apiVersion: "catalog.confighub.com/v1alpha1"
kind: "AIChangeReviewLiveProofReceipt"
metadata:
  name: "aicr-training-runtime-reviewed-approval"
spec:
  recordedAt: "2026-07-27T19:46:35.012Z"
  context:
    name: "river-bear"
    organization: "helm-catalog"
    purpose: "temporary live AI change review proof"
  source:
    type: "aicr"
    unsafeProposal: "data/ai-change-review/proposal.yaml"
    unsafeProposalSha256: "a2b4e3d81d2dbdb8656c759f9043163d472d72000983b2031e44e7c5ee2bec56"
    reviewedObject: "data/ai-change-review/reviewed.yaml"
    localReviewReceipt: "data/ai-change-review/receipt.yaml"
    sha256: "8f7394b1e54170f9f3721cc6ac7f19f1c788d967780a630fea891f11ffed7adf"
    identity:
      apiVersion: "trainer.kubeflow.org/v1alpha1"
      kind: "ClusterTrainingRuntime"
      name: "torch-distributed"
  storedConfiguration:
    space: "hx-ai-review-20260727t194622564z"
    unit: "reviewed-training-runtime"
    unitId: "b690c6a2-8aff-4265-b1ff-3ad02bda3508"
    sourceSha256: "8f7394b1e54170f9f3721cc6ac7f19f1c788d967780a630fea891f11ffed7adf"
    storedSha256: "2282cd0c0afd4f9194ed49ee83fc073b565c1425077fb623eae3e0ca70ae5e5b"
    byteForByteMatch: false
    semanticMatch: true
    contentHashBeforeApproval: 1816530773
    contentHashAfterApproval: 1816530773
  unsafeProposal:
    unit: "unsafe-training-runtime"
    unitId: "b1182bfd-c7ec-4a05-b27d-e177b13ffc24"
    validationKeys:
      - "platform/aicr-training-images-pinned/vet-cel"
      - "platform/aicr-training-secret-refs/vet-cel"
      - "platform/require-approval/vet-approvedby"
      - "platform/vet-placeholders/vet-placeholders"
    applyGates:
      - "platform/aicr-training-secret-refs/vet-cel"
      - "platform/require-approval/vet-approvedby"
      - "platform/vet-placeholders/vet-placeholders"
    dryRun:
      result: "blocked"
      exitCode: 1
      gate: "platform/aicr-training-secret-refs/vet-cel"
      dryRun: true
  policy:
    profile: "catalog-standard"
    resourceClass: "system-configuration"
    filter:
      ref: "platform/helm-catalog-prod-gates"
      id: "8784a447-0e4d-4471-b924-eae5377778a2"
      hash: "31133ade3ebd259030d3d2ef559e6aec14a62590779fbce9c0d13b188f717dc1"
      triggerRefs:
        - "platform/aicr-training-images-pinned"
        - "platform/aicr-training-secret-refs"
        - "platform/digest-pinned-images"
        - "platform/lifecycle-route-evidence"
        - "platform/probes-declared"
        - "platform/require-approval"
        - "platform/vet-placeholders"
        - "platform/vet-schemas"
      triggerIds:
        - "04746183-327b-484e-b061-91d2c7753a76"
        - "1823a4c6-9743-467a-8e9a-5e1893e31d17"
        - "2651b7cc-31a2-4833-adde-11e018656dee"
        - "3f5dd412-1cf2-4583-a73a-12817f899c87"
        - "4d7664a3-9ac0-4160-868f-95eaa0b59f8f"
        - "5ce74cb1-7129-43c8-a48c-a0ba4322de3d"
        - "894ba8a0-eb84-4105-9557-4854f3739cf2"
        - "9d281daf-79f4-4244-84cc-fbde411e3c11"
    approvalGate: "platform/require-approval/vet-approvedby"
    validationKeysBeforeApproval:
      - "platform/require-approval/vet-approvedby"
    applyGatesBeforeApproval:
      - "platform/require-approval/vet-approvedby"
    applyGatesAfterApproval:
      []
    aicrChecks:
      image:
        validationKey: "platform/aicr-training-images-pinned/vet-cel"
        effect: "warn"
        unsafeProposalReported: true
        reviewedCandidateReported: false
      apiKeySecret:
        validationKey: "platform/aicr-training-secret-refs/vet-cel"
        effect: "block"
        unsafeProposalBlocked: true
        reviewedCandidateBlocked: false
    ordinaryWorkloadChecks:
      validationKeys:
        - "platform/digest-pinned-images/vet-cel"
        - "platform/probes-declared/vet-cel"
      reportedForUnsafeProposal: false
      reportedForReviewedCandidate: false
      reason: "Deployment image and probe checks are scoped to ordinary Kubernetes workload kinds, so they leave this AICR custom resource alone."
  target:
    ref: "hx-policy-proof-cluster-20260727/oci"
    id: "f6864c9f-d57f-4da8-93eb-45bcf4c806b5"
    provider: "OCI"
    toolchain: "Any"
    dryRunOnly: true
  beforeApproval:
    result: "blocked"
    exitCode: 1
    gate: "platform/require-approval/vet-approvedby"
    dryRun: true
  approval:
    revisionSelector: "HeadRevisionNum"
    headRevisionBefore: 2
    headRevisionAfter: 2
    recordedApprovals: 1
    approverIdentityRecordedInReceipt: false
    gateCleared: true
  afterApproval:
    result: "allowed"
    exitCode: 0
    dryRun: true
    queuedOperationId: "35fe1008-95c2-4d75-b583-707bfa322823"
  cleanup:
    space: "pass"
  limits:
    - "The proposal is a deterministic fixture, not a transcript from a named AI model."
    - "The catalog-standard ConfigHub checks and approval ran. The four-node target-capacity check remains a repository check, not a ConfigHub Function."
    - "The AICR checks cover the nested image and AI_API_KEY fields in this trainer.kubeflow.org/v1alpha1 ClusterTrainingRuntime shape. They do not claim to cover every custom resource."
    - "All apply attempts used --dry-run against an OCI target. Nothing was applied to Kubernetes and no release artifact was published."
    - "The referenced training-provider-credentials Secret was not read or tested."
    - "This run did not test promotion, rollback, GPU workload health, or live observation."
    - "The temporary ConfigHub Space was deleted after the receipt was recorded."
status:
  result: "pass"
  claim: "ConfigHub reported the unsafe AICR image, blocked the inline API key, left the reviewed nested fields clear, stored the reviewed object without changing its Kubernetes fields, required approval, and then allowed the same dry run against the recorded OCI target."