes:
+                      namespaces:
+                        from: Same
+                    hostname: waf.e2e.env.datum.net
+                    tls:
+                      mode: Terminate
+                      options:
+                        gateway.networking.datumapis.com/certificate-issuer: ($clusterIssuerName)
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: discovery.k8s.io/v1
+              kind: EndpointSlice
+              metadata:
+                name: test-slice-1
+              addressType: FQDN
+              endpoints:
+                - addresses:
+                    - echo-backend.default.svc.cluster.local
+                  conditions:
+                    ready: true
+                    serving: true
+                    terminating: false
+              ports:
+                - name: http
+                  appProtocol: http
+                  port: 8080
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: HTTPRoute
+              metadata:
+                name: test-route
+              spec:
+                parentRefs:
+                  - name: test-gateway
+                    kind: Gateway
+                rules:
+                  - matches:
+                      - path:
+                          type: PathPrefix
+                          value: /
+                    backendRefs:
+                      - group: discovery.k8s.io
+                        kind: EndpointSlice
+                        name: test-slice-1
+                        port: 8080
+        # Enforce mode: a matching request must be blocked with 403.
+        - create:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: TrafficProtectionPolicy
+              metadata:
+                name: test-waf
+              spec:
+                targetRefs:
+                  - group: gateway.networking.k8s.io
+                    kind: Gateway
+                    name: test-gateway
+                mode: Enforce
+                ruleSets:
+                  - type: OWASPCoreRuleSet
+                    owaspCoreRuleSet: {}
+        - assert:
+            timeout: 120s
+            cluster: nso-upstream
+            resource:
+              apiVersion: gateway.networking.k8s.io/v1
+              kind: Gateway
+              metadata:
+                name: test-gateway
+              status:
+                (addresses[?type == 'Hostname'] | [0]):
+                  type: Hostname
+      catch:
+        - script:
+            cluster: nso-upstream
+            content: |
+              kubectl -n network-services-operator-system logs -l app.kubernetes.io/name=network-services-operator --tail=200
+              kubectl -n $NAMESPACE get gateway,httproute,trafficprotectionpolicy -o yaml
+
+    - name: Stand up the long-lived conntest client and resolve the edge IP
+      try:
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: echo-backend
+                namespace: default
+              status:
+                phase: Running
+        - create:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              spec:
+                containers:
+                  - name: curl
+                    image: curlimages/curl:8.11.1
+                    command: ["sleep", "infinity"]
+                    resources:
+                      requests:
+                        cpu: 50m
+                        memory: 64Mi
+                      limits:
+                        cpu: 100m
+                        memory: 128Mi
+                terminationGracePeriodSeconds: 0
+        - assert:
+            cluster: nso-downstream
+            resource:
+              apiVersion: v1
+              kind: Pod
+              metadata:
+                name: conntest
+                namespace: default
+              status:
+                phase: Running
+    - name: Benign request returns 200
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: waf.e2e.env.datum.net }
+            - { name: path, value: /get }
+            - { name: scheme, value: https }
+            - { name: expectCode, value: "200" }
+
+    - name: Malicious requests are blocked with 403 (SQLi, traversal, XSS)
+      try:
+        - description: |
+            Send each malicious payload and require a 403. Assert on the 403
+            itself, not on which firewall rule fired, since rule identifiers
+            change between rule-set versions. If the firewall rule never applied,
+            these return 200 and the step fails.
+          script:
+            timeout: 240s
+            cluster: nso-downstream
+            env:
+              - name: HOST
+                value: waf.e2e.env.datum.net
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+            content: |
+              set -eu
+              # Resolve the edge IP here; output bindings don't cross steps.
+              IP=$(kubectl get svc -n datum-downstream-gateway \
+                -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC \
+                -o jsonpath='{.items[0].spec.clusterIP}')
+              # Malicious payloads, kept inline so the assertion is
+              # self-contained; the corpus file is the reviewable source.
+              fail=0
+              for q in \
+                'id=1%27%20OR%20%271%27%3D%271' \
+                'q=UNION%20SELECT%20username%2Cpassword%20FROM%20users' \
+                'file=..%2F..%2F..%2Fetc%2Fpasswd' \
+                'x=%3Cscript%3Ealert(1)%3C%2Fscript%3E' ; do
+                code=$(kubectl -n default exec conntest -- \
+                  curl -ksS -o /dev/null -w '%{http_code}' --max-time 10 \
+                  --resolve "${HOST}:443:${IP}" \
+                  "https://${HOST}/get?${q}" 2>/dev/null || true)
+                echo "malicious '${q}' -> ${code}"
+                if [ "${code}" != "403" ]; then
+                  echo "  ERROR: expected 403 (WAF block), got ${code}"
+                  fail=1
+                fi
+              done
+              [ "${fail}" -eq 0 ] || { echo "ERROR: a malicious request was not blocked"; exit 1; }
+              echo "OK: all malicious requests blocked with 403"
+      catch:
+        - script:
+            cluster: nso-downstream
+            content: |
+              kubectl -n datum-downstream-gateway logs -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC -c envoy --tail=100
+            env:
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+
+    - name: Benign request still returns 200 after the WAF blocks (parser.Merge guard)
+      description: |
+        Checks the listener still works after a firewall block. If a bad
+        firewall rule broke the proxy or its listener, this returns non-200 and
+        the test fails.
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: waf.e2e.env.datum.net }
+            - { name: path, value: /get }
+            - { name: scheme, value: https }
+            - { name: expectCode, value: "200" }
+
+    - name: Observe-mode control - the same malicious request now returns 200
+      try:
+        - description: |
+            Switch the policy to Observe so the firewall logs but does not
+            block. This proves the 403 above came from the policy, not an
+            unrelated default.
+          patch:
+            cluster: nso-upstream
+            resource:
+              apiVersion: networking.datumapis.com/v1alpha
+              kind: TrafficProtectionPolicy
+              metadata:
+                name: test-waf
+              spec:
+                mode: Observe
+      catch:
+        - script:
+            cluster: nso-downstream
+            content: |
+              kubectl -n datum-downstream-gateway logs -l gateway.envoyproxy.io/owning-gatewayclass=$OWNING_GC -c envoy --tail=100
+            env:
+              - name: OWNING_GC
+                value: ($downstreamGatewayClass)
+
+    - name: In Observe mode the previously-blocked SQLi request returns 200
+      description: |
+        After the switch to Observe, the edge must pick up the new config and
+        the same payload that returned 403 now returns 200. This 403-to-200
+        transition is what proves enforcement is driven by the policy.
+      use:
+        template: ../_steps/assert-http-response.yaml
+        with:
+          bindings:
+            - { name: host, value: waf.e2e.env.datum.net }
+            - { name: path, value: "/get?id=1%27%20OR%20%271%27%3D%271" }
+            - { name: scheme, value: https }
+            - { name: expectCode, value: "200" }
+
+    # Let the edge config settle after the Observe-mode switch before the
+    # config-presence check compares.
+    - name: Wait for the edge config to settle before the parity gate
+      use:
+        template: ../_steps/wait-config-settle.yaml
+        with:
+          bindings:
+            - { name: extServerSelector, value: app.kubernetes.io/component=envoy-gateway-extension-server }
+            - { name: extServerNamespace, value: network-services-operator-system }
+
+    # Runs last so a config-presence hiccup never masks the firewall traffic
+    # assertions above.
+    - name: Config-presence - the WAF config actually landed at the edge (parity gate)
+      description: |
+        Confirms the firewall config is actually present at the edge: the live
+        proxy config carries exactly the firewall rules the extension server
+        reports it programmed, and the proxy accepted the update. The traffic
+        assertions prove the firewall blocks; this proves the config is present
+        and not silently dropped.
+      use:
+        template: ../_steps/assert-config-dump.yaml
+        with:
+          # Values are inlined, not referenced as ($envoyNamespace) etc.: a
+          # with-binding whose name matches a template default resolves ($name)
+          # against the template default, not this test's value. Literals avoid
+          # that self-reference.
+          bindings:
+            - { name: envoyPodSelector, value: gateway.envoyproxy.io/owning-gatewayclass=datum-downstream-gateway-e2e }
+            - { name: envoyNamespace, value: datum-downstream-gateway }
+            - { name: extServerSelector, value: app.kubernetes.io/component=envoy-gateway-extension-server }
+            - { name: extServerNamespace, value: network-services-operator-system }
+            - { name: dataplaneCluster, value: nso-downstream }
diff --git a/test/e2e/trafficprotectionpolicy-enforce/chainsaw-test.yaml b/test/e2e/trafficprotectionpolicy-enforce/chainsaw-test.yaml
deleted file mode 100644
index 5d684ff7..00000000
--- a/test/e2e/trafficprotectionpolicy-enforce/chainsaw-test.yaml
+++ /dev/null
@@ -1,164 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json
-apiVersion: chainsaw.kyverno.io/v1alpha1
-kind: Test
-metadata:
-  name: trafficprotectionpolicy-enforce-serves-traffic
-# Regression for issue #243: a TrafficProtectionPolicy in Enforce mode must not
-# take the gateway offline. The branded error page NSO injects into Envoy's
-# local_reply_config is a SubstitutionFormatString, so an unescaped '%' in the
-# page (e.g. CSS "height: 100%") makes Envoy reject the whole listener and, with
-# failOpen:false, drops the xDS update fleet-wide — every request then fails
-# with an empty reply instead of the backend's 200.
-#
-# Precondition: the downstream (nso-infra) must have the WAF data plane wired up
-# (extension-server + the extensionManager Envoy Gateway registered on the
-# `datum-downstream-gateway` GatewayClass, with the Coraza filter). The stock
-# `make prepare-infra-cluster` does NOT install this; this test is skipped by
-# CI environments without it (the Gateway never reaches Programmed=True).
-spec:
-  cluster: nso-infra
-  # EG only reconciles namespaces carrying this label.
-  namespaceTemplate:
-    metadata:
-      labels:
-        meta.datumapis.com/upstream-cluster-name: e2e
-  steps:
-    - name: Deploy a backend
-      try:
-        - apply:
-            resource:
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: echo
-              spec:
-                replicas: 1
-                selector:
-                  matchLabels:
-                    app: echo
-                template:
-                  metadata:
-                    labels:
-                      app: echo
-                  spec:
-                    containers:
-                      - name: echo
-                        image: hashicorp/http-echo:1.0
-                        args: ["-text=hello from backend", "-listen=:8080"]
-                        ports:
-                          - containerPort: 8080
-        - apply:
-            resource:
-              apiVersion: v1
-              kind: Service
-              metadata:
-                name: echo
-              spec:
-                selector:
-                  app: echo
-                ports:
-                  - port: 80
-                    targetPort: 8080
-        - assert:
-            resource:
-              apiVersion: apps/v1
-              kind: Deployment
-              metadata:
-                name: echo
-              status:
-                availableReplicas: 1
-
-    - name: Route through the WAF gateway with an Enforce policy
-      bindings:
-        - name: hostname
-          value: (join('.', [$namespace, 'e2e.test']))
-      try:
-        - apply:
-            resource:
-              apiVersion: gateway.networking.k8s.io/v1
-              kind: Gateway
-              metadata:
-                name: waf-gw
-              spec:
-                gatewayClassName: datum-downstream-gateway
-                listeners:
-                  - name: http
-                    protocol: HTTP
-                    port: 80
-                    hostname: ($hostname)
-                    allowedRoutes:
-                      namespaces:
-                        from: Same
-        - apply:
-            resource:
-              apiVersion: gateway.networking.k8s.io/v1
-              kind: HTTPRoute
-              metadata:
-                name: echo
-              spec:
-                parentRefs:
-                  - name: waf-gw
-                hostnames:
-                  - ($hostname)
-                rules:
-                  - matches:
-                      - path:
-                          type: PathPrefix
-                          value: /
-                    backendRefs:
-                      - name: echo
-                        port: 80
-        - apply:
-            resource:
-              apiVersion: networking.datumapis.com/v1alpha
-              kind: TrafficProtectionPolicy
-              metadata:
-                name: enforce-waf
-              spec:
-                mode: Enforce
-                targetRefs:
-                  - group: gateway.networking.k8s.io
-                    kind: Gateway
-                    name: waf-gw
-                ruleSets:
-                  - type: OWASPCoreRuleSet
-                    owaspCoreRuleSet: {}
-        - assert:
-            resource:
-              apiVersion: gateway.networking.k8s.io/v1
-              kind: Gateway
-              metadata:
-                name: waf-gw
-              status:
-                (conditions[?type == 'Programmed']):
-                  - status: "True"
-
-    - name: Benign traffic must reach the backend (not an empty/5xx reply)
-      description: >
-        Probe the downstream Envoy via the kind hostPort (30080). Before the fix
-        the listener is rejected and curl returns 000 / empty reply; after the
-        fix a benign GET returns the backend's 200. Gateway.status.Programmed is
-        not sufficient on its own — EG reports Programmed from its own
-        translation, independent of Envoy's xDS ACK — so this asserts on the
-        wire.
-      bindings:
-        - name: hostname
-          value: (join('.', [$namespace, 'e2e.test']))
-      try:
-        - script:
-            env:
-              - name: HOSTNAME
-                value: ($hostname)
-            content: |
-              set -u
-              for i in $(seq 1 30); do
-                code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 \
-                  -H "Host: ${HOSTNAME}" http://localhost:30080/) || code=000
-                echo "attempt ${i}: HTTP ${code}"
-                if [ "${code}" = "200" ]; then
-                  exit 0
-                fi
-                sleep 3
-              done
-              echo "benign request never returned 200 (issue #243 regression)"
-              exit 1
diff --git a/test/parity/README.md b/test/parity/README.md
new file mode 100644
index 00000000..43d3ea5b
--- /dev/null
+++ b/test/parity/README.md
@@ -0,0 +1,58 @@
+# The parity check
+
+The parity check answers one question the customer ultimately cares about:
+
+> **Is the edge actually doing what it was told to do?**
+
+It compares two things — what the platform *intended* to program onto the edge,
+and what the running proxy is *actually* serving — and reports any difference.
+It's the tie-breaker described in [`docs/testing/README.md`](../../docs/testing/README.md),
+backing up the real-traffic guarantees in
+[`test/e2e/README.md`](../e2e/README.md).
+
+## Why real traffic isn't enough on its own
+
+A successful response is reassuring but ambiguous. If a firewall is supposed to
+block an attack and the attack instead succeeds, the response alone can't tell
+you *why*: is the firewall switched off, did the rule not match, did the edge
+never pick up the new configuration, or was the configuration applied to the
+wrong place? Worse, the most dangerous version of this failure is silent — a
+firewall that protects nothing still lets every ordinary request through, so
+everything looks healthy right up until a real attack arrives in production.
+
+The parity check removes the ambiguity. It looks past the response at the edge's
+actual live configuration, so a surprising result becomes a specific, named
+diagnosis instead of a guess.
+
+## What it catches
+
+It sorts any gap between intended and actual into the categories that map to
+real incidents:
+
+| Diagnosis | What it means for the customer |
+|---|---|
+| **Missing** | The edge was told to add protection but carries none — the rule is inert. |
+| **Incomplete** | Only part of what was intended made it — partial protection. |
+| **Misplaced** | The right amount of configuration, applied to the wrong place. |
+| **Rejected** | The edge refused the update outright and is serving stale config. |
+| **Overflowed** | The configuration was too large to deliver and was silently dropped. |
+
+## How it fits the suite
+
+- **Real traffic is the verdict.** Did the edge behave correctly? That's the
+  pass/fail.
+- **Parity is the diagnosis.** When the verdict surprises, parity says which of
+  the failures above you're in — and it catches the silent, protects-nothing
+  case that ordinary traffic can't reveal.
+
+The rule the suite holds to: parity supports a real-traffic test, it never
+replaces one. A scenario that could send the attack and watch it be blocked does
+exactly that; parity is added on top, never in place of the behavior itself.
+
+## Using it
+
+The check ships as a small command, `parity-check` (see
+[`cmd/parity-check`](../../cmd/parity-check)), which the end-to-end suite runs
+automatically as a shared step. It can also be pointed at a live edge on its own
+to ask, "does this proxy match what it was told?" — useful when diagnosing an
+edge that's misbehaving.
diff --git a/test/parity/configdump.go b/test/parity/configdump.go
new file mode 100644
index 00000000..aa2741be
--- /dev/null
+++ b/test/parity/configdump.go
@@ -0,0 +1,147 @@
+package parity
+
+import (
+	"fmt"
+
+	adminv3 "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+// ConfigDump is the parsed view of the proxy's live configuration, with each
+// resource decoded into its concrete type.
+type ConfigDump struct {
+	Clusters  []*clusterv3.Cluster
+	Routes    []*routev3.RouteConfiguration
+	Listeners []*listenerv3.Listener
+	// SecretNames are the TLS certificates present, used to confirm that
+	// certificates we expected to be removed are actually gone.
+	SecretNames []string
+	// ErrorStates holds, per kind of configuration, the reasons the proxy gave
+	// for rejecting an individual resource.
+	ErrorStates map[string][]string
+}
+
+// ParseConfigDump decodes the proxy's live configuration into typed resources.
+// We decode against the real schema rather than poking at raw JSON so that a
+// shape we don't recognize is a hard error, not a silent miss.
+func ParseConfigDump(raw []byte) (*ConfigDump, error) {
+	var dump adminv3.ConfigDump
+	// Tolerate fields newer than this binary knows about, so a proxy running a
+	// newer version doesn't fail the parse.
+	if err := (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(raw, &dump); err != nil {
+		return nil, fmt.Errorf("unmarshal config_dump envelope: %w", err)
+	}
+
+	out := &ConfigDump{ErrorStates: map[string][]string{}}
+
+	for i, cfgAny := range dump.GetConfigs() {
+		msg, err := cfgAny.UnmarshalNew()
+		if err != nil {
+			return nil, fmt.Errorf("unmarshal config_dump section %d (%s): %w", i, cfgAny.GetTypeUrl(), err)
+		}
+		switch section := msg.(type) {
+		case *adminv3.ClustersConfigDump:
+			if err := out.absorbClusters(section); err != nil {
+				return nil, err
+			}
+		case *adminv3.RoutesConfigDump:
+			if err := out.absorbRoutes(section); err != nil {
+				return nil, err
+			}
+		case *adminv3.ListenersConfigDump:
+			if err := out.absorbListeners(section); err != nil {
+				return nil, err
+			}
+		case *adminv3.SecretsConfigDump:
+			out.absorbSecrets(section)
+		default:
+			// Other sections aren't needed by the scanners.
+		}
+	}
+	return out, nil
+}
+
+func (d *ConfigDump) absorbClusters(s *adminv3.ClustersConfigDump) error {
+	for _, dc := range s.GetDynamicActiveClusters() {
+		if es := dc.GetErrorState(); es != nil {
+			d.ErrorStates["cluster"] = append(d.ErrorStates["cluster"], es.GetDetails())
+		}
+		cl := &clusterv3.Cluster{}
+		if err := unwrap(dc.GetCluster(), cl); err != nil {
+			return fmt.Errorf("unwrap dynamic cluster: %w", err)
+		}
+		if cl.GetName() != "" {
+			d.Clusters = append(d.Clusters, cl)
+		}
+	}
+	// Clusters still being applied may carry rejection details too.
+	for _, dc := range s.GetDynamicWarmingClusters() {
+		if es := dc.GetErrorState(); es != nil {
+			d.ErrorStates["cluster"] = append(d.ErrorStates["cluster"], es.GetDetails())
+		}
+	}
+	return nil
+}
+
+func (d *ConfigDump) absorbRoutes(s *adminv3.RoutesConfigDump) error {
+	for _, dr := range s.GetDynamicRouteConfigs() {
+		if es := dr.GetErrorState(); es != nil {
+			d.ErrorStates["route"] = append(d.ErrorStates["route"], es.GetDetails())
+		}
+		rc := &routev3.RouteConfiguration{}
+		if err := unwrap(dr.GetRouteConfig(), rc); err != nil {
+			return fmt.Errorf("unwrap dynamic route config: %w", err)
+		}
+		if rc.GetName() != "" {
+			d.Routes = append(d.Routes, rc)
+		}
+	}
+	return nil
+}
+
+func (d *ConfigDump) absorbListeners(s *adminv3.ListenersConfigDump) error {
+	for _, dl := range s.GetDynamicListeners() {
+		if es := dl.GetErrorState(); es != nil {
+			d.ErrorStates["listener"] = append(d.ErrorStates["listener"], es.GetDetails())
+		}
+		// Scan the listener the proxy is currently serving, not one still being
+		// applied.
+		active := dl.GetActiveState()
+		if active == nil {
+			continue
+		}
+		l := &listenerv3.Listener{}
+		if err := unwrap(active.GetListener(), l); err != nil {
+			return fmt.Errorf("unwrap dynamic listener: %w", err)
+		}
+		if l.GetName() != "" {
+			d.Listeners = append(d.Listeners, l)
+		}
+	}
+	return nil
+}
+
+func (d *ConfigDump) absorbSecrets(s *adminv3.SecretsConfigDump) {
+	for _, ds := range s.GetDynamicActiveSecrets() {
+		if es := ds.GetErrorState(); es != nil {
+			d.ErrorStates["secret"] = append(d.ErrorStates["secret"], es.GetDetails())
+		}
+		if n := ds.GetName(); n != "" {
+			d.SecretNames = append(d.SecretNames, n)
+		}
+	}
+}
+
+// unwrap decodes a wrapped resource into dst. A nil input is not an error (the
+// resource is simply absent); dst is left zero.
+func unwrap(a *anypb.Any, dst proto.Message) error {
+	if a == nil {
+		return nil
+	}
+	return a.UnmarshalTo(dst)
+}
diff --git a/test/parity/configdump_test.go b/test/parity/configdump_test.go
new file mode 100644
index 00000000..68085fdc
--- /dev/null
+++ b/test/parity/configdump_test.go
@@ -0,0 +1,185 @@
+package parity
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	adminv3 "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	internalupstreamv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/internal_upstream/v3"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/structpb"
+)
+
+func mustAny(t *testing.T, m proto.Message) *anypb.Any {
+	t.Helper()
+	a, err := anypb.New(m)
+	require.NoError(t, err)
+	return a
+}
+
+// buildSyntheticDump builds a proxy configuration that looks like the real
+// thing, so parsing and scanning can be exercised without a live cluster.
+func buildSyntheticDump(t *testing.T, corazaFilter string) []byte {
+	t.Helper()
+
+	// --- WAF-governed route + CONNECT route ---
+	wafMeta, err := structpb.NewStruct(map[string]any{
+		"resources": []any{map[string]any{
+			"kind": "TrafficProtectionPolicy", "namespace": "proj-ns", "name": "test-tpp", "mode": "Observe",
+		}},
+	})
+	require.NoError(t, err)
+	rc := &routev3.RouteConfiguration{
+		Name: "gw/https",
+		VirtualHosts: []*routev3.VirtualHost{{
+			Name:    "vh",
+			Domains: []string{"app.example.com", "vh.connector.internal"},
+			Routes: []*routev3.Route{
+				{
+					Name: "connector-connect-vh",
+					Action: &routev3.Route_Route{Route: &routev3.RouteAction{
+						UpgradeConfigs: []*routev3.RouteAction_UpgradeConfig{{UpgradeType: "CONNECT"}},
+					}},
+				},
+				{
+					Name:     "fwd",
+					Metadata: &corev3.Metadata{FilterMetadata: map[string]*structpb.Struct{datumGatewayMetaKey: wafMeta}},
+				},
+			},
+		}},
+	}
+
+	// --- replaced connector cluster ---
+	ts := mustAny(t, &internalupstreamv3.InternalUpstreamTransport{})
+	cl := &clusterv3.Cluster{
+		Name:                 "httproute/proj-ns/proxy/rule/0",
+		ClusterDiscoveryType: &clusterv3.Cluster_Type{Type: clusterv3.Cluster_STATIC},
+		LoadAssignment:       &endpointv3.ClusterLoadAssignment{ClusterName: "httproute/proj-ns/proxy/rule/0"},
+		TransportSocket: &corev3.TransportSocket{
+			Name:       connectorInternalTransport,
+			ConfigType: &corev3.TransportSocket_TypedConfig{TypedConfig: ts},
+		},
+	}
+	infraCl := &clusterv3.Cluster{
+		Name:                 "infra",
+		ClusterDiscoveryType: &clusterv3.Cluster_Type{Type: clusterv3.Cluster_EDS},
+	}
+
+	// --- listener with the firewall and a custom error page ---
+	hcm := &hcmv3.HttpConnectionManager{
+		RouteSpecifier:   &hcmv3.HttpConnectionManager_Rds{Rds: &hcmv3.Rds{RouteConfigName: "gw/https"}},
+		HttpFilters:      []*hcmv3.HttpFilter{{Name: corazaFilter, Disabled: true}, {Name: "envoy.filters.http.router"}},
+		LocalReplyConfig: &hcmv3.LocalReplyConfig{},
+	}
+	l := &listenerv3.Listener{
+		Name: "gw/https",
+		FilterChains: []*listenerv3.FilterChain{{
+			Name: "fc",
+			Filters: []*listenerv3.Filter{{
+				Name:       hcmNetworkFilterName,
+				ConfigType: &listenerv3.Filter_TypedConfig{TypedConfig: mustAny(t, hcm)},
+			}},
+		}},
+	}
+
+	dump := &adminv3.ConfigDump{
+		Configs: []*anypb.Any{
+			mustAny(t, &adminv3.ClustersConfigDump{
+				DynamicActiveClusters: []*adminv3.ClustersConfigDump_DynamicCluster{
+					{Cluster: mustAny(t, cl)},
+					{Cluster: mustAny(t, infraCl)},
+				},
+			}),
+			mustAny(t, &adminv3.RoutesConfigDump{
+				DynamicRouteConfigs: []*adminv3.RoutesConfigDump_DynamicRouteConfig{{RouteConfig: mustAny(t, rc)}},
+			}),
+			mustAny(t, &adminv3.ListenersConfigDump{
+				DynamicListeners: []*adminv3.ListenersConfigDump_DynamicListener{
+					{Name: "gw/https", ActiveState: &adminv3.ListenersConfigDump_DynamicListenerState{Listener: mustAny(t, l)}},
+				},
+			}),
+			mustAny(t, &adminv3.SecretsConfigDump{
+				DynamicActiveSecrets: []*adminv3.SecretsConfigDump_DynamicSecret{{Name: "good-cert"}},
+			}),
+		},
+	}
+
+	raw, err := protojson.Marshal(dump)
+	require.NoError(t, err)
+	return raw
+}
+
+func TestParseAndScan_EndToEnd(t *testing.T) {
+	const corazaFilter = "coraza-waf"
+	raw := buildSyntheticDump(t, corazaFilter)
+
+	dump, err := ParseConfigDump(raw)
+	require.NoError(t, err)
+
+	assert.Len(t, dump.Clusters, 2)
+	assert.Len(t, dump.Routes, 1)
+	assert.Len(t, dump.Listeners, 1)
+	assert.Equal(t, []string{"good-cert"}, dump.SecretNames)
+
+	act := ScanActual(dump, corazaFilter, nil)
+	assert.Equal(t, []string{wafRouteKey("gw/https", "vh", "fwd", "proj-ns", "test-tpp", "Observe")},
+		normalize(act.Keys[FamilyWAFRoute]))
+	assert.Equal(t, []string{"httproute/proj-ns/proxy/rule/0"}, normalize(act.Keys[FamilyConnectorCluster]))
+	assert.Equal(t, []string{connectorRouteKey("gw/https", "vh", "connector-connect-vh")},
+		normalize(act.Keys[FamilyConnectorRoute]))
+	assert.Equal(t, []string{listenerChainKey("gw/https", "fc")}, normalize(act.Keys[FamilyWAFHCM]))
+	assert.Equal(t, []string{listenerChainKey("gw/https", "fc")}, normalize(act.Keys[FamilyLocalReply]))
+}
+
+// TestParseAndScan_FullParity is the integration shape: the same key formats are
+// produced by the (simulated) ext-server side and the dump side, so Compare
+// returns OK — proving the two sides are in lockstep.
+func TestParseAndScan_FullParity(t *testing.T) {
+	const corazaFilter = "coraza-waf"
+	raw := buildSyntheticDump(t, corazaFilter)
+	dump, err := ParseConfigDump(raw)
+	require.NoError(t, err)
+	act := ScanActual(dump, corazaFilter, nil)
+
+	// Expected derived from the same artifact set (as the programmed-set endpoint
+	// would report it).
+	expected := exp(map[Family][]string{
+		FamilyWAFRoute:         {wafRouteKey("gw/https", "vh", "fwd", "proj-ns", "test-tpp", "Observe")},
+		FamilyConnectorCluster: {"httproute/proj-ns/proxy/rule/0"},
+		FamilyConnectorRoute:   {connectorRouteKey("gw/https", "vh", "connector-connect-vh")},
+		FamilyWAFHCM:           {listenerChainKey("gw/https", "fc")},
+		FamilyLocalReply:       {listenerChainKey("gw/https", "fc")},
+	})
+
+	rep := Compare(expected, act)
+	rep.AssertOK(t)
+}
+
+// TestParseConfigDump_NACKErrorState covers a single resource the proxy
+// rejected while keeping the rest.
+func TestParseConfigDump_NACKErrorState(t *testing.T) {
+	dump := &adminv3.ConfigDump{Configs: []*anypb.Any{
+		mustAny(t, &adminv3.ListenersConfigDump{
+			DynamicListeners: []*adminv3.ListenersConfigDump_DynamicListener{
+				{Name: "bad", ErrorState: &adminv3.UpdateFailureState{Details: "KEY_VALUES_MISMATCH"}},
+			},
+		}),
+	}}
+	raw, err := protojson.Marshal(dump)
+	require.NoError(t, err)
+
+	parsed, err := ParseConfigDump(raw)
+	require.NoError(t, err)
+	require.Contains(t, parsed.ErrorStates, "listener")
+	assert.Contains(t, parsed.ErrorStates["listener"][0], "KEY_VALUES_MISMATCH")
+}
diff --git a/test/parity/fetch.go b/test/parity/fetch.go
new file mode 100644
index 00000000..95da96f4
--- /dev/null
+++ b/test/parity/fetch.go
@@ -0,0 +1,272 @@
+package parity
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+)
+
+// Fetcher retrieves a response body from an endpoint. It is an interface because
+// different environments reach the proxy differently: some can make a plain HTTP
+// request, others must tunnel into the proxy pod first.
+type Fetcher interface {
+	Fetch(ctx context.Context, path string) ([]byte, error)
+}
+
+// HTTPFetcher fetches over plain HTTP from a base URL, for endpoints reachable
+// directly without tunneling into a pod.
+type HTTPFetcher struct {
+	BaseURL string // e.g. "http://127.0.0.1:19000"
+	Client  *http.Client
+}
+
+func (h HTTPFetcher) Fetch(ctx context.Context, path string) ([]byte, error) {
+	client := h.Client
+	if client == nil {
+		client = http.DefaultClient
+	}
+	url := strings.TrimRight(h.BaseURL, "/") + path
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("GET %s: %w", url, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("read %s: %w", url, err)
+	}
+	if resp.StatusCode/100 != 2 {
+		return nil, fmt.Errorf("GET %s: status %d: %s", url, resp.StatusCode, snippet(body))
+	}
+	return body, nil
+}
+
+// FetchExpected reads the configuration the extension server says it intended to
+// program, which is the reference we compare the live proxy against.
+func FetchExpected(ctx context.Context, extFetcher Fetcher) (Expected, error) {
+	body, err := extFetcher.Fetch(ctx, ProgrammedSetPath)
+	if err != nil {
+		return Expected{}, fmt.Errorf("fetch programmed-set: %w", err)
+	}
+	var exp Expected
+	if err := json.Unmarshal(body, &exp); err != nil {
+		return Expected{}, fmt.Errorf("decode programmed-set JSON: %w", err)
+	}
+	if exp.Keys == nil {
+		exp.Keys = map[Family][]string{}
+	}
+	if exp.Counts == nil {
+		exp.Counts = map[Family]int{}
+	}
+	return exp, nil
+}
+
+// ProgrammedSetPath is duplicated from the extension server rather than imported
+// so this package stays free of any internal/ dependency; the two MUST stay in sync.
+const ProgrammedSetPath = "/debug/programmed-set"
+
+// ExpectedSource pairs a fetched Expected set with the replica it came from, so
+// the caller can report which replica was authoritative.
+type ExpectedSource struct {
+	Replica  string
+	Expected Expected
+}
+
+// FetchExpectedFromMany queries every extension server replica and returns the
+// authoritative one. Only one replica actually builds configuration at a time,
+// so querying a fixed replica can hit an idle one and falsely report missing or
+// stale configuration.
+//
+// The replica with the highest build count wins, since that count only ever
+// increases on the replica doing the work and idle replicas sit at zero. A tie
+// (no replica has built yet) resolves to the first replica so the caller still
+// gets a valid empty result instead of an error.
+//
+// An unreachable replica is skipped rather than fatal, as long as at least one
+// replica answered; its error is returned for diagnosis.
+func FetchExpectedFromMany(ctx context.Context, fetchers map[string]Fetcher) (ExpectedSource, map[string]error, error) {
+	if len(fetchers) == 0 {
+		return ExpectedSource{}, nil, fmt.Errorf("no ext-server replicas to query")
+	}
+
+	errs := map[string]error{}
+	var best *ExpectedSource
+	// Stable order so ties resolve deterministically.
+	for _, replica := range sortedKeys(fetchers) {
+		exp, err := FetchExpected(ctx, fetchers[replica])
+		if err != nil {
+			errs[replica] = err
+			continue
+		}
+		src := ExpectedSource{Replica: replica, Expected: exp}
+		if best == nil || exp.BuildID > best.Expected.BuildID {
+			s := src
+			best = &s
+		}
+	}
+
+	if best == nil {
+		return ExpectedSource{}, errs, fmt.Errorf("all %d ext-server replicas failed to answer", len(fetchers))
+	}
+	return *best, errs, nil
+}
+
+// sortedKeys returns the map keys sorted, for deterministic iteration.
+func sortedKeys(m map[string]Fetcher) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// FetchActual reads the proxy's live configuration and scans it for the
+// artifacts of each change family. corazaFilterName identifies the firewall
+// filter; droppedSecrets names the TLS certificates that should have been
+// removed, so we can confirm none are still present.
+//
+// adminFetcher reaches the proxy; extFetcher reaches the extension server to
+// check whether any update was too large to deliver. Pass a nil extFetcher to
+// skip that check.
+func FetchActual(
+	ctx context.Context,
+	adminFetcher Fetcher,
+	extFetcher Fetcher,
+	corazaFilterName string,
+	droppedSecrets []string,
+) (Actual, *ConfigDump, error) {
+	dumpRaw, err := adminFetcher.Fetch(ctx, "/config_dump")
+	if err != nil {
+		return Actual{}, nil, fmt.Errorf("fetch config_dump: %w", err)
+	}
+	dump, err := ParseConfigDump(dumpRaw)
+	if err != nil {
+		return Actual{}, nil, err
+	}
+
+	act := ScanActual(dump, corazaFilterName, droppedSecrets)
+
+	// Counts of updates the proxy rejected.
+	statsRaw, err := adminFetcher.Fetch(ctx, "/stats?format=prometheus")
+	if err != nil {
+		// Best-effort: the comparison still works without these counts, so a
+		// failure here yields an empty map rather than aborting.
+		statsRaw = nil
+	}
+	act.XDSRejected = scrapeXDSRejected(statsRaw)
+
+	// Whether any update was too large to deliver.
+	if extFetcher != nil {
+		if metricsRaw, mErr := extFetcher.Fetch(ctx, "/metrics"); mErr == nil {
+			act.ResourceExhausted = scrapeResourceExhausted(metricsRaw)
+		}
+	}
+	return act, dump, nil
+}
+
+// snippet returns the first line of b for error messages.
+func snippet(b []byte) string {
+	s := string(b)
+	if i := strings.IndexByte(s, '\n'); i >= 0 {
+		s = s[:i]
+	}
+	if len(s) > 200 {
+		s = s[:200] + "..."
+	}
+	return s
+}
+
+// scrapeXDSRejected sums the proxy's rejected-update counters, grouped by the
+// kind of configuration. Route counters are per-route so they are matched by
+// substring rather than exact name.
+func scrapeXDSRejected(stats []byte) map[string]int {
+	out := map[string]int{}
+	if len(stats) == 0 {
+		return out
+	}
+	for line := range strings.SplitSeq(string(stats), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		if !strings.Contains(line, "update_rejected") {
+			continue
+		}
+		name, val := splitMetricLine(line)
+		if val == 0 {
+			continue
+		}
+		fam := classifyXDS(name)
+		out[fam] += val
+	}
+	return out
+}
+
+// classifyXDS groups a metric by the kind of configuration it counts. The
+// proxy rewrites dots to underscores in metric names, so we match on substrings.
+func classifyXDS(name string) string {
+	switch {
+	case strings.Contains(name, "lds"):
+		return "lds"
+	case strings.Contains(name, "cds"):
+		return "cds"
+	case strings.Contains(name, "rds"):
+		return "rds"
+	case strings.Contains(name, "sds"):
+		return "sds"
+	default:
+		return "other"
+	}
+}
+
+// scrapeResourceExhausted counts how often the extension server failed to
+// deliver an update because it was too large. A non-zero result means
+// configuration was truncated.
+func scrapeResourceExhausted(metrics []byte) int {
+	if len(metrics) == 0 {
+		return 0
+	}
+	total := 0
+	for line := range strings.SplitSeq(string(metrics), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		if !strings.HasPrefix(line, "grpc_server_handled_total") {
+			continue
+		}
+		if !strings.Contains(line, `grpc_code="ResourceExhausted"`) {
+			continue
+		}
+		_, val := splitMetricLine(line)
+		total += val
+	}
+	return total
+}
+
+// splitMetricLine parses one metrics line "name{labels} value" into the name
+// (without labels) and the integer value (floats are truncated; non-numeric
+// yields 0).
+func splitMetricLine(line string) (name string, value int) {
+	fields := strings.Fields(line)
+	if len(fields) < 2 {
+		return "", 0
+	}
+	valStr := fields[len(fields)-1]
+	nameWithLabels := strings.Join(fields[:len(fields)-1], " ")
+	name, _, _ = strings.Cut(nameWithLabels, "{")
+	if f, err := strconv.ParseFloat(valStr, 64); err == nil {
+		value = int(f)
+	}
+	return name, value
+}
diff --git a/test/parity/fetch_test.go b/test/parity/fetch_test.go
new file mode 100644
index 00000000..2ec8d1ea
--- /dev/null
+++ b/test/parity/fetch_test.go
@@ -0,0 +1,90 @@
+package parity
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stubFetcher returns a fixed programmed-set JSON body (or error) for the
+// programmed-set path. Models one ext-server replica.
+type stubFetcher struct {
+	buildID int
+	err     error
+}
+
+func (s stubFetcher) Fetch(_ context.Context, path string) ([]byte, error) {
+	if s.err != nil {
+		return nil, s.err
+	}
+	if path != ProgrammedSetPath {
+		return nil, fmt.Errorf("unexpected path %s", path)
+	}
+	body := fmt.Sprintf(`{"buildID":%d,"keys":{"waf_route":["k%d"]},"counts":{"waf_route":1}}`,
+		s.buildID, s.buildID)
+	return []byte(body), nil
+}
+
+// TestFetchExpectedFromMany_PicksHighestBuildID is the core multi-replica rule:
+// EG pins its gRPC connection to one replica, so only that pod has the real
+// (highest-BuildID) programmed-set; the idle replica sits at 0.
+func TestFetchExpectedFromMany_PicksHighestBuildID(t *testing.T) {
+	fetchers := map[string]Fetcher{
+		"ext-replica-a": stubFetcher{buildID: 0}, // idle replica
+		"ext-replica-b": stubFetcher{buildID: 7}, // active replica
+	}
+	src, errs, err := FetchExpectedFromMany(context.Background(), fetchers)
+	require.NoError(t, err)
+	assert.Empty(t, errs)
+	assert.Equal(t, "ext-replica-b", src.Replica, "must pick the active (highest-BuildID) replica")
+	assert.Equal(t, uint64(7), src.Expected.BuildID)
+	assert.Equal(t, []string{"k7"}, src.Expected.Keys[FamilyWAFRoute])
+}
+
+// TestFetchExpectedFromMany_OneUnreachable: one replica down is not fatal as
+// long as another answers; the error is surfaced, not returned.
+func TestFetchExpectedFromMany_OneUnreachable(t *testing.T) {
+	fetchers := map[string]Fetcher{
+		"ext-replica-a": stubFetcher{err: errors.New("connection refused")},
+		"ext-replica-b": stubFetcher{buildID: 3},
+	}
+	src, errs, err := FetchExpectedFromMany(context.Background(), fetchers)
+	require.NoError(t, err)
+	assert.Equal(t, "ext-replica-b", src.Replica)
+	require.Contains(t, errs, "ext-replica-a")
+	assert.ErrorContains(t, errs["ext-replica-a"], "connection refused")
+}
+
+// TestFetchExpectedFromMany_AllFail returns an error only when no replica answers.
+func TestFetchExpectedFromMany_AllFail(t *testing.T) {
+	fetchers := map[string]Fetcher{
+		"a": stubFetcher{err: errors.New("down")},
+		"b": stubFetcher{err: errors.New("down")},
+	}
+	_, errs, err := FetchExpectedFromMany(context.Background(), fetchers)
+	require.Error(t, err)
+	assert.Len(t, errs, 2)
+}
+
+// TestFetchExpectedFromMany_TieResolvesDeterministically: both at 0 (no build
+// anywhere yet) resolves to the first replica in sorted order, returning a
+// well-formed empty Expected rather than an error.
+func TestFetchExpectedFromMany_TieResolvesDeterministically(t *testing.T) {
+	fetchers := map[string]Fetcher{
+		"ext-z": stubFetcher{buildID: 0},
+		"ext-a": stubFetcher{buildID: 0},
+	}
+	src, _, err := FetchExpectedFromMany(context.Background(), fetchers)
+	require.NoError(t, err)
+	assert.Equal(t, "ext-a", src.Replica, "ties resolve to the first replica in sorted order")
+	assert.Equal(t, uint64(0), src.Expected.BuildID)
+}
+
+func TestFetchExpectedFromMany_Empty(t *testing.T) {
+	_, _, err := FetchExpectedFromMany(context.Background(), nil)
+	require.Error(t, err)
+}
diff --git a/test/parity/parity.go b/test/parity/parity.go
new file mode 100644
index 00000000..26ee8198
--- /dev/null
+++ b/test/parity/parity.go
@@ -0,0 +1,313 @@
+// Package parity answers one question: is the edge proxy actually running the
+// configuration the platform tried to give it? A successful-looking request can
+// hide configuration that never applied, applied only partly, or applied in the
+// wrong place — so we compare what was intended against what the proxy is live
+// serving and name the gap, turning a surprising result into a cause instead of
+// a guess.
+package parity
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// Family groups one kind of edge change so intended and live can be compared
+// kind by kind. The values match the names the extension server reports, so its
+// output decodes straight into these.
+type Family string
+
+const (
+	FamilyWAFRoute         Family = "waf_route"
+	FamilyWAFHCM           Family = "waf_hcm"
+	FamilyLocalReply       Family = "local_reply"
+	FamilyConnectorCluster Family = "connector_cluster"
+	FamilyConnectorRoute   Family = "connector_route"
+	FamilyConnectorOffline Family = "connector_offline"
+	FamilyTLSPrune         Family = "tls_prune"
+)
+
+// AllFamilies is the canonical iteration order for reports.
+var AllFamilies = []Family{
+	FamilyWAFRoute, FamilyWAFHCM, FamilyLocalReply,
+	FamilyConnectorCluster, FamilyConnectorRoute, FamilyConnectorOffline,
+	FamilyTLSPrune,
+}
+
+// FailureClass names how a comparison differed. The values are stable because
+// reports and logs are read by people and tooling outside this package.
+type FailureClass string
+
+const (
+	ClassOK                FailureClass = "OK"
+	ClassMissing           FailureClass = "MISSING"
+	ClassCountMismatch     FailureClass = "COUNT_MISMATCH"
+	ClassWrongKeyed        FailureClass = "WRONG_KEYED"
+	ClassNACK              FailureClass = "NACK"
+	ClassCeilingTruncation FailureClass = "CEILING_TRUNCATION"
+)
+
+// Expected is the set of changes the extension server reports it last applied.
+type Expected struct {
+	BuildID                uint64              `json:"buildID"`
+	Keys                   map[Family][]string `json:"keys"`
+	Counts                 map[Family]int      `json:"counts"`
+	TLSPrunedChains        int                 `json:"tlsPrunedChains"`
+	TLSPrunedSecrets       int                 `json:"tlsPrunedSecrets"`
+	TLSListenersLeftIntact int                 `json:"tlsListenersLeftIntact"`
+}
+
+// Actual is what the edge proxy is really running, read back from its live
+// configuration and its record of rejected or undelivered updates.
+type Actual struct {
+	// Keys must be formatted exactly as the extension server formats them, so the
+	// two sides can be compared as sets.
+	Keys map[Family][]string
+	// Certificates the extension server says it removed that are still present on
+	// the proxy — a removal that didn't take effect.
+	TLSDroppedSecretsStillPresent []string
+	// Updates the proxy rejected, by kind. Any rejection means the proxy kept
+	// older configuration instead.
+	XDSRejected map[string]int
+	// Count of updates too large to deliver, which the proxy silently never sees.
+	ResourceExhausted int
+}
+
+// FamilyResult is one family's comparison outcome.
+type FamilyResult struct {
+	Family        Family       `json:"family"`
+	Class         FailureClass `json:"class"`
+	ExpectedCount int          `json:"expectedCount"`
+	ActualCount   int          `json:"actualCount"`
+	// Expected but absent from the proxy.
+	MissingKeys []string `json:"missingKeys,omitempty"`
+	// Present on the proxy but not expected — the other side of a wrong-place match.
+	UnexpectedKeys []string `json:"unexpectedKeys,omitempty"`
+	// Plain-language explanation for differences that aren't about keys.
+	Detail string `json:"detail,omitempty"`
+}
+
+// ParityReport is the full result of a comparison — never just pass/fail, so a
+// reader can see which change differed, how, and the specific keys involved.
+type ParityReport struct {
+	ExpectedBuildID uint64         `json:"expectedBuildID"`
+	Families        []FamilyResult `json:"families"`
+	// Update kinds the proxy rejected.
+	XDSRejections map[string]int `json:"xdsRejections,omitempty"`
+	// Non-zero when updates were too large to deliver.
+	ResourceExhausted int `json:"resourceExhausted,omitempty"`
+}
+
+// OK reports whether everything matched and the proxy accepted every update.
+func (r ParityReport) OK() bool {
+	if len(r.XDSRejections) > 0 || r.ResourceExhausted > 0 {
+		return false
+	}
+	for _, f := range r.Families {
+		if f.Class != ClassOK {
+			return false
+		}
+	}
+	return true
+}
+
+// Failures lists every problem — mismatched changes plus any rejected or
+// undelivered updates — so a caller can show them all at once.
+func (r ParityReport) Failures() []FamilyResult {
+	var out []FamilyResult
+	for _, f := range r.Families {
+		if f.Class != ClassOK {
+			out = append(out, f)
+		}
+	}
+	for xds, n := range r.XDSRejections {
+		out = append(out, FamilyResult{
+			Class:  ClassNACK,
+			Detail: fmt.Sprintf("xDS %s update_rejected=%d (Envoy rejected the snapshot)", xds, n),
+		})
+	}
+	if r.ResourceExhausted > 0 {
+		out = append(out, FamilyResult{
+			Class:  ClassCeilingTruncation,
+			Detail: fmt.Sprintf("ext-server gRPC ResourceExhausted=%d (message-ceiling truncation)", r.ResourceExhausted),
+		})
+	}
+	return out
+}
+
+// AssertOK fails the test with the full report when the comparison did not pass.
+func (r ParityReport) AssertOK(t testing.TB) {
+	t.Helper()
+	if !r.OK() {
+		t.Errorf("config-dump parity gate FAILED:\n%s", r.String())
+	}
+}
+
+// String renders a compact, readable summary.
+func (r ParityReport) String() string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "parity report (expected build %d): %s\n", r.ExpectedBuildID, statusWord(r.OK()))
+	for _, f := range r.Families {
+		fmt.Fprintf(&b, "  %-18s %-15s expected=%d actual=%d", f.Family, f.Class, f.ExpectedCount, f.ActualCount)
+		if len(f.MissingKeys) > 0 {
+			fmt.Fprintf(&b, " missing=%v", truncateKeys(f.MissingKeys))
+		}
+		if len(f.UnexpectedKeys) > 0 {
+			fmt.Fprintf(&b, " unexpected=%v", truncateKeys(f.UnexpectedKeys))
+		}
+		if f.Detail != "" {
+			fmt.Fprintf(&b, " (%s)", f.Detail)
+		}
+		b.WriteByte('\n')
+	}
+	for xds, n := range r.XDSRejections {
+		fmt.Fprintf(&b, "  NACK: xDS %s update_rejected=%d\n", xds, n)
+	}
+	if r.ResourceExhausted > 0 {
+		fmt.Fprintf(&b, "  CEILING_TRUNCATION: gRPC ResourceExhausted=%d\n", r.ResourceExhausted)
+	}
+	return b.String()
+}
+
+func statusWord(ok bool) string {
+	if ok {
+		return "PASS"
+	}
+	return "FAIL"
+}
+
+// truncateKeys caps a key list for log readability.
+func truncateKeys(keys []string) []string {
+	const max = 5
+	if len(keys) <= max {
+		return keys
+	}
+	out := append([]string{}, keys[:max]...)
+	return append(out, fmt.Sprintf("...(+%d more)", len(keys)-max))
+}
+
+// Compare diffs intended against live and classifies each kind of change. The
+// key-by-key match is the important one: it is the only way to catch a change
+// that quietly applied to the wrong place.
+func Compare(exp Expected, act Actual) ParityReport {
+	report := ParityReport{ExpectedBuildID: exp.BuildID}
+
+	for _, fam := range AllFamilies {
+		report.Families = append(report.Families, compareFamily(fam, exp, act))
+	}
+
+	// Record any updates the proxy rejected.
+	for xds, n := range act.XDSRejected {
+		if n > 0 {
+			if report.XDSRejections == nil {
+				report.XDSRejections = map[string]int{}
+			}
+			report.XDSRejections[xds] = n
+		}
+	}
+	report.ResourceExhausted = act.ResourceExhausted
+	return report
+}
+
+// compareFamily classifies one kind of change. Removed certificates are the
+// exception: success there means the certificate is gone, so its "actual" is how
+// many that should be absent are still present.
+func compareFamily(fam Family, exp Expected, act Actual) FamilyResult {
+	if fam == FamilyTLSPrune {
+		return compareTLSPrune(exp, act)
+	}
+
+	expKeys := normalize(exp.Keys[fam])
+	actKeys := normalize(act.Keys[fam])
+	res := FamilyResult{
+		Family:        fam,
+		ExpectedCount: len(expKeys),
+		ActualCount:   len(actKeys),
+	}
+
+	switch {
+	case len(expKeys) == 0:
+		// Nothing expected — any actual is not this gate's concern (the gate
+		// asserts what the ext-server INTENDED is present, not the inverse).
+		res.Class = ClassOK
+	case len(actKeys) == 0:
+		res.Class = ClassMissing
+		res.MissingKeys = expKeys
+		res.Detail = "expected mutations but the config_dump carries none (inert / never-applied)"
+	case len(actKeys) < len(expKeys):
+		res.Class = ClassCountMismatch
+		res.MissingKeys = setDiff(expKeys, actKeys)
+		res.Detail = "config_dump carries fewer than expected (truncated / partial publish)"
+	default:
+		missing := setDiff(expKeys, actKeys)
+		if len(missing) == 0 {
+			res.Class = ClassOK
+		} else {
+			// Right number of changes, but not the ones we expected — something
+			// applied in the wrong place.
+			res.Class = ClassWrongKeyed
+			res.MissingKeys = missing
+			res.UnexpectedKeys = setDiff(actKeys, expKeys)
+			res.Detail = "expected key set not present in the config_dump (applied to wrong route/gateway)"
+		}
+	}
+	return res
+}
+
+// compareTLSPrune checks the opposite of the others: a certificate the extension
+// server says it removed must be gone from the proxy. One still present means the
+// removal never took effect.
+func compareTLSPrune(exp Expected, act Actual) FamilyResult {
+	res := FamilyResult{
+		Family:        FamilyTLSPrune,
+		ExpectedCount: exp.TLSPrunedSecrets,
+		ActualCount:   len(act.TLSDroppedSecretsStillPresent),
+	}
+	if exp.TLSPrunedSecrets == 0 {
+		res.Class = ClassOK
+		return res
+	}
+	if len(act.TLSDroppedSecretsStillPresent) > 0 {
+		res.Class = ClassMissing // a removal that didn't take effect
+		res.UnexpectedKeys = normalize(act.TLSDroppedSecretsStillPresent)
+		res.Detail = "pruned TLS secret(s) still present in the config_dump (prune did not take effect)"
+		return res
+	}
+	res.Class = ClassOK
+	return res
+}
+
+// normalize returns a sorted, de-duplicated copy of keys (nil-safe).
+func normalize(keys []string) []string {
+	if len(keys) == 0 {
+		return nil
+	}
+	seen := make(map[string]struct{}, len(keys))
+	out := make([]string, 0, len(keys))
+	for _, k := range keys {
+		if _, ok := seen[k]; ok {
+			continue
+		}
+		seen[k] = struct{}{}
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// setDiff returns the elements of a not present in b. Both inputs must be
+// normalized (sorted, deduped).
+func setDiff(a, b []string) []string {
+	bset := make(map[string]struct{}, len(b))
+	for _, x := range b {
+		bset[x] = struct{}{}
+	}
+	var out []string
+	for _, x := range a {
+		if _, ok := bset[x]; !ok {
+			out = append(out, x)
+		}
+	}
+	return out
+}
diff --git a/test/parity/parity_test.go b/test/parity/parity_test.go
new file mode 100644
index 00000000..762e9ef4
--- /dev/null
+++ b/test/parity/parity_test.go
@@ -0,0 +1,154 @@
+package parity
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func exp(keys map[Family][]string) Expected {
+	e := Expected{BuildID: 1, Keys: keys, Counts: map[Family]int{}}
+	for f, k := range keys {
+		e.Counts[f] = len(k)
+	}
+	return e
+}
+
+func actual(keys map[Family][]string) Actual {
+	return Actual{Keys: keys}
+}
+
+func TestCompare_OK(t *testing.T) {
+	keys := map[Family][]string{
+		FamilyWAFRoute:         {"rc##vh##fwd##ns/tpp/Observe"},
+		FamilyConnectorCluster: {"httproute/ns/proxy/rule/0"},
+	}
+	rep := Compare(exp(keys), actual(keys))
+	assert.True(t, rep.OK(), rep.String())
+}
+
+// TestCompare_WAFDisabledIsNotMissing covers the case where the firewall is
+// turned off: the extension server intended no firewall changes and the proxy
+// has none. That must pass — the comparison asks whether what was intended is
+// present, and nothing was intended.
+func TestCompare_WAFDisabledIsNotMissing(t *testing.T) {
+	want := map[Family][]string{
+		FamilyConnectorCluster: {"httproute/ns/proxy/rule/0"},
+		FamilyLocalReply:       {"l##fc"},
+	}
+	got := map[Family][]string{
+		FamilyConnectorCluster: {"httproute/ns/proxy/rule/0"},
+		FamilyLocalReply:       {"l##fc"},
+	}
+	rep := Compare(exp(want), actual(got))
+	assert.True(t, rep.OK(), rep.String())
+	assert.Equal(t, ClassOK, familyResult(t, rep, FamilyWAFRoute).Class, "zero-expected WAF route must be OK, not MISSING")
+	assert.Equal(t, ClassOK, familyResult(t, rep, FamilyWAFHCM).Class, "zero-expected WAF HCM must be OK, not MISSING")
+	assert.Equal(t, ClassOK, familyResult(t, rep, FamilyConnectorCluster).Class)
+	assert.Equal(t, ClassOK, familyResult(t, rep, FamilyLocalReply).Class)
+}
+
+func TestCompare_Missing(t *testing.T) {
+	want := map[Family][]string{FamilyWAFRoute: {"rc##vh##fwd##ns/tpp/Observe"}}
+	rep := Compare(exp(want), actual(nil))
+	r := familyResult(t, rep, FamilyWAFRoute)
+	assert.Equal(t, ClassMissing, r.Class)
+	assert.Equal(t, want[FamilyWAFRoute], r.MissingKeys)
+	assert.False(t, rep.OK())
+}
+
+func TestCompare_CountMismatch(t *testing.T) {
+	want := map[Family][]string{FamilyWAFRoute: {"a", "b", "c"}}
+	got := map[Family][]string{FamilyWAFRoute: {"a", "b"}}
+	rep := Compare(exp(want), actual(got))
+	r := familyResult(t, rep, FamilyWAFRoute)
+	assert.Equal(t, ClassCountMismatch, r.Class)
+	assert.Equal(t, []string{"c"}, r.MissingKeys)
+}
+
+// TestCompare_WrongKeyed covers the case only this comparison can catch: the
+// right number of changes, but applied to the wrong place.
+func TestCompare_WrongKeyed(t *testing.T) {
+	want := map[Family][]string{FamilyWAFRoute: {"rc##vh##fwd##nsA/tpp/Observe"}}
+	got := map[Family][]string{FamilyWAFRoute: {"rc##vh##fwd##nsB/tpp/Observe"}}
+	rep := Compare(exp(want), actual(got))
+	r := familyResult(t, rep, FamilyWAFRoute)
+	assert.Equal(t, ClassWrongKeyed, r.Class)
+	assert.Equal(t, r.ExpectedCount, r.ActualCount, "counts equal — count-only gate would pass")
+	assert.Equal(t, []string{"rc##vh##fwd##nsA/tpp/Observe"}, r.MissingKeys)
+	assert.Equal(t, []string{"rc##vh##fwd##nsB/tpp/Observe"}, r.UnexpectedKeys)
+}
+
+func TestCompare_NACK(t *testing.T) {
+	a := actual(nil)
+	a.XDSRejected = map[string]int{"lds": 1, "rds": 0}
+	rep := Compare(exp(nil), a)
+	assert.False(t, rep.OK())
+	require.Contains(t, rep.XDSRejections, "lds")
+	assert.NotContains(t, rep.XDSRejections, "rds", "zero-delta types must not be reported")
+}
+
+func TestCompare_CeilingTruncation(t *testing.T) {
+	a := actual(nil)
+	a.ResourceExhausted = 3
+	rep := Compare(exp(nil), a)
+	assert.False(t, rep.OK())
+	assert.Equal(t, 3, rep.ResourceExhausted)
+	classes := map[FailureClass]bool{}
+	for _, f := range rep.Failures() {
+		classes[f.Class] = true
+	}
+	assert.True(t, classes[ClassCeilingTruncation])
+}
+
+func TestCompareTLSPrune_NegativeAssertion(t *testing.T) {
+	e := Expected{BuildID: 1, Keys: map[Family][]string{}, Counts: map[Family]int{}, TLSPrunedSecrets: 2}
+
+	// Pass: no pruned secret remains in the dump.
+	rep := Compare(e, Actual{Keys: map[Family][]string{}})
+	assert.Equal(t, ClassOK, familyResult(t, rep, FamilyTLSPrune).Class)
+
+	// Fail: a pruned secret is still present.
+	a := Actual{Keys: map[Family][]string{}, TLSDroppedSecretsStillPresent: []string{"bad-cert"}}
+	rep2 := Compare(e, a)
+	r := familyResult(t, rep2, FamilyTLSPrune)
+	assert.Equal(t, ClassMissing, r.Class)
+	assert.Equal(t, []string{"bad-cert"}, r.UnexpectedKeys)
+}
+
+func familyResult(t *testing.T, rep ParityReport, fam Family) FamilyResult {
+	t.Helper()
+	for _, f := range rep.Families {
+		if f.Family == fam {
+			return f
+		}
+	}
+	t.Fatalf("family %s not in report", fam)
+	return FamilyResult{}
+}
+
+// --- stats scrape ---
+
+func TestScrapeXDSRejected(t *testing.T) {
+	stats := []byte(`
+# HELP envoy_listener_manager_lds_update_rejected
+envoy_listener_manager_lds_update_rejected 2
+envoy_cluster_manager_cds_update_rejected 0
+envoy_http_foo_rds_bar_update_rejected 1
+envoy_listener_manager_lds_update_success 40
+`)
+	got := scrapeXDSRejected(stats)
+	assert.Equal(t, 2, got["lds"])
+	assert.Equal(t, 1, got["rds"])
+	_, hasCDS := got["cds"]
+	assert.False(t, hasCDS, "zero-value counters must be skipped")
+}
+
+func TestScrapeResourceExhausted(t *testing.T) {
+	metrics := []byte(`
+grpc_server_handled_total{grpc_code="OK",grpc_method="PostTranslateModify"} 100
+grpc_server_handled_total{grpc_code="ResourceExhausted",grpc_method="PostTranslateModify"} 4
+`)
+	assert.Equal(t, 4, scrapeResourceExhausted(metrics))
+}
diff --git a/test/parity/register.go b/test/parity/register.go
new file mode 100644
index 00000000..eb2ef36b
--- /dev/null
+++ b/test/parity/register.go
@@ -0,0 +1,21 @@
+package parity
+
+// These message types can appear nested inside the proxy's configuration, and
+// each must be linked into the binary or parsing that configuration fails. Add
+// to this list whenever a new dump surfaces a type the parser can't resolve.
+import (
+	_ "github.com/cncf/xds/go/xds/type/v3"
+	_ "github.com/envoyproxy/go-control-plane/contrib/envoy/extensions/filters/http/golang/v3alpha"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/file/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/health_check/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/tls_inspector/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/tcp_proxy/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/load_balancing_policies/least_request/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/resource_monitors/downstream_connections/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/internal_upstream/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/raw_buffer/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3"
+)
diff --git a/test/parity/scan.go b/test/parity/scan.go
new file mode 100644
index 00000000..a5eaf59d
--- /dev/null
+++ b/test/parity/scan.go
@@ -0,0 +1,188 @@
+package parity
+
+import (
+	"strings"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+)
+
+// This file scans the proxy's live configuration for each kind of change and
+// emits an identity for every one it finds. These identity strings must match
+// the ones the extension server produces exactly, or the comparison is
+// meaningless; keep both sides in lockstep.
+
+const (
+	keySep = "##"
+
+	// Well-known marker strings, mirrored from where the configuration is written.
+	datumGatewayMetaKey        = "datum-gateway"
+	connectorInternalTransport = "envoy.transport_sockets.internal_upstream"
+	hcmNetworkFilterName       = "envoy.filters.network.http_connection_manager"
+	offlineBodyMarker          = "Tunnel not online"
+)
+
+// ScanActual scans the proxy's live configuration and assembles what it
+// actually found. corazaFilterName is the firewall filter name used to spot
+// firewall injection; droppedSecrets names the TLS certificates that should have
+// been removed.
+func ScanActual(dump *ConfigDump, corazaFilterName string, droppedSecrets []string) Actual {
+	act := Actual{Keys: map[Family][]string{}}
+
+	for _, rc := range dump.Routes {
+		scanRouteConfig(rc, &act)
+	}
+	for _, cl := range dump.Clusters {
+		if isReplacedConnectorCluster(cl) {
+			act.Keys[FamilyConnectorCluster] = append(act.Keys[FamilyConnectorCluster], cl.GetName())
+		}
+	}
+	for _, l := range dump.Listeners {
+		scanListener(l, corazaFilterName, &act)
+	}
+
+	// Flag any certificate that should have been removed but is still present.
+	if len(droppedSecrets) > 0 {
+		present := make(map[string]struct{}, len(dump.SecretNames))
+		for _, n := range dump.SecretNames {
+			present[n] = struct{}{}
+		}
+		for _, dropped := range droppedSecrets {
+			if _, ok := present[dropped]; ok {
+				act.TLSDroppedSecretsStillPresent = append(act.TLSDroppedSecretsStillPresent, dropped)
+			}
+		}
+	}
+	return act
+}
+
+func scanRouteConfig(rc *routev3.RouteConfiguration, act *Actual) {
+	rcName := rc.GetName()
+	for _, vh := range rc.GetVirtualHosts() {
+		vhName := vh.GetName()
+		for _, rt := range vh.GetRoutes() {
+			if ns, name, mode, ok := datumGatewayTPP(rt); ok {
+				act.Keys[FamilyWAFRoute] = append(act.Keys[FamilyWAFRoute],
+					wafRouteKey(rcName, vhName, rt.GetName(), ns, name, mode))
+			}
+			if isConnectRoute(rt) {
+				act.Keys[FamilyConnectorRoute] = append(act.Keys[FamilyConnectorRoute],
+					connectorRouteKey(rcName, vhName, rt.GetName()))
+			}
+			if isOfflineDirectResponse(rt) {
+				act.Keys[FamilyConnectorOffline] = append(act.Keys[FamilyConnectorOffline],
+					connectorRouteKey(rcName, vhName, rt.GetName()))
+			}
+		}
+	}
+}
+
+func scanListener(l *listenerv3.Listener, corazaFilterName string, act *Actual) {
+	lName := l.GetName()
+	eachHCM(l, func(chainName string, hcm *hcmv3.HttpConnectionManager) {
+		if corazaFilterName != "" && hcmHasFilterAtZero(hcm, corazaFilterName) {
+			act.Keys[FamilyWAFHCM] = append(act.Keys[FamilyWAFHCM], listenerChainKey(lName, chainName))
+		}
+		if hcm.GetLocalReplyConfig() != nil {
+			act.Keys[FamilyLocalReply] = append(act.Keys[FamilyLocalReply], listenerChainKey(lName, chainName))
+		}
+	})
+}
+
+// --- identity formats (MUST match the extension server) ---
+
+func wafRouteKey(rc, vh, rt, tppNS, tppName, mode string) string {
+	return strings.Join([]string{rc, vh, rt, tppNS + "/" + tppName + "/" + mode}, keySep)
+}
+
+func connectorRouteKey(rc, vh, rt string) string {
+	return strings.Join([]string{rc, vh, rt}, keySep)
+}
+
+func listenerChainKey(listener, chain string) string {
+	return strings.Join([]string{listener, chain}, keySep)
+}
+
+// --- detectors (mirror, in reverse, how the configuration is written) ---
+
+func datumGatewayTPP(rt *routev3.Route) (ns, name, mode string, ok bool) {
+	md := rt.GetMetadata()
+	if md == nil {
+		return "", "", "", false
+	}
+	dg := md.GetFilterMetadata()[datumGatewayMetaKey]
+	if dg == nil {
+		return "", "", "", false
+	}
+	res := dg.GetFields()["resources"].GetListValue()
+	if res == nil || len(res.GetValues()) == 0 {
+		return "", "", "", false
+	}
+	f := res.GetValues()[0].GetStructValue().GetFields()
+	return f["namespace"].GetStringValue(),
+		f["name"].GetStringValue(),
+		f["mode"].GetStringValue(),
+		true
+}
+
+func isConnectRoute(rt *routev3.Route) bool {
+	ra := rt.GetRoute()
+	if ra == nil {
+		return false
+	}
+	for _, uc := range ra.GetUpgradeConfigs() {
+		if strings.EqualFold(uc.GetUpgradeType(), "CONNECT") {
+			return true
+		}
+	}
+	return false
+}
+
+func isOfflineDirectResponse(rt *routev3.Route) bool {
+	dr := rt.GetDirectResponse()
+	if dr == nil {
+		return false
+	}
+	if dr.GetStatus() != 503 {
+		return false
+	}
+	return dr.GetBody().GetInlineString() == offlineBodyMarker
+}
+
+func isReplacedConnectorCluster(cl *clusterv3.Cluster) bool {
+	if cl.GetType() != clusterv3.Cluster_STATIC {
+		return false
+	}
+	return cl.GetTransportSocket().GetName() == connectorInternalTransport
+}
+
+func eachHCM(l *listenerv3.Listener, fn func(chainName string, hcm *hcmv3.HttpConnectionManager)) {
+	chains := make([]*listenerv3.FilterChain, 0, len(l.GetFilterChains())+1)
+	chains = append(chains, l.GetFilterChains()...)
+	if dfc := l.GetDefaultFilterChain(); dfc != nil {
+		chains = append(chains, dfc)
+	}
+	for _, fc := range chains {
+		for _, f := range fc.GetFilters() {
+			if f.GetName() != hcmNetworkFilterName {
+				continue
+			}
+			tc := f.GetTypedConfig()
+			if tc == nil {
+				continue
+			}
+			hcm := &hcmv3.HttpConnectionManager{}
+			if err := tc.UnmarshalTo(hcm); err != nil {
+				continue
+			}
+			fn(fc.GetName(), hcm)
+		}
+	}
+}
+
+func hcmHasFilterAtZero(hcm *hcmv3.HttpConnectionManager, filterName string) bool {
+	fs := hcm.GetHttpFilters()
+	return len(fs) > 0 && fs[0].GetName() == filterName
+}