apiVersion: "catalog.confighub.com/v1alpha1"
kind: "ConfigCatalogApplyPolicyFunctionalProofReceipt"
metadata:
  name: "catalog-standard-live-functional"
spec:
  recordedAt: "2026-07-27T19:46:07.092Z"
  context:
    name: "river-bear"
    organization: "helm-catalog"
    purpose: "temporary live policy fixtures"
  target:
    ref: "hx-policy-proof-cluster-20260727/oci"
    id: "f6864c9f-d57f-4da8-93eb-45bcf4c806b5"
    provider: "OCI"
    dryRunOnly: true
  filters:
    baseline:
      ref: "platform/helm-catalog-checks"
      id: "305d4b12-fd04-43ad-8aeb-be53c34a1b36"
      hash: "b42dcf124959da754d5b5bac08bce74bd450d6c6d52983af134f5fc7c8434554"
      triggerRefs:
        - "platform/aicr-training-images-pinned"
        - "platform/aicr-training-secret-refs"
        - "platform/digest-pinned-images"
        - "platform/lifecycle-route-evidence"
        - "platform/probes-declared"
        - "platform/vet-placeholders"
        - "platform/vet-schemas"
      triggerIds:
        - "04746183-327b-484e-b061-91d2c7753a76"
        - "1823a4c6-9743-467a-8e9a-5e1893e31d17"
        - "2651b7cc-31a2-4833-adde-11e018656dee"
        - "3f5dd412-1cf2-4583-a73a-12817f899c87"
        - "4d7664a3-9ac0-4160-868f-95eaa0b59f8f"
        - "5ce74cb1-7129-43c8-a48c-a0ba4322de3d"
        - "894ba8a0-eb84-4105-9557-4854f3739cf2"
    approvalRequired:
      ref: "platform/helm-catalog-prod-gates"
      id: "8784a447-0e4d-4471-b924-eae5377778a2"
      hash: "31133ade3ebd259030d3d2ef559e6aec14a62590779fbce9c0d13b188f717dc1"
      triggerRefs:
        - "platform/aicr-training-images-pinned"
        - "platform/aicr-training-secret-refs"
        - "platform/digest-pinned-images"
        - "platform/lifecycle-route-evidence"
        - "platform/probes-declared"
        - "platform/require-approval"
        - "platform/vet-placeholders"
        - "platform/vet-schemas"
      triggerIds:
        - "04746183-327b-484e-b061-91d2c7753a76"
        - "1823a4c6-9743-467a-8e9a-5e1893e31d17"
        - "2651b7cc-31a2-4833-adde-11e018656dee"
        - "3f5dd412-1cf2-4583-a73a-12817f899c87"
        - "4d7664a3-9ac0-4160-868f-95eaa0b59f8f"
        - "5ce74cb1-7129-43c8-a48c-a0ba4322de3d"
        - "894ba8a0-eb84-4105-9557-4854f3739cf2"
        - "9d281daf-79f4-4244-84cc-fbde411e3c11"
  checks:
    placeholder:
      effect: "block"
      finding: "unresolved ConfigHub placeholder"
      gate: "platform/vet-placeholders/vet-placeholders"
      space: "hx-policy-baseline-20260727194541"
      unit: "placeholder-fixture"
      unitId: "a597e2cc-a281-4acc-8570-a708cdfbc425"
      validationKeys:
        - "platform/vet-placeholders/vet-placeholders"
      applyGates:
        - "platform/vet-placeholders/vet-placeholders"
      dryRunApply:
        result: "blocked"
        exitCode: 1
        gate: "platform/vet-placeholders/vet-placeholders"
        dryRun: true
    schema:
      effect: "block"
      finding: "invalid Kubernetes field type"
      gate: "platform/vet-schemas/vet-schemas"
      space: "hx-policy-baseline-20260727194541"
      unit: "schema-fixture"
      unitId: "f1bc8daa-7114-4e29-9032-c523e534c5d3"
      validationKeys:
        - "platform/vet-schemas/vet-schemas"
      applyGates:
        - "platform/vet-schemas/vet-schemas"
      dryRunApply:
        result: "blocked"
        exitCode: 1
        gate: "platform/vet-schemas/vet-schemas"
        dryRun: true
    warnings:
      effect: "warn"
      findings:
        - "workload image is not pinned by digest"
        - "workload container has no liveness or readiness probe"
      triggers:
        - "platform/digest-pinned-images/vet-cel"
        - "platform/probes-declared/vet-cel"
      space: "hx-policy-baseline-20260727194541"
      unit: "warning-fixture"
      unitId: "759164fb-0fe9-45e2-b8ee-83a81c44b5b6"
      validationKeys:
        - "platform/digest-pinned-images/vet-cel"
        - "platform/probes-declared/vet-cel"
      applyGates:
        []
      dryRunApply:
        result: "allowed"
        exitCode: 0
        dryRun: true
        queuedOperationId: "31faddd2-e5dd-4fcf-bbea-550eac1a9a46"
    approval:
      effect: "block"
      finding: "system configuration has no recorded approval"
      gate: "platform/require-approval/vet-approvedby"
      space: "hx-policy-approval-20260727194541"
      unit: "approval-fixture"
      unitId: "f449e001-b76c-4647-8166-69646d433440"
      validationKeys:
        - "platform/require-approval/vet-approvedby"
      applyGates:
        - "platform/require-approval/vet-approvedby"
      dryRunApply:
        result: "blocked"
        exitCode: 1
        gate: "platform/require-approval/vet-approvedby"
        dryRun: true
      afterApproval:
        result: "allowed"
        revisionSelector: "HeadRevisionNum"
        headRevisionBefore: 1
        headRevisionAfter: 1
        recordedApprovals: 1
        gateCleared: true
        dryRunApply:
          result: "allowed"
          exitCode: 0
          dryRun: true
          queuedOperationId: "570a5436-735d-46c0-9921-209d690ee8ff"
    lifecycleRoute:
      effect: "block"
      finding: "automatic lifecycle route has no observed evidence"
      gate: "platform/lifecycle-route-evidence/vet-cel"
      result: "blocked"
      receipt: "data/hooks-crds-app/live-receipt.yaml"
      testedAt: "2026-07-27T06:39:52.630Z"
  cleanup:
    baselineSpace: "pass"
    approvalSpace: "pass"
  limits:
    - "Every apply command used --dry-run. No fixture configuration was applied to Kubernetes."
    - "The target was used only to exercise ConfigHub's apply boundary; this run does not test workload health or controller convergence."
    - "The fixtures prove the recorded checks for these exact inputs. They do not prove that every possible invalid configuration is detected."
    - "The lifecycle-route result comes from the separately recorded Hooks and CRDs App fixture."
    - "The AICR image and Secret checks are exercised by the separate live AI change review proof."
status:
  result: "pass"
  claim: "The live catalog policy blocked a placeholder, invalid Kubernetes data, and unapproved system configuration; allowed the same system configuration after its exact revision was approved; reported two advisory workload findings without blocking a dry run; and separately blocked an unsupported automatic lifecycle route."