Intent: A standalone redis with TLS on, certs auto-generated
Switches the agent mapped it to: architecture=standalone, tls.enabled
Mapped by: claude (live mapping)
The intent is the only step an AI performed. The chart's renderer produced the objects; the parity gate below certifies they are the genuine chart output.
The gate
| Check | Result |
|---|---|
| Composition | +1 objects, -4 objects vs baseline (14); interaction observed: true |
| Determinism | DIVERGED (15d839c1bf9fb864…) |
| Route disposition | none |
Objects added: v1/Secret/redis-crt
Objects removed: policy/v1/PodDisruptionBudget/redis-replicas, v1/ServiceAccount/redis-replica, v1/Service/redis-replicas, apps/v1/StatefulSet/redis-replicas
Routing
No routed quirks introduced by these switches.
Verdict
FAIL. Parity gate FAILED. The variant is not allowed to exist as mapped. The correct route forward is named in this receipt.
The correct route forward
Render-time TLS generation mints new certificates on every render, so the output can never be reproducible config. Keep certificate material out of the render. Use the chart's existing-secret form (for redis: tls.enabled with tls.existingSecret and the cert/key/CA filenames) against a pre-staged Secret, or let cert-manager own issuance and rotation on the target. Then regenerate: the render becomes deterministic, the Secret lives in a SecretStore instead of the rendered output, and the variant can exist.
A refusal is not a wall. The block names the failing check; this section names what to do instead in this paradigm, so the next attempt is the right one.
Why this is not a hallucination
Pilot chose the switches. The chart rendered the objects. The gate proves the object set is exactly the sum of the switch-effect map's predictions plus any interaction it renders and reports, that the render is reproducible, and that the one routed quirk is named. An AI that wrote this YAML directly could ship a plausible but wrong object set; this flow cannot, because a wrong set fails composition and a non-reproducible one fails determinism.