apiVersion: helm-expt.confighub.com/v1alpha1
kind: HookLifecycleRouteReceipt
metadata:
  name: kyverno-kyverno-default-hook-route
spec:
  chart: kyverno/kyverno
  version: 3.8.1
  base: default
  result: observed
  selectedAt: "2026-06-09"
  observedAt: "2026-06-11T04:16:49Z"
  route:
    summary: Upgrade, delete cleanup, and test hooks are split into explicit lifecycle actions.
    phases:
      - hookTypes: [post-upgrade]
        action: upgrade-action-with-receipt
        reason: Resource migration after upgrade must be recorded as an upgrade operation.
      - hookTypes: [pre-delete]
        action: delete-cleanup-policy
        reason: Webhook and APIService cleanup belongs to delete or rollback policy.
      - hookTypes: [test]
        action: explicit-post-install-check
        reason: Test hooks become checks, not hidden install behavior.
  evidence:
    - path: data/hook-lifecycle/top100-hooks.csv
      claim: Source scan found post-upgrade, pre-delete, and test hook templates.
    - path: recipes/kyverno/kyverno/3.8.1/helm-pain-report.yaml
      claim: Chart pain report records CRD, webhook, generated fact, and hook lifecycle risk.
    - path: runs/hook-lifecycle/kyverno-kyverno/default/latest/receipt.yaml
      claim: Fresh kind run observed CRD establishment, controller rollout, admission Service readiness, webhook routes with CA bundles, Kyverno ClusterPolicy server dry-run, explicit post-upgrade migration hook execution, and explicit pre-delete cleanup policy actions.
  execution:
    helmHooksExecutedByHarness: false
    runtimeObserved: true
    observedRoute:
      route: explicit-lifecycle-actions-and-post-install-checks
      result: pass
      receipt: runs/hook-lifecycle/kyverno-kyverno/default/latest/receipt.yaml
    notes:
      - This is a route selection for a proof-grade chart, not a production support claim.
      - The fresh-install test route has been observed as explicit post-install checks.
      - The upstream post-upgrade migration hook was rendered and executed as an explicit lifecycle action.
      - The upstream pre-delete cleanup hooks were rendered and mapped to explicit delete-cleanup policy actions.
      - CRDs are applied with a CRD-first lifecycle policy before controllers.
      - This does not claim cross-version Kyverno upgrade support or production uninstall policy.
  remainingWork:
    - Record cross-version Kyverno upgrade behavior before making production upgrade support claims.
    - Review production uninstall policy before promoting Kyverno as a production-supported policy engine.