# Variant-Promotion Closeout

**UNOFFICIAL/EXPERIMENTAL.** Generated by
`scripts/generate-variant-promotion-closeout.mjs`. Do not hand-edit. Regenerate
with `npm run variant-promotion-closeout`.

This surface turns the master matrix promotion column into a product-and-engineering queue:
for every variant, whether `cub variant promote` is **ready to run now**,
**watch-grade pending receipt rerun**, or **blocked** by a proof prerequisite, with the exact next command or fix
and the owner who has to act.

Promotion is a **ConfigHub server value**, not a helm-expt-only trick:
`cub variant promote` clones and promotes a Unit server-side. See
[variant-promotion-closeout reference](../../docs/reference/variant-promotion-closeout.md).
Source of record: [variant-promotion/status.csv](../variant-promotion/status.csv).

## Owner classes

| Owner class | Variants | Meaning |
| --- | ---: | --- |
| `run-proof` | 32 | A clone exists (or a prerequisite proof can run); record or rerun the proof. Engineering/CI. |
| `catalog-modeling` | 0 | Needs catalog/model work before promotion is meaningful. |
| `not-applicable-if-any` | 167 | Promotion does not apply to this variant. |

| Readiness | Variants |
| --- | ---: |
| `promotion-proven` | 167 |
| `watch-grade` | 29 |
| `blocked-proof-failed` | 2 |
| `blocked-needs-confighub-proof` | 1 |

| Promotion state | Variants |
| --- | ---: |
| `yes` | 167 |
| `watch` | 29 |
| `no` | 2 |
| `todo` | 1 |

## Ready to run now (0)

These variants already have a server-side clone and ConfigHub upload proof; only
the `cub variant promote` receipt is missing. **A representative set of commands
(not run here — promotion is a ConfigHub-server action):**

```text
```

The full 0-row ready-to-run set is in [closeout.csv](./closeout.csv).

## Watch-grade — rerun on the fixed server (29)

Server-side promotion mechanics are proven for these, but the committed receipts
were recorded before the changeset-bound add-new-units server fix. The next action is:

> ConfigHub v0.1.80 includes the changeset-bound add-new-units fix; rerun this promotion proof to replace the old fallback receipt with a full pass.

| Chart | Base | Evidence |
| --- | --- | --- |
| argo-cd/argo-cd@9.5.15 | default | runs/argo-cd-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/mongodb@19.0.7 | static-passwords | runs/mongodb-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/mongodb@19.0.9 | existing-secret-replicaset | runs/cl-mongodb-19-0-9-existing-secret-replicaset-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/mongodb@19.1.0 | existing-secret-replicaset | runs/cl-mongodb-19-1-0-existing-secret-replicaset-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/mongodb@19.1.0 | static-passwords | runs/cl-mongodb-19-1-0-static-passwords-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/mysql@14.0.3 | static-passwords | runs/mysql-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/nginx@24.0.4 | existing-tls-ingress | runs/cl-nginx-24-0-4-existing-tls-ingress-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/nginx@24.0.4 | http-clusterip | runs/cl-nginx-24-0-4-http-clusterip-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/nginx@25.0.0 | existing-tls-ingress | runs/cl-nginx-25-0-0-existing-tls-ingress-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/nginx@25.0.0 | http-clusterip | runs/cl-nginx-25-0-0-http-clusterip-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/postgresql@18.6.10 | existing-secret | runs/cl-postgresql-18-6-10-existing-secret-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/postgresql@18.6.7 | static-passwords | runs/postgresql-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/postgresql@18.7.0 | existing-secret | runs/cl-postgresql-18-7-0-existing-secret-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/postgresql@18.7.0 | static-passwords | runs/cl-postgresql-18-7-0-static-passwords-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/rabbitmq@16.0.14 | static-passwords | runs/rabbitmq-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/redis@27.0.0 | default | runs/cl-redis-27-0-0-default-confighub-proof/latest/variant-promotion-receipt.yaml |
| bitnami/redis@27.0.0 | reuse-existing-secret | runs/cl-redis-27-0-0-reuse-existing-secret-confighub-proof/latest/variant-promotion-receipt.yaml |
| external-secrets/external-secrets@2.5.0 | default | runs/external-secrets-confighub-proof/latest/variant-promotion-receipt.yaml |
| grafana/grafana@10.5.15 | static-passwords | runs/grafana-confighub-proof/latest/variant-promotion-receipt.yaml |
| grafana/loki@7.0.0 | single-binary-filesystem | runs/loki-confighub-proof/latest/variant-promotion-receipt.yaml |
| grafana/tempo@1.24.4 | local-persistent | runs/tempo-confighub-proof/latest/variant-promotion-receipt.yaml |
| hashicorp/consul@2.0.0 | default-control-plane | runs/consul-confighub-proof/latest/variant-promotion-receipt.yaml |
| hashicorp/vault@0.32.0 | dev-mode | runs/vault-confighub-proof/latest/variant-promotion-receipt.yaml |
| ingress-nginx/ingress-nginx@4.15.1 | internal-clusterip | runs/ingress-nginx-confighub-proof/latest/variant-promotion-receipt.yaml |
| jetstack/cert-manager@v1.20.2 | crds-enabled | runs/cert-manager-confighub-proof/latest/variant-promotion-receipt.yaml |
| longhorn/longhorn@1.11.2 | default | runs/longhorn-confighub-proof/latest/variant-promotion-receipt.yaml |
| metrics-server/metrics-server@3.13.0 | default | runs/metrics-server-confighub-proof/latest/variant-promotion-receipt.yaml |
| prometheus-community/prometheus@29.8.0 | server-only-ephemeral | runs/prometheus-confighub-proof/latest/variant-promotion-receipt.yaml |
| secrets-store-csi-driver/secrets-store-csi-driver@1.6.0 | default | runs/secrets-store-csi-driver-confighub-proof/latest/variant-promotion-receipt.yaml |

## Blocked — needs the ConfigHub proof first (1)

No ConfigHub upload proof exists yet, so there is no clone to promote.

| Chart | Base | Next action |
| --- | --- | --- |
| argo-cd/argo-cd@9.5.17 | no-crds | run the ConfigHub proof lane first |

## Boundaries

- Read-only projection over `variant-promotion/status.csv`. No live run, no
  ConfigHub-server call, no `runs/` edit, and no status changed.
- `ready-to-run` lists the command; it does not run it. Promotion is a ConfigHub
  server action and is executed deliberately, not by this surface.
- A `watch-grade` row is a recorded decision (mechanics proven, old receipt still
  used the fallback), never silently rounded to proven.