# Managed setup guidance — the two non-delivery adoption findings, managed

**UNOFFICIAL/EXPERIMENTAL.** Offline receipt generated by `scripts/run-managed-setup-guidance.mjs`; do not hand-edit. Regenerate with `npm run managed-setup-guidance:proof`.

**Claim.** The two non-delivery adoption findings are manageable at the setup edge. Customize friction (#1009): every Helm idiom cub rejects (`unknown flag: --set`, `unknown input`) maps to a plain migration hint. Shared placeholder password (#1012): the safer package default uses the existing-secret base, so a normal setup does not bake the shared demo password. The suggested Secret commands generate fresh values before apply.

## Customize friction (#1009) → guided

Every Helm idiom cub rejects now maps to a plain migration hint. **5/5 idioms guided** (the friction lane found 0/72).

| Helm idiom | Real cub error | Managed guidance |
| --- | --- | --- |
| `--set replicaCount=2` | Error: unknown flag: --set | cub has no `--set`. Declared inputs use `--input KEY=VALUE` (`cub installer doc <pkg>` lists them); most values are set by choosing or editing a kustomize base, not a flag. See docs/user/helm-to-cub-migration.md. |
| `--values values.yaml` | Error: unknown flag: --values | cub has no values file. Configuration lives in the base (kustomize) — pick or edit a base instead of a `values.yaml`. See docs/user/helm-to-cub-migration.md. |
| `-f values.yaml` | Error: unknown shorthand flag: 'f' in -f | cub rejected this input. cub uses declared `--input`s plus kustomize bases rather than Helm's `--set`/values files; see docs/user/helm-to-cub-migration.md. |
| `--set-string image.tag=7.4` | Error: unknown flag: --set-string | cub has no `--set`. Declared inputs use `--input KEY=VALUE` (`cub installer doc <pkg>` lists them); most values are set by choosing or editing a kustomize base, not a flag. See docs/user/helm-to-cub-migration.md. |
| `--input replicaCount=2` | Error: unknown input "replicaCount" | cub rejects non-declared inputs by design — this is the typo guard that catches what Helm silently absorbs. To set it: confirm it's a declared input (`cub installer doc <pkg>`), or edit the base. |

## Shared placeholder password (#1012) → detected + routed

**0/2 charts warned.** Secret VALUES are never decoded or printed — only password key names/counts are read, to honor the credential-handling constraint.

| Chart | Default base | Bakes a password? | reuse base | Managed warning |
| --- | --- | --- | --- | --- |
| bitnami | `reuse-existing-secret` | no | `reuse-existing-secret` | No baked password Secret in the default base (`reuse-existing-secret`). |
| bitnami | `existing-secret` | no | `existing-secret` | No baked password Secret in the default base (`existing-secret`). |

### The determinism tension (why cub can't just "generate a random password")

cub's deterministic render (#1011) and Helm's random-per-install password are different safety models. The package answer is reuse-existing-secret: create or supply the Secret before apply, keep the Secret material outside the rendered chart, and make fixed-password demo bases explicit.

Overall: **pass**. Both non-delivery findings are managed: opaque Helm-idiom rejections become guided migration hints, and the normal setup path no longer bakes the shared placeholder password. With the delivery applier (managed-cub-direct), all five adoption findings now have a concrete 'manage it'.

- Receipt: `runs/managed-setup-guidance/receipt.yaml`.