apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ControlPoints"
metadata:
  name: "falcosecurity-falco-9-0-0"
spec:
  points:
    -
      category: "source-lock"
      status: "handled"
      evidence: "source-lock.yaml"
    -
      category: "dependency-lock"
      status: "handled"
      evidence: "dependency-lock.yaml"
      dependencyCount: 3
    -
      category: "capability-profile"
      status: "handled"
      kubeVersion: "1.30.0"
    -
      category: "variant-revision"
      status: "handled"
      evidence: "revisions/default/r001/variant-revision.yaml"
    -
      category: "rendered-manifest-scan"
      status: "handled"
      evidence: "revisions/default/r001/receipts/scan-receipt.yaml"
    -
      category: "helm-equivalence"
      status: "handled"
      evidence: "revisions/default/r001/receipts/helm-equivalence-receipt.yaml"
    -
      category: "target-facts"
      status: "source-signal-recorded"
      note: "default proof render was deterministic under pinned inputs; future variants must bind lookup-driven facts explicitly"
    -
      category: "generated-facts"
      status: "source-signal-recorded"
      note: "default proof render was deterministic; future generated material must be captured before approval"
    -
      category: "tpl-extension-slots"
      status: "source-signal-recorded"
      note: "tpl use is recorded for review and variant analysis"
    -
      category: "lifecycle-policy"
      status: "handled-by-no-hooks-proof"
      policy: "no-hooks"
      note: "hook templates are excluded from the approved rendered object revision"
    -
      category: "extension-slots"
      status: "source-signal-recorded"
      note: "raw/extra manifest knobs require explicit variant ownership before promotion"