# One OCI bundle delivered three ways

**UNOFFICIAL/EXPERIMENTAL.** Live receipt generated by `scripts/run-oci-hook-delivery-proof.mjs`; do not hand-edit. Regenerate with `npm run oci-hook:proof`.

This run checks whether Argo CD, Flux, and a direct-apply path can pull the same ConfigHub release OCI, apply its workload, and run its routed hook.

ConfigHub published `tests/fixtures/hook-replacement-probe` once to `oci.hub.confighub.com:443`. Each consumer pulled that bundle on one throwaway test cluster. Publish: **pass**.

| Consumer | OCI source | workload applied | hook ran | result |
| --- | --- | --- | --- | --- |
| Argo CD | OCI Application | yes | yes | pass |
| Flux | OCIRepository | yes | yes | pass |
| cub-direct (no controller) | oras pull | yes | yes | pass |

Overall: **pass**. The workload and routed hook completed under all three consumers in this run.

This is a test of one small routed-hook fixture. It proves that the delivery mechanism works through all three consumers. It does not prove that every catalog configuration has been delivered through all three. A catalog configuration has delivery proof only when its own page names a receipt.

- **Argo CD** uses an `Application` whose `source.repoURL` is the OCI bundle.
- **Flux** uses an `OCIRepository` and `Kustomization` at the same URL. The OCI pull Secret is copied into `flux-system` and is never printed.
- **cub-direct** uses `oras pull` and `kubectl apply` without a controller.
- Legs are best-effort: a non-converged consumer is `watch` with its reason, not a silent failure.
- Receipt: `runs/oci-hook-delivery-proof/receipt.yaml`. Fixture: `tests/fixtures/hook-replacement-probe`.