apiVersion: helm-expt.confighub.com/v1alpha1
kind: ProductionDispositionReceipt
metadata:
  name: bitnami-postgresql-generated-fact-ownership
spec:
  chart: bitnami/postgresql
  version: "18.6.7"
  disposition: generated fact ownership
  decision: accepted
  acceptedAt: "2026-06-09"
  scope:
    - local-test
    - production-review-input
  summary: The static-passwords base binds auth.postgresPassword before render so the rendered PostgreSQL Secret is deterministic and separated by cub installer. The existing-secret base removes the rendered credential Secret and declares postgresql/postgresql-auth as a required target Secret. This closes generated credential ownership for the reviewed bases, while production support still needs a target-specific secret policy.
  evidence:
    - path: recipes/bitnami/postgresql/18.6.7/control-points.yaml
      claim: The recipe records generated-facts as variant-controlled and target-facts as variant-controlled.
    - path: recipes/bitnami/postgresql/18.6.7/value-model.yaml
      claim: The value model records static-passwords values and the existing-secret target-fact route.
    - path: recipes/bitnami/postgresql/18.6.7/effective-values.yaml
      claim: The static-passwords base binds auth.postgresPassword before render using a deterministic proof value.
    - path: recipes/bitnami/postgresql/18.6.7/effective-values-existing-secret.yaml
      claim: The existing-secret base switches the rendered objects to use postgresql-auth instead of rendering the credential Secret.
    - path: recipes/bitnami/postgresql/18.6.7/variants/existing-secret/variant.yaml
      claim: The existing-secret variant declares postgresql/postgresql-auth with postgres-password as a target fact.
    - path: packages/bitnami/postgresql/18.6.7/installer.yaml
      claim: The installer package exposes the PostgreSQL Secret as an external requirement for the existing-secret base.
    - path: recipes/bitnami/postgresql/18.6.7/revisions/static-passwords/r001/receipts/render-receipt.yaml
      claim: The static-passwords base renders one Secret deterministically and records that cub installer separates one Secret.
    - path: recipes/bitnami/postgresql/18.6.7/revisions/existing-secret/r001/receipts/render-receipt.yaml
      claim: The existing-secret base renders zero Secrets.
    - path: runs/live-kind-parity/bitnami-postgresql-static-passwords/receipt.yaml
      claim: The static-passwords base passes strict two-cluster live parity between regular Helm and cub installer apply.
    - path: runs/live-kind-parity/bitnami-postgresql-existing-secret/receipt.yaml
      claim: The existing-secret base passes strict two-cluster live parity with the target Secret staged for both paths.
  affectedVariants:
    - static-passwords
    - existing-secret
  remainingProductionBlockers: []
  nextDecision: A production support decision should choose whether PostgreSQL uses generated credentials managed outside the public proof values or the existing-secret base with externally managed credentials.