UNOFFICIAL/EXPERIMENTAL. Offline receipt generated by scripts/run-managed-setup-guidance.mjs; do not hand-edit. Regenerate with npm run managed-setup-guidance:proof.
Claim. The two non-delivery adoption findings are manageable at the setup edge. Customize friction (#1009): every Helm idiom cub rejects (unknown flag: --set, unknown input) maps to a plain migration hint. Shared placeholder password (#1012): the safer package default uses the existing-secret base, so a normal setup does not bake the shared demo password. The suggested Secret commands generate fresh values before apply.
Customize friction (#1009) → guided
Every Helm idiom cub rejects now maps to a plain migration hint. 5/5 idioms guided (the friction lane found 0/72).
| Helm idiom | Real cub error | Managed guidance |
|---|---|---|
--set replicaCount=2 | Error: unknown flag: --set | cub has no --set. Declared inputs use --input KEY=VALUE (cub installer doc <pkg> lists them); most values are set by choosing or editing a kustomize base, not a flag. See docs/user/helm-to-cub-migration.md. |
--values values.yaml | Error: unknown flag: --values | cub has no values file. Configuration lives in the base (kustomize) - pick or edit a base instead of a values.yaml. See docs/user/helm-to-cub-migration.md. |
-f values.yaml | Error: unknown shorthand flag: 'f' in -f | cub rejected this input. cub uses declared --inputs plus kustomize bases rather than Helm's --set/values files; see docs/user/helm-to-cub-migration.md. |
--set-string image.tag=7.4 | Error: unknown flag: --set-string | cub has no --set. Declared inputs use --input KEY=VALUE (cub installer doc <pkg> lists them); most values are set by choosing or editing a kustomize base, not a flag. See docs/user/helm-to-cub-migration.md. |
--input replicaCount=2 | Error: unknown input "replicaCount" | cub rejects non-declared inputs by design - this is the typo guard that catches what Helm silently absorbs. To set it: confirm it's a declared input (cub installer doc <pkg>), or edit the base. |
Shared placeholder password (#1012) → detected + routed
0/2 charts warned. Secret VALUES are never decoded or printed - only password key names/counts are read, to honor the credential-handling constraint.
| Chart | Default base | Bakes a password? | reuse base | Managed warning |
|---|---|---|---|---|
| bitnami | reuse-existing-secret | no | reuse-existing-secret | No baked password Secret in the default base (reuse-existing-secret). |
| bitnami | existing-secret | no | existing-secret | No baked password Secret in the default base (existing-secret). |
The determinism tension (why cub can't just "generate a random password")
cub's deterministic render (#1011) and Helm's random-per-install password are different safety models. The package answer is reuse-existing-secret: create or supply the Secret before apply, keep the Secret material outside the rendered chart, and make fixed-password demo bases explicit.
Overall: pass. Both non-delivery findings are managed: opaque Helm-idiom rejections become guided migration hints, and the normal setup path no longer bakes the shared placeholder password. With the delivery applier (managed-cub-direct), all five adoption findings now have a concrete 'manage it'.
- Receipt:
runs/managed-setup-guidance/receipt.yaml.