apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "WebhookCertLifecycleStagingReceipt"
metadata:
  name: "prometheus-community-kube-prometheus-stack-86.1.0-default-webhook-cert-staging"
spec:
  chart: "prometheus-community/kube-prometheus-stack"
  version: "86.1.0"
  base: "default"
  result: "pass"
  observedAt: "2026-06-11T18:11:32.702Z"
  route: "generated-fact-staged-secret"
  stagedSecret:
    namespace: "monitoring"
    name: "kube-prometheus-stack-admission"
    keys:
      - "cert"
      - "key"
  generation:
    method: "local-self-signed-certificate"
    secretMaterialCommitted: false
  pairedObservation:
    receipt: "runs/next80-local-kind/prometheus-community-kube-prometheus-stack-86.1.0-default/observation-receipt.yaml"
    result: "pass"
    target: "claude-helm-expt-codex-cert-kps861"
    namespace: "monitoring"
  proofBoundary:
    - "Proves an explicit staged serving certificate Secret can replace a hidden chart lifecycle side effect for this local kind target."
    - "Does not claim production CA trust, admission policy safety, certificate rotation, or long-term serving certificate management."