Hard Proof Gaps Shortlist · Config Workshop

Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this rendered repository document.

This generated shortlist joins the P0 source-quirk queue with remote dependency closure and hook route candidate data. It is the short assignment surface for the top-100 rows most likely to damage trust if the project overclaims them.

It does not say these charts are unsupported. It says the named gap must be modeled, routed, observed, or explicitly refused before stronger catalog or production claims are made.

Summary

shortlist rows: 25
catalog-supported rows on shortlist: 3
rows with remote dependency work: 20
rows with hook route candidates: 9

Main Gap Types

Gap	Rows
create-recipe-import-candidate	13
apiservice	4
dependency-range-policy	4
semver-compare	4

First Rows

Rank	Chart	Main gap	Why it matters	First action
1	`k8s-dashboard/kubernetes-dashboard@7.14.0`	apiservice	APIService aggregation can pass render parity while failing at API aggregation or TLS/runtime readiness.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
2	`gitlab/gitlab@10.0.0`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
3	`datadog/datadog@3.214.0`	apiservice	APIService aggregation can pass render parity while failing at API aggregation or TLS/runtime readiness.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
4	`kong/kong@3.2.0`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
5	`bitnami/kafka@32.4.3`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
6	`bitnami/minio@17.0.21`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
7	`bitnami/thanos@17.3.1`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
8	`prometheus-community/kube-prometheus-stack@85.3.0`	semver-compare	version-conditional templates can change rendered objects under a different Kubernetes, chart, or dependency version.	promote version-conditional rendering into chart facts and variant-path coverage
9	`grafana/loki@7.0.0`	semver-compare	version-conditional templates can change rendered objects under a different Kubernetes, chart, or dependency version.	promote version-conditional rendering into chart facts and variant-path coverage
10	`apache-airflow/airflow@1.21.0`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer
11	`kyverno/kyverno@3.8.1`	dependency-range-policy	non-exact dependency ranges can silently change the rendered dependency closure during refresh.	record dependency range policy and refresh-survival check for non-exact dependency constraints
12	`bitnami/keycloak@25.2.0`	create-recipe-import-candidate	source-only charts have no maintained recipe path, so catalog claims would be disconnected from proof artifacts.	create recipe/import candidate and write dependency-lock.yaml before treating the chart as a catalog offer

Catalog Rows On The Shortlist

These rows are visible because they are already public catalog entries or have strong proof surfaces. They should be kept honest first.

Chart	Main gap	Next artifact
`prometheus-community/kube-prometheus-stack@85.3.0`	semver-compare	chart facts axis plus capability/version matrix row
`grafana/loki@7.0.0`	semver-compare	chart facts axis plus capability/version matrix row
`metrics-server/metrics-server@3.13.0`	apiservice	chart facts axis plus lifecycle observation receipt

How To Use This

Pick a row from the top of the table.
Open the source evidence and required artifact.
Decide whether the gap becomes a modeled fact, a route receipt, a runtime observation, a better base variant, or an explicit blocker.
Regenerate the owning queue before changing any support or catalog claim.

Source Tables

Source	Use
quirk-work-queue/top100-queue.csv	P0 source-quirk queue and first action.
remote-dependency-closure/top100.csv	Dependency closure and refresh-survival workstreams.
hook-route-candidates/candidates.csv	Candidate routes for hook-bearing source charts not yet in the maintained queue.
top100-coverage/work-queue.csv	Current top-100 promotion, variant, and limitation queues.