{
  "kind": "LifecycleRouteActions",
  "unofficial": true,
  "description": "Action packets projected from data/lifecycle-routes/routes.json. Each row is a checkable plan for a hook/lifecycle behavior; automatic is false unless evidence proves product execution. Generated by scripts/generate-lifecycle-route-actions.mjs; do not hand-edit.",
  "schema": "schemas/lifecycle-route-action.schema.json",
  "sources": [
    "data/lifecycle-routes/routes.json",
    "data/master-catalog-matrix/matrix.csv"
  ],
  "vocabulary": {
    "disposition": [
      "observed",
      "routed",
      "per-target",
      "not-run",
      "blocked",
      "refused"
    ],
    "lifecycle_phase": [
      "pre-render",
      "preflight",
      "pre-apply",
      "post-apply",
      "observe",
      "refuse"
    ],
    "action_kind": [
      "verify-render",
      "run-preflight",
      "stage-target-facts",
      "install-crd",
      "preserve-ordering",
      "run-job",
      "gitops-sync-hook",
      "run-check",
      "run-test",
      "observe-webhook",
      "accept-target-policy",
      "stage-secret",
      "configure-ingress",
      "wait-for-apiservice"
    ]
  },
  "source_disposition_crosswalk": {
    "observed": "observed",
    "per-target": "per-target",
    "refused": "refused",
    "todo (live_status=not-run)": "not-run",
    "todo (other)": "blocked (no recipe/route built yet)",
    "routed (live_status=blocked)": "blocked",
    "routed (live_status=none/other)": "routed"
  },
  "not_yet_projected": [
    "jetstack/cert-manager + external-secrets lifecycle observations (data/lifecycle-observations/cert-manager-eso) — observed via that lane, not in the hook-disposition source; illustrated in the user doc.",
    "hashicorp/consul UI Ingress per-target controller-health decision — illustrated in the user doc; not a hook-disposition row."
  ],
  "actions": [
    {
      "chart": "airflow-helm/airflow",
      "version": "8.9.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "explicit-managed-action",
      "disposition": "blocked",
      "source_disposition": "routed",
      "source_live_status": "blocked",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-job",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "metadata database and migration state; values-conditional rendering",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "explicit-managed-action",
        "default_route": "explicit-managed-action",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-job",
        "required_target_facts": "metadata database and migration state; values-conditional rendering",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "decide the supported migration mode (Deployment vs hook Job) at recipe time; rehearse after image preconditions clear | blocked before attempt: dependency closure + image-availability preconditions (see blocker receipt) | data/hook-disposition/evidence/airflow-helm-airflow/evidence.yaml;data/hook-disposition/evidence/airflow-helm-airflow/hook-resources.yaml;data/hook-disposition/evidence/airflow-helm-airflow/live-rehearsal-blocker-receipt.yaml"
    },
    {
      "chart": "apache-airflow/airflow",
      "version": "1.21.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "recipe-time-lifecycle-verification",
      "disposition": "blocked",
      "source_disposition": "todo",
      "source_live_status": "candidate-route-plan",
      "lifecycle_phase": "pre-render",
      "action_kind": "verify-render",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "metadata database and migration state",
      "human_command": "",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "recipe-time-lifecycle-verification",
        "default_route": "recipe-time-lifecycle-verification",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-render",
        "action_kind": "verify-render",
        "required_target_facts": "metadata database and migration state",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "verify values-conditional lifecycle Jobs before claiming hook-free; route rendered migration Jobs as managed actions with receipts | data/hook-route-candidates/candidates.csv"
    },
    {
      "chart": "argo-cd/argo-workflows",
      "version": "1.0.14",
      "base": "",
      "quirk_class": "crd-install",
      "route_name": "preflight-or-presync-crd-apply",
      "disposition": "blocked",
      "source_disposition": "todo",
      "source_live_status": "candidate-route-plan",
      "lifecycle_phase": "pre-apply",
      "action_kind": "install-crd",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "full CRDs required before workflow-controller and server can start; hook uses server-side apply because full CRDs exceed client-side apply annotation limits",
      "human_command": "kubectl apply --server-side -f <chart-crds>   # placeholder, not verified",
      "alternatives": [
        "self-contained-crd-base",
        "target-owned-crds",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync-crd-apply",
        "default_route": "preflight-or-presync-crd-apply",
        "alternatives": [
          "self-contained-crd-base",
          "target-owned-crds",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "install-crd",
        "required_target_facts": "full CRDs required before workflow-controller and server can start; hook uses server-side apply because full CRDs exceed client-side apply annotation limits",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "direct full-CRD package route is proven; next prove controller-run ordering under Argo CD and Flux and test a cross-version CRD upgrade | data/hook-route-candidates/candidates.csv"
    },
    {
      "chart": "argo-cd/argo-workflows",
      "version": "1.0.14",
      "base": "default",
      "quirk_class": "crd-install",
      "route_name": "preflight-or-presync-crd-apply",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "install-crd",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The controller and server require the Argo Workflows APIs. Helm normally downloads and applies the full CRDs in a hook before those workloads start.",
      "human_command": "kubectl apply --server-side -f <chart-crds>   # placeholder, not verified",
      "alternatives": [
        "self-contained-crd-base",
        "target-owned-crds",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync-crd-apply",
        "default_route": "preflight-or-presync-crd-apply",
        "alternatives": [
          "self-contained-crd-base",
          "target-owned-crds",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "install-crd",
        "required_target_facts": "The controller and server require the Argo Workflows APIs. Helm normally downloads and applies the full CRDs in a hook before those workloads start.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-route-candidates/selected-routes/argo-cd-argo-workflows-default.yaml;docs/demo/hooks-crds/argo-workflows.md;data/hook-route-candidates/argo-cd-argo-workflows.yaml;recipes/argo-cd/argo-workflows/1.0.14/variants/default/variant.yaml;recipes/argo-cd/argo-workflows/1.0.14/upstream/full-crds/argoproj.io_workflows.yaml;packages/argo-cd/argo-workflows/1.0.14/prerequisites/target-facts/default-crds.yaml;runs/live-kind-parity/argo-cd-argo-workflows-default/receipt.yaml;runs/live-helm-confighub-compare/argo-cd-argo-workflows-default/receipt.yaml"
    },
    {
      "chart": "argo-cd/argo-workflows",
      "version": "1.0.14",
      "base": "minimal-crds",
      "quirk_class": "crd-install",
      "route_name": "self-contained-crd-base",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "preserve-ordering",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "Argo Workflows default full CRDs are installed through a Helm hook using server-side apply; this base chooses the self-contained minimal-CRD route instead.",
      "human_command": "",
      "alternatives": [
        "target-owned-crds",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "self-contained-crd-base",
        "default_route": "self-contained-crd-base",
        "alternatives": [
          "target-owned-crds",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "preserve-ordering",
        "required_target_facts": "Argo Workflows default full CRDs are installed through a Helm hook using server-side apply; this base chooses the self-contained minimal-CRD route instead.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-route-candidates/selected-routes/argo-cd-argo-workflows-minimal-crds.yaml;data/hook-route-candidates/argo-cd-argo-workflows.yaml;recipes/argo-cd/argo-workflows/1.0.14/variants/minimal-crds/variant.yaml;recipes/argo-cd/argo-workflows/1.0.14/revisions/minimal-crds/r001/receipts/install-gate.yaml;runs/next80-local-kind/argo-cd-argo-workflows-1.0.14-minimal-crds/observation-receipt.yaml;runs/argo-workflows-minimal-crds-confighub-proof/latest/confighub-proof-receipt.yaml;runs/live-helm-confighub-compare/argo-cd-argo-workflows-minimal-crds/receipt.yaml;runs/live-kind-parity/argo-cd-argo-workflows-minimal-crds/receipt.yaml"
    },
    {
      "chart": "bitnami/contour",
      "version": "21.1.4",
      "base": "legacy",
      "quirk_class": "hook-phase",
      "route_name": "preflight-or-presync",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Contour and Envoy cannot start until contourcert and envoycert exist; Helm normally creates them with a hook that is absent from the ordinary rendered YAML.",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync",
        "default_route": "preflight-or-presync",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "Contour and Envoy cannot start until contourcert and envoycert exist; Helm normally creates them with a hook that is absent from the ordinary rendered YAML.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-route-candidates/selected-routes/bitnami-contour-legacy.yaml;recipes/bitnami/contour/21.1.4/lifecycle-route.yaml;recipes/bitnami/contour/21.1.4/variants/legacy/variant.yaml;packages/bitnami/contour/21.1.4/prerequisites/contour-certgen/run.sh;runs/live-kind-parity/bitnami-contour-legacy/receipt.yaml;runs/live-helm-confighub-compare/bitnami-contour-legacy/receipt.yaml"
    },
    {
      "chart": "bitnami/kafka",
      "version": "32.4.3",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "explicit-managed-action",
      "disposition": "blocked",
      "source_disposition": "routed",
      "source_live_status": "blocked",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-job",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "in-cluster brokers; values-conditional opt-in",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "explicit-managed-action",
        "default_route": "explicit-managed-action",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-job",
        "required_target_facts": "in-cluster brokers; values-conditional opt-in",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "create an image-override or digest-pinned base, then re-run the provisioning-Job route rehearsal | blocked: pinned default image tag no longer exists upstream (see blocker receipt) | data/hook-disposition/evidence/bitnami-kafka/evidence.yaml;data/hook-disposition/evidence/bitnami-kafka/hook-resources.yaml;data/hook-disposition/evidence/bitnami-kafka/live-rehearsal-blocker-receipt.yaml"
    },
    {
      "chart": "bitnami/minio",
      "version": "17.0.21",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "explicit-managed-action",
      "disposition": "blocked",
      "source_disposition": "routed",
      "source_live_status": "blocked",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-job",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "in-cluster object store; optional existing credentials Secret; values-conditional opt-in",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "explicit-managed-action",
        "default_route": "explicit-managed-action",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-job",
        "required_target_facts": "in-cluster object store; optional existing credentials Secret; values-conditional opt-in",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "choose a supported image override or newer chart version, then re-run the provisioning-Job managed-action rehearsal | blocked: pinned MinIO image tags no longer resolve upstream (see rehearsal receipt) | data/hook-route-candidates/rehearsals/bitnami-minio-provisioning/rehearsal-receipt.yaml;data/hook-route-candidates/rehearsals/bitnami-minio-provisioning/render-summary.json;data/hook-route-candidates/rehearsals/bitnami-minio-provisioning/hook-job.yaml"
    },
    {
      "chart": "bitnami/thanos",
      "version": "17.3.1",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "explicit-managed-action",
      "disposition": "blocked",
      "source_disposition": "todo",
      "source_live_status": "none",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-job",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "vendored object store and credentials when enabled",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "explicit-managed-action",
        "default_route": "explicit-managed-action",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-job",
        "required_target_facts": "vendored object store and credentials when enabled",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "create Thanos recipe; distinguish provisioning-off and provisioning-enabled bases; reuse MinIO provisioning receipt shape when the hook renders | none | data/hook-route-candidates/candidates.csv"
    },
    {
      "chart": "datadog/datadog",
      "version": "3.214.0",
      "base": "",
      "quirk_class": "per-target-hook",
      "route_name": "target-class-preflight-and-upgrade-action",
      "disposition": "per-target",
      "source_disposition": "per-target",
      "source_live_status": "none",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "GKE Autopilot target class plus migration state",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "per-target-scope-split"
      ],
      "agent_inputs": {
        "route_name": "target-class-preflight-and-upgrade-action",
        "default_route": "target-class-preflight-and-upgrade-action",
        "alternatives": [
          "per-target-scope-split"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "GKE Autopilot target class plus migration state",
        "disposition": "per-target"
      },
      "evidence_required": "a recorded target decision plus a live receipt for that scope",
      "source_drift": "",
      "evidence_or_next_action": "split normal and GKE Autopilot target scopes; route allowlist hooks as preflight and migration Job as lifecycle action with receipt | none | data/hook-route-candidates/candidates.csv"
    },
    {
      "chart": "fluent/fluent-bit",
      "version": "0.57.6",
      "base": "",
      "quirk_class": "hook-delete-policy",
      "route_name": "preserve-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preserve-cleanup-policy",
        "default_route": "preserve-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/fluent-fluent-bit/default/latest.yaml"
    },
    {
      "chart": "fluent/fluent-bit",
      "version": "0.57.6",
      "base": "",
      "quirk_class": "hook-test",
      "route_name": "explicit-test-check",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "run-test",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "# run the chart's test/check (helm test equivalent)   # placeholder",
      "alternatives": [
        "ci-check",
        "skip-test"
      ],
      "agent_inputs": {
        "route_name": "explicit-test-check",
        "default_route": "explicit-test-check",
        "alternatives": [
          "ci-check",
          "skip-test"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "run-test",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/fluent-fluent-bit/default/latest.yaml"
    },
    {
      "chart": "fluent/fluent-bit",
      "version": "0.57.6",
      "base": "default",
      "quirk_class": "hook-test",
      "route_name": "explicit-test-check",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "run-test",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Connectivity tests are checks against the installed target, not render-time behavior.",
      "human_command": "# run the chart's test/check (helm test equivalent)   # placeholder",
      "alternatives": [
        "ci-check",
        "skip-test"
      ],
      "agent_inputs": {
        "route_name": "explicit-test-check",
        "default_route": "explicit-test-check",
        "alternatives": [
          "ci-check",
          "skip-test"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "run-test",
        "required_target_facts": "Connectivity tests are checks against the installed target, not render-time behavior.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/fluent-fluent-bit/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/fluent/fluent-bit/0.57.6/helm-pain-report.yaml;runs/hook-lifecycle/fluent-fluent-bit/default/latest/receipt.yaml"
    },
    {
      "chart": "gatekeeper/gatekeeper",
      "version": "3.22.2",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "preflight-or-presync",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "CRD and admission-webhook prerequisites must be checked before apply.",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync",
        "default_route": "preflight-or-presync",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "CRD and admission-webhook prerequisites must be checked before apply.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/gatekeeper-gatekeeper/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/gatekeeper/gatekeeper/3.22.2/helm-pain-report.yaml;runs/hook-lifecycle/gatekeeper-gatekeeper/default/latest/receipt.yaml"
    },
    {
      "chart": "gatekeeper/gatekeeper",
      "version": "3.22.2",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The pinned rendered CRD route must be recorded as a target-aware operation before stronger upgrade claims.",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "The pinned rendered CRD route must be recorded as a target-aware operation before stronger upgrade claims.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/gatekeeper-gatekeeper/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/gatekeeper/gatekeeper/3.22.2/helm-pain-report.yaml;runs/hook-lifecycle/gatekeeper-gatekeeper/default/latest/receipt.yaml"
    },
    {
      "chart": "gitlab/gitlab",
      "version": "10.0.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "argocd-or-flux-lifecycle-hook",
      "disposition": "blocked",
      "source_disposition": "todo",
      "source_live_status": "none",
      "lifecycle_phase": "post-apply",
      "action_kind": "gitops-sync-hook",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "GitLab serious-chart prerequisites dominate; confirm supported base before routing",
      "human_command": "",
      "alternatives": [
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "argocd-or-flux-lifecycle-hook",
        "default_route": "argocd-or-flux-lifecycle-hook",
        "alternatives": [
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "gitops-sync-hook",
        "required_target_facts": "GitLab serious-chart prerequisites dominate; confirm supported base before routing",
        "disposition": "blocked"
      },
      "evidence_required": "resolve the named prerequisite/blocker, then capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "treat as a serious-chart review; choose a supported base; confirm whether the vendored hook renders; then write maintained route receipt or hook-inert fact | none | data/hook-route-candidates/candidates.csv"
    },
    {
      "chart": "k8s-dashboard/kubernetes-dashboard",
      "version": "7.14.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "routed",
      "source_disposition": "routed",
      "source_live_status": "none",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "none expected under default values; rendering under defaults unresolved; condition: if rendered",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "none expected under default values; rendering under defaults unresolved; condition: if rendered",
        "disposition": "routed"
      },
      "evidence_required": "a live lifecycle receipt showing this route ran for the supported target scope",
      "source_drift": "",
      "evidence_or_next_action": "record hook-inert-under-default-values for the default base at recipe time; keep the route plan for postgres-mode bases | none (default base is hook-inert; no rehearsal needed for it) | data/hook-disposition/evidence/k8s-dashboard-kubernetes-dashboard/evidence.yaml;data/hook-disposition/evidence/k8s-dashboard-kubernetes-dashboard/hook-resources.yaml"
    },
    {
      "chart": "kedacore/keda",
      "version": "2.19.0",
      "base": "no-crds",
      "quirk_class": "webhook-readiness",
      "route_name": "webhook-readiness-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "observe-webhook",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "The operator mounts kedaorg-certs as optional, starts certificate rotation, and creates the Secret used by the webhook and metrics API pods.",
      "human_command": "kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations   # placeholder",
      "alternatives": [
        "postsync-check-or-observation"
      ],
      "agent_inputs": {
        "route_name": "webhook-readiness-observation",
        "default_route": "webhook-readiness-observation",
        "alternatives": [
          "postsync-check-or-observation"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "observe-webhook",
        "required_target_facts": "The operator mounts kedaorg-certs as optional, starts certificate rotation, and creates the Secret used by the webhook and metrics API pods.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-route-candidates/selected-routes/kedacore-keda-no-crds.yaml;recipes/kedacore/keda/2.19.0/variants/no-crds/variant.yaml;recipes/kedacore/keda/2.19.0/revisions/no-crds/r001/rendered/release-objects.yaml;runs/live-kind-parity/kedacore-keda-no-crds/receipt.yaml"
    },
    {
      "chart": "kong/kong",
      "version": "3.2.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "routed",
      "source_disposition": "routed",
      "source_live_status": "none",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "reachable database when not DB-less; values-conditional rendering",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "reachable database when not DB-less; values-conditional rendering",
        "disposition": "routed"
      },
      "evidence_required": "a live lifecycle receipt showing this route ran for the supported target scope",
      "source_drift": "",
      "evidence_or_next_action": "create the recipe with DB-less and postgres bases; rehearse the migration pair against a database | none (postgres-mode rehearsal needs a database and pullable images) | data/hook-disposition/evidence/kong-kong/evidence.yaml;data/hook-disposition/evidence/kong-kong/hook-resources.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "",
      "quirk_class": "hook-delete-policy",
      "route_name": "delete-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "delete-cleanup-policy",
        "default_route": "delete-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "",
      "quirk_class": "hook-delete-policy",
      "route_name": "preserve-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preserve-cleanup-policy",
        "default_route": "preserve-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "",
      "quirk_class": "hook-test",
      "route_name": "explicit-test-check",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "run-test",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "# run the chart's test/check (helm test equivalent)   # placeholder",
      "alternatives": [
        "ci-check",
        "skip-test"
      ],
      "agent_inputs": {
        "route_name": "explicit-test-check",
        "default_route": "explicit-test-check",
        "alternatives": [
          "ci-check",
          "skip-test"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "run-test",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "",
      "quirk_class": "hook-weight-ordering",
      "route_name": "preserve-ordering",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "preserve-ordering",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "argocd-sync-waves",
        "apply-order"
      ],
      "agent_inputs": {
        "route_name": "preserve-ordering",
        "default_route": "preserve-ordering",
        "alternatives": [
          "argocd-sync-waves",
          "apply-order"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "preserve-ordering",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "",
      "quirk_class": "target-facts",
      "route_name": "target-facts-or-preflight",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "stage-target-facts",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "# create the required target facts (Secret/StorageClass/etc.) before apply   # placeholder",
      "alternatives": [
        "preflight-or-presync",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "target-facts-or-preflight",
        "default_route": "target-facts-or-preflight",
        "alternatives": [
          "preflight-or-presync",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "stage-target-facts",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "default",
      "quirk_class": "hook-delete-policy",
      "route_name": "delete-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "Webhook and APIService cleanup belongs to delete or rollback policy.",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "delete-cleanup-policy",
        "default_route": "delete-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "Webhook and APIService cleanup belongs to delete or rollback policy.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/kyverno/kyverno/3.8.1/helm-pain-report.yaml;runs/hook-lifecycle/kyverno-kyverno/default/latest/receipt.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Resource migration after upgrade must be recorded as an upgrade operation.",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "Resource migration after upgrade must be recorded as an upgrade operation.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/kyverno/kyverno/3.8.1/helm-pain-report.yaml;runs/hook-lifecycle/kyverno-kyverno/default/latest/receipt.yaml"
    },
    {
      "chart": "kyverno/kyverno",
      "version": "3.8.1",
      "base": "default",
      "quirk_class": "hook-test",
      "route_name": "explicit-test-check",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "run-test",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Test hooks become checks, not hidden install behavior.",
      "human_command": "# run the chart's test/check (helm test equivalent)   # placeholder",
      "alternatives": [
        "ci-check",
        "skip-test"
      ],
      "agent_inputs": {
        "route_name": "explicit-test-check",
        "default_route": "explicit-test-check",
        "alternatives": [
          "ci-check",
          "skip-test"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "run-test",
        "required_target_facts": "Test hooks become checks, not hidden install behavior.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/kyverno-kyverno/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/kyverno/kyverno/3.8.1/helm-pain-report.yaml;runs/hook-lifecycle/kyverno-kyverno/default/latest/receipt.yaml"
    },
    {
      "chart": "projectcalico/tigera-operator",
      "version": "v3.32.0",
      "base": "default",
      "quirk_class": "hook-delete-policy",
      "route_name": "explicit-delete-cleanup-action",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Deleting this chart may require cleanup that depends on the cluster's current state. Run that cleanup as a separate, recorded step instead of assuming that deleting the rendered files is enough.",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "explicit-delete-cleanup-action",
        "default_route": "explicit-delete-cleanup-action",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "run-job",
        "required_target_facts": "Deleting this chart may require cleanup that depends on the cluster's current state. Run that cleanup as a separate, recorded step instead of assuming that deleting the rendered files is enough.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/projectcalico-tigera-operator/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/projectcalico/tigera-operator/v3.32.0/helm-pain-report.yaml;runs/hook-lifecycle/projectcalico-tigera-operator/default/latest/receipt.yaml;runs/live-helm-confighub-compare/projectcalico-tigera-operator-default/receipt.yaml;runs/public-preset-script/projectcalico-tigera-operator-default/latest/receipt.yaml"
    },
    {
      "chart": "projectcalico/tigera-operator",
      "version": "v3.32.0",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "preflight-or-presync",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Before installing the rendered resources, the Tigera operator must create four operator.tigera.io CRDs so Kubernetes can accept the APIServer, Goldmane, Installation, and Whisker objects.",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync",
        "default_route": "preflight-or-presync",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "Before installing the rendered resources, the Tigera operator must create four operator.tigera.io CRDs so Kubernetes can accept the APIServer, Goldmane, Installation, and Whisker objects.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/projectcalico-tigera-operator/default/latest.yaml;data/hook-lifecycle/top100-hooks.csv;recipes/projectcalico/tigera-operator/v3.32.0/helm-pain-report.yaml;runs/hook-lifecycle/projectcalico-tigera-operator/default/latest/receipt.yaml;runs/live-helm-confighub-compare/projectcalico-tigera-operator-default/receipt.yaml;runs/public-preset-script/projectcalico-tigera-operator-default/latest/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "hook-delete-policy",
      "route_name": "preserve-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preserve-cleanup-policy",
        "default_route": "preserve-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "postsync-check-or-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-check",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "postsync-check-or-observation",
        "default_route": "postsync-check-or-observation",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-check",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "preflight-or-presync",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync",
        "default_route": "preflight-or-presync",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "hook-weight-ordering",
      "route_name": "preserve-ordering",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "preserve-ordering",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "",
      "alternatives": [
        "argocd-sync-waves",
        "apply-order"
      ],
      "agent_inputs": {
        "route_name": "preserve-ordering",
        "default_route": "preserve-ordering",
        "alternatives": [
          "argocd-sync-waves",
          "apply-order"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "preserve-ordering",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "target-facts",
      "route_name": "target-facts-or-preflight",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "stage-target-facts",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "# create the required target facts (Secret/StorageClass/etc.) before apply   # placeholder",
      "alternatives": [
        "preflight-or-presync",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "target-facts-or-preflight",
        "default_route": "target-facts-or-preflight",
        "alternatives": [
          "preflight-or-presync",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "stage-target-facts",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.0",
      "base": "",
      "quirk_class": "webhook-readiness",
      "route_name": "webhook-readiness-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "observe-webhook",
      "execution_mode": "target-owned",
      "automatic": false,
      "required_target_facts": "",
      "human_command": "kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations   # placeholder",
      "alternatives": [
        "postsync-check-or-observation"
      ],
      "agent_inputs": {
        "route_name": "webhook-readiness-observation",
        "default_route": "webhook-readiness-observation",
        "alternatives": [
          "postsync-check-or-observation"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "observe-webhook",
        "required_target_facts": "",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "route source version 85.3.0; catalog has 85.3.3, 86.1.0",
      "evidence_or_next_action": "data/hook-lifecycle/receipt-index.csv;data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "crd-install",
      "route_name": "preflight-or-presync-crd-apply",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "install-crd",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The package applies the locked CRDs before the chart objects that use them.",
      "human_command": "kubectl apply --server-side -f <chart-crds>   # placeholder, not verified",
      "alternatives": [
        "self-contained-crd-base",
        "target-owned-crds",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync-crd-apply",
        "default_route": "preflight-or-presync-crd-apply",
        "alternatives": [
          "self-contained-crd-base",
          "target-owned-crds",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "install-crd",
        "required_target_facts": "The package applies the locked CRDs before the chart objects that use them.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "hook-delete-policy",
      "route_name": "preserve-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The run removes both completed Jobs and their temporary RBAC objects.",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preserve-cleanup-policy",
        "default_route": "preserve-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "The run removes both completed Jobs and their temporary RBAC objects.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "postsync-check-or-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-check",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The package runs the chart's webhook patch Job after the webhook objects exist.",
      "human_command": "",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "postsync-check-or-observation",
        "default_route": "postsync-check-or-observation",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-check",
        "required_target_facts": "The package runs the chart's webhook patch Job after the webhook objects exist.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "preflight-or-presync",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The package runs the chart's certificate creation Job before applying the admission webhooks.",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync",
        "default_route": "preflight-or-presync",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "The package runs the chart's certificate creation Job before applying the admission webhooks.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "not-run",
      "source_disposition": "todo",
      "source_live_status": "not-run",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "not-yet-executable",
      "automatic": false,
      "required_target_facts": "The fresh-install receipt does not test the 85.3.3 to 86.1.0 upgrade.",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "The fresh-install receipt does not test the 85.3.3 to 86.1.0 upgrade.",
        "disposition": "not-run"
      },
      "evidence_required": "run this route for the named path and capture a live receipt",
      "source_drift": "",
      "evidence_or_next_action": "Run the packaged route during an 85.3.3 to 86.1.0 upgrade and record the result."
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "hook-weight-ordering",
      "route_name": "preserve-ordering",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "preserve-ordering",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The direct runner applies CRDs, creates the certificate, applies the workload, and patches the webhooks in that order.",
      "human_command": "",
      "alternatives": [
        "argocd-sync-waves",
        "apply-order"
      ],
      "agent_inputs": {
        "route_name": "preserve-ordering",
        "default_route": "preserve-ordering",
        "alternatives": [
          "argocd-sync-waves",
          "apply-order"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "preserve-ordering",
        "required_target_facts": "The direct runner applies CRDs, creates the certificate, applies the workload, and patches the webhooks in that order.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "target-facts",
      "route_name": "target-facts-or-preflight",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "stage-target-facts",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The certificate Job creates the required admission Secret with ca, cert, and key.",
      "human_command": "# create the required target facts (Secret/StorageClass/etc.) before apply   # placeholder",
      "alternatives": [
        "preflight-or-presync",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "target-facts-or-preflight",
        "default_route": "target-facts-or-preflight",
        "alternatives": [
          "preflight-or-presync",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "stage-target-facts",
        "required_target_facts": "The certificate Job creates the required admission Secret with ca, cert, and key.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "default",
      "quirk_class": "webhook-readiness",
      "route_name": "webhook-readiness-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "observe-webhook",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The run checks three CA bundles, the operator endpoint, a server dry-run, and six workloads.",
      "human_command": "kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations   # placeholder",
      "alternatives": [
        "postsync-check-or-observation"
      ],
      "agent_inputs": {
        "route_name": "webhook-readiness-observation",
        "default_route": "webhook-readiness-observation",
        "alternatives": [
          "postsync-check-or-observation"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "observe-webhook",
        "required_target_facts": "The run checks three CA bundles, the operator endpoint, a server dry-run, and six workloads.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/default/latest.yaml;runs/kps-lifecycle-route-proof/receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/default/r001/rendered/release-objects.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "crd-install",
      "route_name": "preflight-or-presync-crd-apply",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "install-crd",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The no-crds render omits CRDs, so the package applies the locked CRDs before the workload.",
      "human_command": "kubectl apply --server-side -f <chart-crds>   # placeholder, not verified",
      "alternatives": [
        "self-contained-crd-base",
        "target-owned-crds",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync-crd-apply",
        "default_route": "preflight-or-presync-crd-apply",
        "alternatives": [
          "self-contained-crd-base",
          "target-owned-crds",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "install-crd",
        "required_target_facts": "The no-crds render omits CRDs, so the package applies the locked CRDs before the workload.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "hook-delete-policy",
      "route_name": "preserve-cleanup-policy",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "accept-target-policy",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The run removes both completed Jobs and their temporary RBAC objects.",
      "human_command": "",
      "alternatives": [
        "delete-on-uninstall",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preserve-cleanup-policy",
        "default_route": "preserve-cleanup-policy",
        "alternatives": [
          "delete-on-uninstall",
          "refuse"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "accept-target-policy",
        "required_target_facts": "The run removes both completed Jobs and their temporary RBAC objects.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "hook-phase",
      "route_name": "postsync-check-or-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "post-apply",
      "action_kind": "run-check",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The package runs the chart's webhook patch Job after the webhook objects exist.",
      "human_command": "",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "postsync-check-or-observation",
        "default_route": "postsync-check-or-observation",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "post-apply",
        "action_kind": "run-check",
        "required_target_facts": "The package runs the chart's webhook patch Job after the webhook objects exist.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "hook-phase",
      "route_name": "preflight-or-presync",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "run-preflight",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The package runs the chart's certificate creation Job before applying the admission webhooks.",
      "human_command": "kubectl apply -f <preflight-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "preflight-or-presync",
        "default_route": "preflight-or-presync",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "run-preflight",
        "required_target_facts": "The package runs the chart's certificate creation Job before applying the admission webhooks.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "hook-phase",
      "route_name": "upgrade-action-with-receipt",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "run-job",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "Argo CD and Flux upgraded the no-crds preset from 85.3.3 to 86.1.0, reran the four ordered stages, replaced both hook Jobs, and passed the runtime checks.",
      "human_command": "kubectl apply -f <action-job>; kubectl wait --for=condition=complete job/<name>   # placeholder",
      "alternatives": [
        "argocd-or-flux-lifecycle-hook",
        "target-facts-or-preflight",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "upgrade-action-with-receipt",
        "default_route": "upgrade-action-with-receipt",
        "alternatives": [
          "argocd-or-flux-lifecycle-hook",
          "target-facts-or-preflight",
          "refuse"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "run-job",
        "required_target_facts": "Argo CD and Flux upgraded the no-crds preset from 85.3.3 to 86.1.0, reran the four ordered stages, replaced both hook Jobs, and passed the runtime checks.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "hook-weight-ordering",
      "route_name": "preserve-ordering",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "pre-apply",
      "action_kind": "preserve-ordering",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The direct runner applies CRDs, creates the certificate, applies the workload, and patches the webhooks in that order.",
      "human_command": "",
      "alternatives": [
        "argocd-sync-waves",
        "apply-order"
      ],
      "agent_inputs": {
        "route_name": "preserve-ordering",
        "default_route": "preserve-ordering",
        "alternatives": [
          "argocd-sync-waves",
          "apply-order"
        ],
        "lifecycle_phase": "pre-apply",
        "action_kind": "preserve-ordering",
        "required_target_facts": "The direct runner applies CRDs, creates the certificate, applies the workload, and patches the webhooks in that order.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "target-facts",
      "route_name": "target-facts-or-preflight",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "preflight",
      "action_kind": "stage-target-facts",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The certificate Job creates the required admission Secret with ca, cert, and key.",
      "human_command": "# create the required target facts (Secret/StorageClass/etc.) before apply   # placeholder",
      "alternatives": [
        "preflight-or-presync",
        "refuse"
      ],
      "agent_inputs": {
        "route_name": "target-facts-or-preflight",
        "default_route": "target-facts-or-preflight",
        "alternatives": [
          "preflight-or-presync",
          "refuse"
        ],
        "lifecycle_phase": "preflight",
        "action_kind": "stage-target-facts",
        "required_target_facts": "The certificate Job creates the required admission Secret with ca, cert, and key.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    },
    {
      "chart": "prometheus-community/kube-prometheus-stack",
      "version": "85.3.3",
      "base": "no-crds",
      "quirk_class": "webhook-readiness",
      "route_name": "webhook-readiness-observation",
      "disposition": "observed",
      "source_disposition": "observed",
      "source_live_status": "observed",
      "lifecycle_phase": "observe",
      "action_kind": "observe-webhook",
      "execution_mode": "user-executes",
      "automatic": false,
      "required_target_facts": "The run checks three CA bundles, the operator endpoint, a server dry-run, and six workloads.",
      "human_command": "kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations   # placeholder",
      "alternatives": [
        "postsync-check-or-observation"
      ],
      "agent_inputs": {
        "route_name": "webhook-readiness-observation",
        "default_route": "webhook-readiness-observation",
        "alternatives": [
          "postsync-check-or-observation"
        ],
        "lifecycle_phase": "observe",
        "action_kind": "observe-webhook",
        "required_target_facts": "The run checks three CA bundles, the operator endpoint, a server dry-run, and six workloads.",
        "disposition": "observed"
      },
      "evidence_required": "already has a live receipt; keep it fresh when chart, base, or cluster version changes",
      "source_drift": "",
      "evidence_or_next_action": "data/hook-lifecycle/receipts/prometheus-community-kube-prometheus-stack/no-crds/latest.yaml;runs/kps-lifecycle-route-proof/no-crds-receipt.yaml;packages/prometheus-community/kube-prometheus-stack/85.3.3/prerequisites/kube-prometheus-stack-lifecycle/generation-receipt.yaml;recipes/prometheus-community/kube-prometheus-stack/85.3.3/revisions/no-crds/r001/rendered/release-objects.yaml;runs/kps-gitops-lifecycle-proof/receipt.yaml"
    }
  ]
}