# Top 20 Full Proof Target The 20-chart milestone means **20 full public-chart proofs**, not a spreadsheet with a few deep examples. Each chart in this target must have: - a recipe directory under `recipes////`; - a `cub installer` package directory under `packages////`; - source and dependency locks; - HelmPlan and ChartDossier artifacts; - at least one install variant, plus a second meaningful variant when the chart exposes one naturally; - rendered release objects and object inventory per variant revision; - render, Helm-equivalence, scan, install-gate, and installer-package receipts; - deterministic `cub installer package` proof; - `cub installer setup` output compared against regular Helm output; - verifier coverage wired into `npm run verify`; - a row in the generated proof spreadsheet that links back to receipts. The target count includes Redis because it is the first public-chart full proof. For the latest chart-version refresh lane, see [Latest Top-20 Refresh Plan](./latest-top20-refresh-plan.md) and: ```text data/latest-top20-refresh/ ``` ## Live ConfigHub Proof Status The top-20 set also has current ConfigHub proof evidence: ```text 20 / 20 ConfigHub proof receipt sets verified ``` Each receipt set proves the current command path: ```text cub installer doc/setup/render/package/vet/plan/upload ConfigHub Unit inventory and representative data/revision review cub variant create staging clone cub function vet checks cub changeset + approve + apply --dry-run safe boundary ``` The runner is quota-aware. For large charts, `--cleanup-spaces` removes temporary live proof spaces after receipts are written because the Kubara demo org has a finite Link quota. The receipt remains the durable proof artifact and records whether live spaces were retained or deleted after the run. ## Latest-Version Status The current refresh snapshot is generated by: ```sh npm run top20:latest-refresh ``` Current result: ```text 13 / 20 proofs are on the latest upstream chart version 7 / 20 have newer upstream chart versions available ``` The seven update candidates are: ```text argo-cd/argo-cd 9.5.15 -> 9.5.17 bitnami/mongodb 19.0.7 -> 19.1.0 bitnami/nginx 24.0.2 -> 25.0.0 bitnami/postgresql 18.6.7 -> 18.7.0 bitnami/redis 25.5.3 -> 27.0.0 prometheus-community/kube-prometheus-stack 85.3.3 -> 86.1.0 prometheus-community/prometheus 29.8.0 -> 29.9.0 ``` A newer chart version is a work order, not an automatic catalog promotion. Every updated version must rebuild the full recipe/package/proof/live-e2e chain before it replaces the supported catalog row. The first candidate stage is complete for all seven update candidates: ```text data/latest-top20-refresh/candidates/ npm run top20:latest-candidates:verify ``` This proves the latest chart versions can still produce deterministic recipe/package candidate artifacts and `cub installer` setup output that matches regular Helm semantically. It does not yet prove ConfigHub upload, server-side variant creation, live e2e, or production disposition for the new versions. ## Current Status ```text Full proofs complete: 20 / 20 Remaining full proofs: 0 / 20 ``` | # | Chart | Status | Proof Focus | | ---: | --- | --- | --- | | 1 | `bitnami/redis@25.5.3` | complete | generated facts, existing Secret variant, StatefulSet/PVC, Helm equivalence | | 2 | `metrics-server/metrics-server@3.13.0` | complete | target Secret fact, APIService, capability/RBAC gates | | 3 | `ingress-nginx/ingress-nginx@4.15.1` | complete | admission webhook variant, hook lifecycle policy, cluster RBAC | | 4 | `jetstack/cert-manager@v1.20.2` | complete | CRD-heavy control plane, webhook risk, startup lifecycle policy | | 5 | `external-secrets/external-secrets@2.5.0` | complete | CRD-heavy controller, dependency lock, webhook Secret/cert-controller | | 6 | `argo-cd/argo-cd@9.5.15` | complete | GitOps handoff, CRDs, raw extension slots, cluster RBAC | | 7 | `prometheus-community/kube-prometheus-stack@85.3.3` | complete | large umbrella chart, CRDs, dependencies, webhooks, generated Grafana credential, scale | | 8 | `bitnami/postgresql@18.6.7` | complete | generated credentials, stateful/PVC, upgrade-sensitive values | | 9 | `bitnami/rabbitmq@16.0.14` | complete | generated credentials, Erlang cookie, stateful/PVC, clustering policy | | 10 | `grafana/loki@7.0.0` | complete | blocked default render, required storage/schema values, MinIO object-store variant, ConfigMap normalization | | 11 | `longhorn/longhorn@1.11.2` | complete | 22 CRDs, storage lifecycle, privileged/daemon workloads, UI ingress variant | | 12 | `hashicorp/vault@0.32.0` | complete | TLS posture, injector webhook, init/unseal operate policy, HA Raft/UI variant | | 13 | `secrets-store-csi-driver/secrets-store-csi-driver@1.6.0` | complete | CSI driver, CRDs, DaemonSet, RBAC, sync Secret/rotation variant | | 14 | `prometheus-community/prometheus@29.8.0` | complete | monitoring stack, RBAC, PVCs, scrape configuration, server-only variant | | 15 | `grafana/grafana@10.5.15` | complete | deprecated chart status, dashboard/config extension slots, Secret handling, UI ingress exposure | | 16 | `bitnami/mysql@14.0.3` | complete | generated credentials, existing Secret variant, stateful/PVC, service variants | | 17 | `bitnami/mongodb@19.0.7` | complete | generated root password, existing Secret replica-set variant, storage/PDB/network policy | | 18 | `bitnami/nginx@24.0.2` | complete | generated TLS avoidance, existing TLS ingress variant, NetworkPolicy/PDB, low-friction UX | | 19 | `grafana/tempo@1.24.4` | complete | deprecated chart marker, local/S3 storage variants, ServiceMonitor capability, query ingress | | 20 | `hashicorp/consul@2.0.0` | complete | 28 CRDs, cluster RBAC, injector webhooks, secure mesh existing-Secret variant | Versions for rows 11-20 are pinned when their proof run is generated. The proof lock, not this planning table, is the source of truth for exact chart package SHA and dependency closure. ## Promotion Status All 20 target rows are promoted. The same contract has now been extended to another 80 public charts in the generated next-80 full-proof lane: ```text data/next80-full-proofs/ ``` That brings the public proof surface to: ```text 20 bespoke proofs 80 generated full proofs 100 total recipes and cub installer packages ``` The completed set alternates between deterministic rendered charts, generated-fact stateful charts, large umbrella charts, blocked/default charts, CRD-heavy controllers, and service/control-plane charts. That mix keeps the proof honest while still producing runnable artifacts. ## Spreadsheet Doctrine The top-20 spreadsheet is an evidence map. It must be generated from the proof artifacts and link to each chart's receipts. It is not the proof itself. Every row should answer, in plain English: ```text Can I install this safely? What variants exist? What did Helm render? What did cub installer produce? What differences are intentional? What scans/gates ran? What remains risky or blocked? Where are the receipts? ```