# Chart-page claim-integrity audit (2026-06-22)

**UNOFFICIAL/EXPERIMENTAL.** Generated by `scripts/verify-chart-claim-integrity.mjs --report`; the same script run with `--verify` is the permanent gate (`npm run chart-claim-integrity:verify`). Each finding re-checks a chart-page claim against the receipt it cites.

**0 HARD + 25 warn finding(s) across 20 chart(s).** A HARD finding means a page claim is not backed by its own receipt — a false claim that should block release. WARN means a "supported" row co-exists with a missing lane (usually legitimate scoped support; confirm the wording).

## Findings by check

### supported-cites-cross-version-receipt (5)

- **WARN** `bitnami/mongodb` — decision for 19.0.7 cites a 19.1.0 receipt (version skew — confirm the doctrine derive-rule covers it) — runs/live-kind-parity/bitnami-mongodb-static-passwords/receipt.yaml
- **WARN** `bitnami/nginx` — decision for 24.0.2 cites a 25.0.0 receipt (version skew — confirm the doctrine derive-rule covers it) — runs/live-kind-parity/bitnami-nginx-http-clusterip/receipt.yaml
- **WARN** `bitnami/postgresql` — decision for 18.6.7 cites a 18.7.0 receipt (version skew — confirm the doctrine derive-rule covers it) — runs/live-kind-parity/bitnami-postgresql-static-passwords/receipt.yaml
- **WARN** `bitnami/redis` — decision for 25.5.3 cites a 27.0.0 receipt (version skew — confirm the doctrine derive-rule covers it) — runs/live-kind-parity/bitnami-redis-default/receipt.yaml
- **WARN** `prometheus-community/prometheus` — decision for 29.8.0 cites a 29.9.0 receipt (version skew — confirm the doctrine derive-rule covers it) — runs/live-kind-parity/prometheus-community-prometheus-server-only-ephemeral/receipt.yaml

### recommends-base-outside-supported-scope (9)

- **WARN** `bitnami/mongodb` — password caveat recommends base "existing-secret-replicaset" but the support decision covers only "static-passwords" — following the page's own advice steps off the supported base
- **WARN** `bitnami/mysql` — password caveat recommends base "existing-secret" but the support decision covers only "static-passwords" — following the page's own advice steps off the supported base
- **WARN** `bitnami/nginx` — password caveat recommends base "existing-tls-ingress" but the support decision covers only "http-clusterip" — following the page's own advice steps off the supported base
- **WARN** `bitnami/postgresql` — password caveat recommends base "existing-secret" but the support decision covers only "static-passwords" — following the page's own advice steps off the supported base
- **WARN** `bitnami/rabbitmq` — password caveat recommends base "existing-secret" but the support decision covers only "static-passwords" — following the page's own advice steps off the supported base
- **WARN** `bitnami/redis` — password caveat recommends base "reuse-existing-secret" but the support decision covers only "default" — following the page's own advice steps off the supported base
- **WARN** `grafana/tempo` — password caveat recommends base "s3-query-observability" but the support decision covers only "local-persistent" — following the page's own advice steps off the supported base
- **WARN** `metrics-server/metrics-server` — password caveat recommends base "external-tls-ca" but the support decision covers only "default" — following the page's own advice steps off the supported base
- **WARN** `prometheus-community/kube-prometheus-stack` — CRD caveat recommends base "no-crds" but the support decision covers only "default" — following the page's own advice steps off the supported base

### recommends-base-with-nonpass-receipt (11)

- **WARN** `fairwinds-stable/vpa` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `grafana/pyroscope` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `grafana/rollout-operator` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `grafana/tempo` — password caveat recommends base "s3-query-observability" whose live receipt is result: watch
- **WARN** `jetstack/trust-manager` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `kedacore/keda` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `open-telemetry/opentelemetry-operator` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `percona/pg-operator` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `percona/pxc-operator` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `strimzi/strimzi-kafka-operator` — CRD caveat recommends base "no-crds" whose live receipt is result: watch
- **WARN** `traefik/traefik` — CRD caveat recommends base "no-crds" whose live receipt is result: watch

## What this proves
The underlying receipts/support-decisions are honest; the failure is the rendering chain asserting more than the receipt says. Fix at the generator (derive claims from receipt `result`, carry the receipt's disclaimers, qualify cross-version evidence), not by editing HTML. Full data: [findings.csv](./findings.csv).