One OCI bundle delivered three ways

Generated at: 2026-07-30T12:38:02.000Z UTC · source: committed helm-expt evidence for this rendered repository document.

UNOFFICIAL/EXPERIMENTAL. Live receipt generated by scripts/run-oci-hook-delivery-proof.mjs; do not hand-edit. Regenerate with npm run oci-hook:proof.

This run checks whether Argo CD, Flux, and a direct-apply path can pull the same ConfigHub release OCI, apply its workload, and run its routed hook.

ConfigHub published tests/fixtures/hook-replacement-probe once to oci.hub.confighub.com:443. Each consumer pulled that bundle on one throwaway test cluster. Publish: pass.

Consumer	OCI source	workload applied	hook ran	result
Argo CD	OCI Application	yes	yes	pass
Flux	OCIRepository	yes	yes	pass
cub-direct (no controller)	oras pull	yes	yes	pass

Overall: pass. The workload and routed hook completed under all three consumers in this run.

This is a test of one small routed-hook fixture. It proves that the delivery mechanism works through all three consumers. It does not prove that every catalog configuration has been delivered through all three. A catalog configuration has delivery proof only when its own page names a receipt.

Argo CD uses an Application whose source.repoURL is the OCI bundle.
Flux uses an OCIRepository and Kustomization at the same URL. The OCI pull Secret is copied into flux-system and is never printed.
cub-direct uses oras pull and kubectl apply without a controller.
Legs are best-effort: a non-converged consumer is watch with its reason, not a silent failure.
Receipt: runs/oci-hook-delivery-proof/receipt.yaml. Fixture: tests/fixtures/hook-replacement-probe.