{ "apiVersion": "workshop.confighub.com/v1alpha2", "kind": "WorkshopResult", "metadata": { "id": "result-5b89805dce1f", "createdAt": "2026-08-24T21:50:08Z" }, "spec": { "question": { "code": "promotion-check", "text": "Can I promote this four-replica NGINX configuration to staging?" }, "source": { "type": "helm", "visibility": "public", "identity": "bitnami/nginx", "version": "24.0.2", "valuesSummary": "ConfigHub change: replicas 3 to 4 and emptyDir sizeLimit 512Mi." }, "candidate": { "content": { "path": "candidate.yaml", "sha256": "sha256:5b89805dce1f9f42add7bf47a71183284b814a0a36a118716f96db50f8846ca1" }, "objectSet": { "algorithm": "cub-scan-canonical-json-v1", "objectCount": 5, "sha256": "sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2" } }, "assessment": { "stages": [ { "id": "inspection", "question": "What do I have?", "answer": "The review received 5 Kubernetes object(s) from bitnami/nginx. It inspected the supplied files, not an unstated source or destination.", "requiredInputs": [ "source identity or exact files", "candidate Kubernetes objects" ], "catalogMatchRequired": false, "sourceIntentRequired": false, "destinationAccessRequired": false, "deploymentRequired": false, "evidenceState": "completed", "resultState": "available", "records": [ "candidate.yaml", "source-and-intent.yaml" ], "nextAction": "Confirm that the supplied source identity and files are the ones you intended to review." }, { "id": "materialization", "question": "What will it produce?", "answer": "The exact candidate objects are available, but this review did not rerun the source-native materialization tool. Keep the source and intent record if you need to reproduce them.", "requiredInputs": [ "source and intent", "source-native materialization tool", "exact candidate objects" ], "catalogMatchRequired": false, "sourceIntentRequired": true, "destinationAccessRequired": false, "deploymentRequired": false, "evidenceState": "not-run", "resultState": "available", "records": [ "candidate.yaml", "source-and-intent.yaml" ], "nextAction": "Rerun the source-native tool with recorded inputs when source-to-output reproduction is required." }, { "id": "destination", "question": "Can this destination accept it?", "answer": "No destination facts were supplied or checked by this local review.", "requiredInputs": [ "exact candidate", "named destination", "current destination facts" ], "catalogMatchRequired": false, "sourceIntentRequired": false, "destinationAccessRequired": true, "deploymentRequired": false, "evidenceState": "blocked", "resultState": "not-run", "records": [], "nextAction": "Check the exact candidate against the chosen destination before deployment." }, { "id": "post-deployment", "question": "Did it work?", "answer": "This local review did not deploy the candidate or inspect a live result.", "requiredInputs": [ "exact delivered revision", "named destination", "claim-specific live evidence" ], "catalogMatchRequired": false, "sourceIntentRequired": false, "destinationAccessRequired": true, "deploymentRequired": true, "evidenceState": "not-run", "resultState": "not-run", "records": [], "nextAction": "After deployment, record the controller, resource, workload, runtime, drift, or rollback result that answers the claim." } ] }, "files": [ { "path": "candidate.yaml", "mediaType": "application/yaml", "sha256": "sha256:5b89805dce1f9f42add7bf47a71183284b814a0a36a118716f96db50f8846ca1", "content": "# Source: promoted-candidate.yaml\napiVersion: \"networking.k8s.io/v1\"\nkind: \"NetworkPolicy\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n egress:\n -\n {}\n ingress:\n -\n ports:\n -\n port: 8080\n -\n port: 8443\n podSelector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n policyTypes:\n - \"Ingress\"\n - \"Egress\"\n---\napiVersion: \"policy/v1\"\nkind: \"PodDisruptionBudget\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n maxUnavailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n---\napiVersion: \"v1\"\nautomountServiceAccountToken: false\nkind: \"ServiceAccount\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\n---\napiVersion: \"v1\"\nkind: \"Service\"\nmetadata:\n annotations: null\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n ports:\n -\n name: \"http\"\n port: 80\n targetPort: \"http\"\n -\n name: \"https\"\n port: 443\n targetPort: \"https\"\n selector:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n type: \"ClusterIP\"\n---\napiVersion: \"apps/v1\"\nkind: \"Deployment\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n replicas: 4\n revisionHistoryLimit: 10\n selector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n strategy:\n rollingUpdate:\n {}\n type: \"RollingUpdate\"\n template:\n metadata:\n annotations: null\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n spec:\n affinity:\n nodeAffinity: null\n podAffinity: null\n podAntiAffinity:\n preferredDuringSchedulingIgnoredDuringExecution:\n -\n podAffinityTerm:\n labelSelector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n topologyKey: \"kubernetes.io/hostname\"\n weight: 1\n automountServiceAccountToken: false\n containers:\n -\n env:\n -\n name: \"BITNAMI_DEBUG\"\n value: \"false\"\n -\n name: \"NGINX_HTTP_PORT_NUMBER\"\n value: \"8080\"\n -\n name: \"OPENSSL_FIPS\"\n value: \"yes\"\n -\n name: \"NGINX_HTTPS_PORT_NUMBER\"\n value: \"8443\"\n envFrom:\n -\n secretRef:\n name: \"ai-provider-credentials\"\n image: \"registry-1.docker.io/bitnami/nginx@sha256:805bcc863fc3f602589fc75cae91eeedebad234d5ce5a476c96b03a747821e7f\"\n imagePullPolicy: \"IfNotPresent\"\n livenessProbe:\n failureThreshold: 6\n initialDelaySeconds: 30\n periodSeconds: 10\n successThreshold: 1\n tcpSocket:\n port: \"http\"\n timeoutSeconds: 5\n name: \"nginx\"\n ports:\n -\n containerPort: 8080\n name: \"http\"\n -\n containerPort: 8443\n name: \"https\"\n readinessProbe:\n failureThreshold: 3\n httpGet:\n path: \"/\"\n port: \"http\"\n initialDelaySeconds: 5\n periodSeconds: 5\n successThreshold: 1\n timeoutSeconds: 3\n resources:\n limits:\n cpu: \"150m\"\n ephemeral-storage: \"2Gi\"\n memory: \"192Mi\"\n requests:\n cpu: \"100m\"\n ephemeral-storage: \"50Mi\"\n memory: \"128Mi\"\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - \"ALL\"\n privileged: false\n readOnlyRootFilesystem: true\n runAsGroup: 1001\n runAsNonRoot: true\n runAsUser: 1001\n seLinuxOptions:\n {}\n seccompProfile:\n type: \"RuntimeDefault\"\n volumeMounts:\n -\n mountPath: \"/tmp\"\n name: \"empty-dir\"\n subPath: \"tmp-dir\"\n -\n mountPath: \"/opt/bitnami/nginx/conf\"\n name: \"empty-dir\"\n subPath: \"app-conf-dir\"\n -\n mountPath: \"/opt/bitnami/nginx/logs\"\n name: \"empty-dir\"\n subPath: \"app-logs-dir\"\n -\n mountPath: \"/opt/bitnami/nginx/tmp\"\n name: \"empty-dir\"\n subPath: \"app-tmp-dir\"\n -\n mountPath: \"/certs\"\n name: \"empty-dir\"\n subPath: \"app-tls-dir\"\n hostIPC: false\n hostNetwork: false\n initContainers:\n -\n args:\n - \"-ec\"\n - \"#!/bin/bash\\n. /opt/bitnami/scripts/libfs.sh\\n# We copy the logs folder because it has symlinks to stdout and stderr\\nif ! is_dir_empty /opt/bitnami/nginx/logs; then\\n cp -r /opt/bitnami/nginx/logs /emptydir/app-logs-dir\\nfi\\n\"\n command:\n - \"/bin/bash\"\n env:\n -\n name: \"OPENSSL_FIPS\"\n value: \"yes\"\n image: \"registry-1.docker.io/bitnami/nginx@sha256:805bcc863fc3f602589fc75cae91eeedebad234d5ce5a476c96b03a747821e7f\"\n imagePullPolicy: \"IfNotPresent\"\n name: \"preserve-logs-symlinks\"\n resources:\n limits:\n cpu: \"150m\"\n ephemeral-storage: \"2Gi\"\n memory: \"192Mi\"\n requests:\n cpu: \"100m\"\n ephemeral-storage: \"50Mi\"\n memory: \"128Mi\"\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - \"ALL\"\n privileged: false\n readOnlyRootFilesystem: true\n runAsGroup: 1001\n runAsNonRoot: true\n runAsUser: 1001\n seLinuxOptions:\n {}\n seccompProfile:\n type: \"RuntimeDefault\"\n volumeMounts:\n -\n mountPath: \"/emptydir\"\n name: \"empty-dir\"\n securityContext:\n fsGroup: 1001\n fsGroupChangePolicy: \"Always\"\n supplementalGroups:\n []\n sysctls:\n []\n serviceAccountName: \"nginx\"\n shareProcessNamespace: false\n volumes:\n -\n emptyDir:\n sizeLimit: \"512Mi\"\n name: \"empty-dir\"\n" }, { "path": "comparison.yaml", "mediaType": "application/yaml", "sha256": "sha256:ec4195803615b2e0d31e82488a16e0ab190ade8ddb0d3b892ceee6c3a724c8b6", "content": "# Source: reviewed-render.yaml\n---\napiVersion: \"networking.k8s.io/v1\"\nkind: \"NetworkPolicy\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n egress:\n -\n {}\n ingress:\n -\n ports:\n -\n port: 8080\n -\n port: 8443\n podSelector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n policyTypes:\n - \"Ingress\"\n - \"Egress\"\n---\napiVersion: \"policy/v1\"\nkind: \"PodDisruptionBudget\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n maxUnavailable: 1\n selector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n---\napiVersion: \"v1\"\nautomountServiceAccountToken: false\nkind: \"ServiceAccount\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\n---\napiVersion: \"v1\"\nkind: \"Service\"\nmetadata:\n annotations: null\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n ports:\n -\n name: \"http\"\n port: 80\n targetPort: \"http\"\n -\n name: \"https\"\n port: 443\n targetPort: \"https\"\n selector:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n type: \"ClusterIP\"\n---\napiVersion: \"apps/v1\"\nkind: \"Deployment\"\nmetadata:\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n name: \"nginx\"\n namespace: \"nginx\"\nspec:\n replicas: 3\n revisionHistoryLimit: 10\n selector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n strategy:\n rollingUpdate:\n {}\n type: \"RollingUpdate\"\n template:\n metadata:\n annotations: null\n labels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/managed-by: \"Helm\"\n app.kubernetes.io/name: \"nginx\"\n app.kubernetes.io/version: \"1.31.1\"\n helm.sh/chart: \"nginx-24.0.2\"\n spec:\n affinity:\n nodeAffinity: null\n podAffinity: null\n podAntiAffinity:\n preferredDuringSchedulingIgnoredDuringExecution:\n -\n podAffinityTerm:\n labelSelector:\n matchLabels:\n app.kubernetes.io/instance: \"nginx\"\n app.kubernetes.io/name: \"nginx\"\n topologyKey: \"kubernetes.io/hostname\"\n weight: 1\n automountServiceAccountToken: false\n containers:\n -\n env:\n -\n name: \"BITNAMI_DEBUG\"\n value: \"false\"\n -\n name: \"NGINX_HTTP_PORT_NUMBER\"\n value: \"8080\"\n -\n name: \"OPENSSL_FIPS\"\n value: \"yes\"\n -\n name: \"NGINX_HTTPS_PORT_NUMBER\"\n value: \"8443\"\n envFrom:\n -\n secretRef:\n name: \"ai-provider-credentials\"\n image: \"registry-1.docker.io/bitnami/nginx@sha256:805bcc863fc3f602589fc75cae91eeedebad234d5ce5a476c96b03a747821e7f\"\n imagePullPolicy: \"IfNotPresent\"\n livenessProbe:\n failureThreshold: 6\n initialDelaySeconds: 30\n periodSeconds: 10\n successThreshold: 1\n tcpSocket:\n port: \"http\"\n timeoutSeconds: 5\n name: \"nginx\"\n ports:\n -\n containerPort: 8080\n name: \"http\"\n -\n containerPort: 8443\n name: \"https\"\n readinessProbe:\n failureThreshold: 3\n httpGet:\n path: \"/\"\n port: \"http\"\n initialDelaySeconds: 5\n periodSeconds: 5\n successThreshold: 1\n timeoutSeconds: 3\n resources:\n limits:\n cpu: \"150m\"\n ephemeral-storage: \"2Gi\"\n memory: \"192Mi\"\n requests:\n cpu: \"100m\"\n ephemeral-storage: \"50Mi\"\n memory: \"128Mi\"\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - \"ALL\"\n privileged: false\n readOnlyRootFilesystem: true\n runAsGroup: 1001\n runAsNonRoot: true\n runAsUser: 1001\n seLinuxOptions:\n {}\n seccompProfile:\n type: \"RuntimeDefault\"\n volumeMounts:\n -\n mountPath: \"/tmp\"\n name: \"empty-dir\"\n subPath: \"tmp-dir\"\n -\n mountPath: \"/opt/bitnami/nginx/conf\"\n name: \"empty-dir\"\n subPath: \"app-conf-dir\"\n -\n mountPath: \"/opt/bitnami/nginx/logs\"\n name: \"empty-dir\"\n subPath: \"app-logs-dir\"\n -\n mountPath: \"/opt/bitnami/nginx/tmp\"\n name: \"empty-dir\"\n subPath: \"app-tmp-dir\"\n -\n mountPath: \"/certs\"\n name: \"empty-dir\"\n subPath: \"app-tls-dir\"\n hostIPC: false\n hostNetwork: false\n initContainers:\n -\n args:\n - \"-ec\"\n - \"#!/bin/bash\\n. /opt/bitnami/scripts/libfs.sh\\n# We copy the logs folder because it has symlinks to stdout and stderr\\nif ! is_dir_empty /opt/bitnami/nginx/logs; then\\n cp -r /opt/bitnami/nginx/logs /emptydir/app-logs-dir\\nfi\\n\"\n command:\n - \"/bin/bash\"\n env:\n -\n name: \"OPENSSL_FIPS\"\n value: \"yes\"\n image: \"registry-1.docker.io/bitnami/nginx@sha256:805bcc863fc3f602589fc75cae91eeedebad234d5ce5a476c96b03a747821e7f\"\n imagePullPolicy: \"IfNotPresent\"\n name: \"preserve-logs-symlinks\"\n resources:\n limits:\n cpu: \"150m\"\n ephemeral-storage: \"2Gi\"\n memory: \"192Mi\"\n requests:\n cpu: \"100m\"\n ephemeral-storage: \"50Mi\"\n memory: \"128Mi\"\n securityContext:\n allowPrivilegeEscalation: false\n capabilities:\n drop:\n - \"ALL\"\n privileged: false\n readOnlyRootFilesystem: true\n runAsGroup: 1001\n runAsNonRoot: true\n runAsUser: 1001\n seLinuxOptions:\n {}\n seccompProfile:\n type: \"RuntimeDefault\"\n volumeMounts:\n -\n mountPath: \"/emptydir\"\n name: \"empty-dir\"\n securityContext:\n fsGroup: 1001\n fsGroupChangePolicy: \"Always\"\n supplementalGroups:\n []\n sysctls:\n []\n serviceAccountName: \"nginx\"\n shareProcessNamespace: false\n volumes:\n -\n emptyDir:\n {}\n name: \"empty-dir\"\n" }, { "path": "source-and-intent.yaml", "mediaType": "application/yaml", "sha256": "sha256:1841c109d0d1c6e932bc46d02b082cb964f129015366d6b16c803466ff0fd163", "content": "apiVersion: catalog.confighub.com/v1alpha1\nkind: BaseVariantRecord\nmetadata:\n name: byo-nginx-ai-values-24-0-2-reviewed\n labels:\n sourceType: helm\n component: bitnami/nginx\n sourceVersion: 24.0.2\n base: reviewed\nspec:\n source:\n type: helm\n name: bitnami/nginx\n version: 24.0.2\n record: data/byo-helm-values-review/review.yaml\n packageOciRef: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/byo-nginx-ai-values:24.0.2-r001\n baseVariant:\n name: reviewed\n revision: r001\n digest: 34af6a50b952d1a168a5cad614ef47f652cf44b11806a93bf6cc7a79c6e9c683\n digestRole: public-oci-manifest\n digestRecord: runs/byo-helm-values-proof/public-oci-receipt.yaml\n configuration:\n format: kubernetes-yaml\n objects: data/byo-helm-values-review/reviewed-render.yaml\n inventory: data/byo-helm-values-review/review.yaml\n objectCount: 5\n digest: 502d8c85470455fa4152f8d0abb9d1582552e830148e90335e9649cbfd42f397\n digestRole: cub-scan-canonical-object-set\n digestRecord: runs/config-catalog-policy-functional-proof/reviewed-cub-check.json\n processing:\n sourceIntent:\n status: recorded\n record: data/byo-helm-values-review/review.yaml\n materialization:\n method: helm-render\n status: captured\n outputDigest: 502d8c85470455fa4152f8d0abb9d1582552e830148e90335e9649cbfd42f397\n record: data/byo-helm-values-review/reviewed-render.yaml\n flattening:\n status: decided\n verdict: safe-for-this-reviewed-base\n action: retain-exact-objects\n scope: bitnami/nginx@24.0.2/reviewed; recheck after source, lifecycle-sensitive variant, destination, or delivery-runtime changes\n record: data/byo-helm-values-review/review.yaml\n boundaries:\n - Helm rendered the pinned chart and reviewed values into the five retained Kubernetes objects.\n - The required Secret is supplied at the destination and is not embedded in the retained objects.\n inputs:\n fixedAtBuildTime:\n - chart=bitnami/nginx\n - version=24.0.2\n - values=examples/byo-helm-values/reviewed-values.yaml\n - releaseName=nginx\n - namespace=nginx\n - kubeVersion=1.30.0\n installTime:\n - name: ai-provider-credentials\n type: requiredSecrets\n required: true\n details:\n name: ai-provider-credentials\n namespace: nginx\n keys:\n - AI_API_KEY\n purpose: AI provider key used by the application\n installTimeStatus: declared\n lifecycle:\n requirements:\n status: recorded\n items:\n - id: nginx/ai-provider-credentials\n origin: reviewed-values\n type: target-fact\n detail: The destination must supply the AI provider Secret before delivery.\n records:\n - data/byo-helm-values-review/review.yaml\n routeIntent:\n status: no-routes-required\n routes: []\n records:\n - data/byo-helm-values-review/review.yaml\n targetFacts:\n status: recorded\n declared:\n requiredSecrets:\n - name: ai-provider-credentials\n namespace: nginx\n keys:\n - AI_API_KEY\n requirementRefs:\n - nginx/ai-provider-credentials\n records:\n - data/byo-helm-values-review/review.yaml\n resolution:\n status: resolved-for-development-and-staging-proof\n rule: Recheck the required Secret and any lifecycle-sensitive change for each new destination.\n records:\n - runs/byo-helm-values-deploy-proof/receipt.yaml\n - runs/byo-helm-values-staging-deploy-proof/receipt.yaml\n ownership:\n status: declared-for-example\n sourceControlled:\n - Fields produced from the pinned chart and reviewed values\n variantControlled:\n - Post-render fields retained in ConfigHub after upload\n targetSupplied:\n - nginx/ai-provider-credentials\n deliveryProtected: []\n records:\n - data/byo-helm-values-review/review.yaml\n - runs/byo-helm-values-proof/confighub-upload-receipt.yaml\n rule: A later chart render changes source-controlled fields; a ConfigHub variant changes retained object fields; the destination supplies the Secret.\n delivery:\n literalConfigOci:\n status: pass\n reference: oci://europe-west1-docker.pkg.dev/nth-fort-499605-q5/helm-expt/byo-nginx-ai-values:24.0.2-r001\n receipt: runs/byo-helm-values-proof/public-oci-receipt.yaml\n configHubUpload:\n status: pass\n space: byo-nginx-ai-values-24-0-2-reviewed\n receipt: runs/byo-helm-values-proof/confighub-upload-receipt.yaml\n configHubReleaseOci:\n status: not-run\n argoCd:\n status: pass\n receipts:\n - runs/byo-helm-values-deploy-proof/receipt.yaml\n - runs/byo-helm-values-staging-deploy-proof/receipt.yaml\n flux: not-run\n direct: not-run\n policy:\n profile: catalog-standard\n productionAdds:\n - human-approval\n evidence:\n review: data/byo-helm-values-review/review.yaml\n localCheck: runs/config-catalog-policy-functional-proof/reviewed-cub-check.json\n configHubUpload: runs/byo-helm-values-proof/confighub-upload-receipt.yaml\n promotion: runs/byo-helm-values-promotion-proof/receipt.yaml\n delivery: runs/byo-helm-values-staging-deploy-proof/receipt.yaml\n operations:\n resourceClass: user-workload\n ownerClass: application-team\n changeCadence: application-release\nstatus:\n level: proven-example\n claim: The reviewed Helm result was retained in ConfigHub, varied, promoted to staging, and delivered through Argo CD.\n limits:\n - The local check is advisory; ConfigHub validation is a separate managed control.\n - The required Secret was supplied to the proof cluster and is not part of the public configuration.\n - Flux delivery and exact rollback have not run for this example.\n" }, { "path": "cub-check.json", "mediaType": "application/json", "sha256": "sha256:1ca80d32ed1b8970d454084a0622e16919f3f98e212eb56c61f9476f98a59875", "content": "{\n \"schema_version\": \"risk-scan-findings-v1\",\n \"surface\": \"cub-scan\",\n \"finding_count\": 0,\n \"findings\": [],\n \"provenance\": {\n \"source\": \"cub-scan\",\n \"source_version\": \"v0.7.3\",\n \"scan_time\": \"2026-08-24T21:50:08Z\",\n \"catalog_version\": \"risk-catalog-v1.json@7ff79a126ad9\"\n },\n \"pattern_bundle\": {\n \"schema_version\": \"bundle-manifest-v1\",\n \"version\": \"v0.7.3\",\n \"source_repo\": \"confighubai/confighub-scan\",\n \"manifest_sha256\": \"0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8\",\n \"catalog_sha256\": \"7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba\"\n },\n \"input\": {\n \"object_count\": 5,\n \"object_set_sha256\": \"sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2\"\n }\n}\n" }, { "path": "workshop-review.json", "mediaType": "application/json", "sha256": "sha256:aae81ffcc27e32a384962dab9587247e7ccbd5e5a4ce25fd852ed2ff75c8d08c", "content": "{\n \"apiVersion\": \"workshop.confighub.com/v1alpha1\",\n \"kind\": \"ConfigurationReview\",\n \"metadata\": {\n \"id\": \"review-5b89805dce1f\",\n \"createdAt\": \"2026-08-24T21:50:08Z\"\n },\n \"spec\": {\n \"question\": {\n \"code\": \"promotion-check\",\n \"text\": \"Can I promote this four-replica NGINX configuration to staging?\"\n },\n \"source\": {\n \"type\": \"helm\",\n \"visibility\": \"public\",\n \"identity\": \"bitnami/nginx\",\n \"version\": \"24.0.2\",\n \"valuesSummary\": \"ConfigHub change: replicas 3 to 4 and emptyDir sizeLimit 512Mi.\"\n },\n \"candidate\": {\n \"name\": \"promoted-candidate.yaml\",\n \"sha256\": \"sha256:5b89805dce1f9f42add7bf47a71183284b814a0a36a118716f96db50f8846ca1\",\n \"objectCount\": 5,\n \"objects\": [\n \"Deployment/nginx/nginx\",\n \"NetworkPolicy/nginx/nginx\",\n \"PodDisruptionBudget/nginx/nginx\",\n \"Service/nginx/nginx\",\n \"ServiceAccount/nginx/nginx\"\n ]\n },\n \"comparison\": {\n \"status\": \"compared\",\n \"objectSet\": {\n \"name\": \"reviewed-render.yaml\",\n \"sha256\": \"sha256:ec4195803615b2e0d31e82488a16e0ab190ade8ddb0d3b892ceee6c3a724c8b6\",\n \"objectCount\": 5,\n \"objects\": [\n \"Deployment/nginx/nginx\",\n \"NetworkPolicy/nginx/nginx\",\n \"PodDisruptionBudget/nginx/nginx\",\n \"Service/nginx/nginx\",\n \"ServiceAccount/nginx/nginx\"\n ]\n },\n \"added\": [],\n \"removed\": [],\n \"changed\": [\n \"Deployment/nginx/nginx\"\n ],\n \"unchanged\": [\n \"NetworkPolicy/nginx/nginx\",\n \"PodDisruptionBudget/nginx/nginx\",\n \"Service/nginx/nginx\",\n \"ServiceAccount/nginx/nginx\"\n ],\n \"noOp\": []\n },\n \"assessment\": {\n \"stages\": [\n {\n \"id\": \"inspection\",\n \"question\": \"What do I have?\",\n \"answer\": \"The review received 5 Kubernetes object(s) from bitnami/nginx. It inspected the supplied files, not an unstated source or destination.\",\n \"requiredInputs\": [\n \"source identity or exact files\",\n \"candidate Kubernetes objects\"\n ],\n \"catalogMatchRequired\": false,\n \"sourceIntentRequired\": false,\n \"destinationAccessRequired\": false,\n \"deploymentRequired\": false,\n \"evidenceState\": \"completed\",\n \"resultState\": \"available\",\n \"records\": [\n \"candidate.yaml\",\n \"source-and-intent.yaml\"\n ],\n \"nextAction\": \"Confirm that the supplied source identity and files are the ones you intended to review.\"\n },\n {\n \"id\": \"materialization\",\n \"question\": \"What will it produce?\",\n \"answer\": \"The exact candidate objects are available, but this review did not rerun the source-native materialization tool. Keep the source and intent record if you need to reproduce them.\",\n \"requiredInputs\": [\n \"source and intent\",\n \"source-native materialization tool\",\n \"exact candidate objects\"\n ],\n \"catalogMatchRequired\": false,\n \"sourceIntentRequired\": true,\n \"destinationAccessRequired\": false,\n \"deploymentRequired\": false,\n \"evidenceState\": \"not-run\",\n \"resultState\": \"available\",\n \"records\": [\n \"candidate.yaml\",\n \"source-and-intent.yaml\"\n ],\n \"nextAction\": \"Rerun the source-native tool with recorded inputs when source-to-output reproduction is required.\"\n },\n {\n \"id\": \"destination\",\n \"question\": \"Can this destination accept it?\",\n \"answer\": \"No destination facts were supplied or checked by this local review.\",\n \"requiredInputs\": [\n \"exact candidate\",\n \"named destination\",\n \"current destination facts\"\n ],\n \"catalogMatchRequired\": false,\n \"sourceIntentRequired\": false,\n \"destinationAccessRequired\": true,\n \"deploymentRequired\": false,\n \"evidenceState\": \"blocked\",\n \"resultState\": \"not-run\",\n \"records\": [],\n \"nextAction\": \"Check the exact candidate against the chosen destination before deployment.\"\n },\n {\n \"id\": \"post-deployment\",\n \"question\": \"Did it work?\",\n \"answer\": \"This local review did not deploy the candidate or inspect a live result.\",\n \"requiredInputs\": [\n \"exact delivered revision\",\n \"named destination\",\n \"claim-specific live evidence\"\n ],\n \"catalogMatchRequired\": false,\n \"sourceIntentRequired\": false,\n \"destinationAccessRequired\": true,\n \"deploymentRequired\": true,\n \"evidenceState\": \"not-run\",\n \"resultState\": \"not-run\",\n \"records\": [],\n \"nextAction\": \"After deployment, record the controller, resource, workload, runtime, drift, or rollback result that answers the claim.\"\n }\n ]\n },\n \"checks\": {\n \"method\": \"cub-check-workshop-composition-v1\",\n \"scope\": \"Kubernetes object inventory, optional semantic comparison, and the supplied matching cub check result.\",\n \"findings\": [],\n \"notChecked\": [\n \"source rendering and values provenance beyond the supplied source record\",\n \"Kubernetes schema and admission behavior\",\n \"hook execution and CRD establishment\",\n \"live workload health and drift\",\n \"database migrations and external services\"\n ],\n \"advisoryReceipts\": [\n {\n \"authority\": \"local-advisory\",\n \"tool\": \"cub-scan\",\n \"version\": \"v0.7.3\",\n \"schemaVersion\": \"risk-scan-findings-v1\",\n \"scanTime\": \"2026-08-24T21:50:08Z\",\n \"catalogVersion\": \"risk-catalog-v1.json@7ff79a126ad9\",\n \"patternBundle\": {\n \"schemaVersion\": \"bundle-manifest-v1\",\n \"version\": \"v0.7.3\",\n \"sourceRepo\": \"confighubai/confighub-scan\",\n \"manifestSha256\": \"sha256:0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8\",\n \"catalogSha256\": \"sha256:7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba\"\n },\n \"input\": {\n \"objectCount\": 5,\n \"objectSetSha256\": \"sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2\"\n },\n \"findingCount\": 0,\n \"findingIds\": []\n }\n ]\n },\n \"findingDecisions\": {\n \"status\": \"not-required\",\n \"candidateObjectSetSha256\": \"sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2\",\n \"outcomes\": []\n },\n \"finding\": \"\",\n \"recommendation\": \"Review the findings and the checks that did not run before keeping or promoting this configuration.\",\n \"lifecycle\": {\n \"record\": \"byo-nginx-ai-values-24-0-2-reviewed\",\n \"requirements\": [\n {\n \"detail\": \"The destination must supply the AI provider Secret before delivery.\",\n \"id\": \"nginx/ai-provider-credentials\",\n \"origin\": \"reviewed-values\",\n \"type\": \"target-fact\"\n }\n ],\n \"routes\": [],\n \"targetFacts\": {\n \"declared\": {\n \"requiredSecrets\": [\n {\n \"keys\": [\n \"AI_API_KEY\"\n ],\n \"name\": \"ai-provider-credentials\",\n \"namespace\": \"nginx\"\n }\n ]\n },\n \"records\": [\n \"data/byo-helm-values-review/review.yaml\"\n ],\n \"requirementRefs\": [\n \"nginx/ai-provider-credentials\"\n ],\n \"status\": \"recorded\"\n },\n \"resolution\": {\n \"records\": [\n \"runs/byo-helm-values-deploy-proof/receipt.yaml\",\n \"runs/byo-helm-values-staging-deploy-proof/receipt.yaml\"\n ],\n \"rule\": \"Recheck the required Secret and any lifecycle-sensitive change for each new destination.\",\n \"status\": \"resolved-for-development-and-staging-proof\"\n }\n },\n \"catalog\": {\n \"status\": \"exact\",\n \"url\": \"https://confighub.github.io/helm-expt/site/charts/bitnami-nginx-24-0-2.html\"\n }\n }\n}\n" } ], "checks": { "completed": [ "Kubernetes object inventory", "shared local configuration checks from a matching cub check result", "semantic comparison with the supplied object set", "Catalog source and lifecycle record retained with the result" ], "notRun": [ "source rendering and values provenance beyond the supplied source record", "Kubernetes schema and admission behavior", "hook execution and CRD establishment", "live workload health and drift", "database migrations and external services" ], "advisoryReceipts": [ { "authority": "local-advisory", "tool": "cub-scan", "version": "v0.7.3", "schemaVersion": "risk-scan-findings-v1", "scanTime": "2026-08-24T21:50:08Z", "catalogVersion": "risk-catalog-v1.json@7ff79a126ad9", "patternBundle": { "schemaVersion": "bundle-manifest-v1", "version": "v0.7.3", "sourceRepo": "confighubai/confighub-scan", "manifestSha256": "sha256:0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8", "catalogSha256": "sha256:7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba" }, "input": { "objectCount": 5, "objectSetSha256": "sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2" }, "findingCount": 0, "findingIds": [] } ] }, "findingDecisions": { "status": "not-required", "candidateObjectSetSha256": "sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2", "outcomes": [] }, "next": { "local": "Review every finding before you call this result accepted. Keep the result with the change, or publish candidate.yaml as OCI using the local tools you already use.", "managed": "Retain candidate.yaml in ConfigHub with annotation workshop.confighub.com/object-set-sha256=sha256:55f6bdcd4f07dc2f57d2dad456addcb035eaf867adcf864ebdf224555636f9e2 when the result needs shared history, validation, variants, promotion, release, or live comparison." } } }