apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "GitOpsRuntimeReview"
metadata:
  name: "trust-manager-no-crds-cert-manager-pass"
  chart: "jetstack/trust-manager"
  version: "v0.22.1"
spec:
  base: "no-crds"
  controller: "Argo CD"
  targetShape: "cub-managed kind proof cluster with target profile kind-cert-manager"
  receipt: "runs/live-helm-confighub-compare/jetstack-trust-manager-no-crds/receipt.yaml"
  observedResult: "pass"
  targetProfile:
    name: "kind-cert-manager"
    sourcePackage: "jetstack/cert-manager@v1.20.2"
    sourceBase: "crds-enabled"
    provides:
      - "the six cert-manager CRDs"
      - "the cert-manager, cainjector, and webhook controllers"
      - "a controller that reconciles trust-manager's Issuer and Certificate"
  currentSummary:
    regularHelmRuntime: "pass"
    configHubDirectRuntime: "pass"
    configHubOciSync: "Synced"
    configHubOciHealth: "Healthy"
    semanticParity: "pass"
  passed:
    - "regular Helm reached readiness"
    - "ConfigHub direct apply reached readiness"
    - "ConfigHub published the workload Space and cluster Space as OCI releases"
    - "ConfigHub OCI/Argo synced all rendered Units and reported Healthy"
    - "the trust-manager Deployment reached readiness"
    - "trust-manager's Issuer and Certificate were reconciled by cert-manager"
    - "semantic object parity passed with zero object diffs for direct apply and OCI/Argo"
  previousObservation:
    base: "default"
    receipt: "runs/live-helm-confighub-compare/jetstack-trust-manager-default/receipt.yaml"
    result: "watch"
    detail: "On a plain kind target without a cert-manager controller, Argo synced the objects but remained Progressing because the chart's Certificate could not be reconciled."
  diagnosis:
    summary: "The earlier watch was caused by a missing target prerequisite, not by a render difference or an Argo health-reporting delay."
    interpretation: "Use the no-crds preset when the platform owns the trust-manager CRDs. Install and verify cert-manager first; trust-manager can then be delivered by Helm, direct apply, or ConfigHub OCI through Argo."
  nextActions:
    - "Use a target with a working cert-manager controller before installing trust-manager."
    - "Keep the trust-manager CRDs under explicit platform ownership when using the no-crds preset."
    - "Replace the local kind profile with evidence from the real target's cert-manager, certificate policy, and CRD lifecycle before making a production claim."
  evidence:
    argoCoreChildJson: "runs/live-helm-confighub-compare/jetstack-trust-manager-no-crds/argocd-core-child.json"
    argoCoreChildTree: "runs/live-helm-confighub-compare/jetstack-trust-manager-no-crds/argocd-core-child-tree.txt"
    argoCoreRootJson: "runs/live-helm-confighub-compare/jetstack-trust-manager-no-crds/argocd-core-root.json"
    argoCoreRootTree: "runs/live-helm-confighub-compare/jetstack-trust-manager-no-crds/argocd-core-root-tree.txt"
  notClaimed:
    - "This row does not prove trust-manager production support for arbitrary targets."
    - "This row does not prove the default base or a target without cert-manager."
    - "This row does not prove long-term certificate rotation or webhook certificate renewal."