apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "HelmPainReport"
metadata:
  name: "nvidia-cluster-readiness-engine-v0.6.0"
spec:
  chart:
    name: "nvidia/cluster-readiness-engine"
    version: "v0.6.0"
    source: "oci://ghcr.io/nvidia"
    digest: "dc85e9cb4ec6b481f62315c5cff95cc4353b58dfa2a5ba86cb347fb509ee8a43"
  supportedScopeStatus: "no-unhandled-pain-points-for-supported-scopes"
  supportedScopes:
    []
  supportedVariants:
    []
  productionReadiness: "not-reviewed-for-production"
  notes:
    - "This package is the exact cluster-readiness-engine@v0.6.0 chart, locked by archive URL and SHA-256."
    - "With chart defaults cluster-readiness-engine@v0.6.0 renders 43 objects as release nvcre in namespace nvcre: 7 CRDs, four cluster-scoped LogProfile objects of one of those CRDs, the manager Deployment, its RBAC, a metrics Service and a ServiceMonitor. It renders no Secrets and no Helm hooks."
    - "The packaged chart contains no lookup, no .Capabilities branch, no generated credential, no webhook configuration and no subchart."
    - "The manager ClusterRole grants access to trainer.kubeflow.org, resource.k8s.io and resource.nvidia.com resources. This chart installs none of those APIs."
    - "The upstream v0.6.0 release notes name the chart's registry manifest digest; scripts/lib/nvidia-gpu-stack-coverage.mjs records the same digest beside the archive SHA-256."
    - "The retained root proves exact source bytes, deterministic rendering, and deterministic ConfigHub installer packaging. It does not claim publication, live convergence, or production support."
  painPoints:
    -
      id: "source-lock"
      detectedPainPoint: "source-lock requires source-lock.yaml"
      evidence:
        - "source-lock.yaml"
      configHubHome: "source-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "source-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "dependency-lock"
      detectedPainPoint: "dependency-lock requires dependency-lock.yaml"
      evidence:
        - "dependency-lock.yaml"
      configHubHome: "dependency-lock"
      disposition: "absorbed-into-recipe"
      linkedReceipt: "dependency-lock.yaml"
      supportedVariantStatus: "handled"
    -
      id: "capability-profile"
      detectedPainPoint: "capability-profile is detected in this chart and mapped to a ConfigHub control point"
      evidence:
        - "control-points.yaml"
      configHubHome: "capability-profile"
      disposition: "handled-by-capability-profile"
      linkedReceipt: "revisions/default/r001/receipts/render-receipt.yaml"
      supportedVariantStatus: "handled"
    -
      id: "lifecycle-policy"
      detectedPainPoint: "no base's render contains a Helm hook object, with or without --no-hooks"
      evidence:
        - "no-hooks"
      configHubHome: "lifecycle-policy"
      disposition: "handled-by-lifecycle-policy"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "handled"
    -
      id: "crd-lifecycle"
      detectedPainPoint: "crd-lifecycle is detected in this chart and mapped to a ConfigHub control point"
      evidence:
        - "control-points.yaml"
      configHubHome: "lifecycle-policy"
      disposition: "handled-by-lifecycle-policy"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "review-required"
    -
      id: "target-facts"
      detectedPainPoint: "the seven nvcre.nvidia.com CRDs must be established before the four LogProfile objects, and the target must already have the Prometheus Operator ServiceMonitor CRD"
      evidence:
        - "control-points.yaml"
      configHubHome: "target-fact-requirement"
      disposition: "handled-by-target-fact-values"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "review-required"
    -
      id: "catalog-coverage"
      detectedPainPoint: "exact source and deterministic package are retained; publication, live qualification and production support remain separate gates"
      evidence:
        - "control-points.yaml"
      configHubHome: "recipe"
      disposition: "needs-operator-decision"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "packaged-with-controls"
    -
      id: "scan-gate"
      detectedPainPoint: "Current scan gate is warn-production-blocked"
      evidence:
        - "helm-plan.yaml"
        - "scan receipts"
        - "install gates"
      configHubHome: "scan-gate"
      disposition: "handled-by-scan-or-gate"
      linkedReceipt: "revisions/default/r001/receipts/install-gate.yaml"
      supportedVariantStatus: "warn-production-blocked"
    -
      id: "value-model-diagnostics"
      detectedPainPoint: "Helm values can be unknown, dead, misspelled, shadowed, or ignored unless the values model records the analysis boundary."
      evidence:
        - "value-model.yaml"
      configHubHome: "value-model"
      disposition: "absorbed-into-value-model"
      linkedReceipt: "value-model.yaml"
      supportedVariantStatus: "unknown=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof; dead=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof; ignored=not-exhaustively-checked-by-nvidia-gpu-stack-coverage-proof"
  answerForSkepticalHelmUser: "nvidia/cluster-readiness-engine@v0.6.0 maps its detected Helm pain to 8 ConfigHub control areas: source-lock, dependency-lock, capability-profile, lifecycle-policy, target-fact-requirement, recipe, scan-gate, value-model. No supported scopes are declared; production readiness remains not-reviewed-for-production."