Top-500 Catalog Analysis

This is the public catalog proof index for the Helm mission.

It combines two kinds of evidence:

New to cub? Install the cub CLI first. You can pull and render public catalog packages without an account. Commands that save or change ConfigHub data require you to sign in.

source-feature reconnaissance
  + current ConfigHub/cub installer recipe evidence

The source scan tells us what Helm complexity exists in popular charts. The catalog proof columns tell us whether this repo already has a current recipe, package, variant, rendered digest, scan/gate evidence, and catalog status for that chart.

Summary

rows: 500
source scanned: 495
source failed: 5
current proof recipes in repo: 100
retained newer candidate proof versions: 10
current proof recipes matched to retained source-scan rows: 91
current proof recipes not represented in retained source-scan rows: 9
current recipe proofs: 91
proof matched by exact chart ref: 63
proof matched by chart name and version: 16
proof matched by chart name only: 12
exact source/current version matches: 70
current recipe version differs from retained source-scan row: 21
no current recipe proof: 409
catalog-supported: 20
proof-grade: 71
multi-variant proofs: 62
default-only proofs: 29
catalog-supported production-blocked: 0
catalog-supported production-review-ready: 20

What We Learn

• Helm complexity is normal, not exceptional. The high-rank rows include CRDs, hooks, generated facts, lookup, tpl, RBAC, webhooks, and stateful storage.
• 100 current chart recipe/package/proof artifacts exist in this repo.
• 10 newer candidate version artifact(s) are retained separately and are not counted as additional chart coverage.
• 91 of the top-500 source rows currently match those proof artifacts.
• 20 matched rows are catalog-supported for the declared local-test scope.
• 71 matched rows are proof-grade default installs. They prove deterministic render/package behavior, but they still need user-shaped variants before catalog promotion.
• 409 rows still have source reconnaissance only. They are useful backlog data, not product proof.
• 21 rows have a current recipe for the chart but at a different version than the original source-scan row. These are upgrade/freshness review candidates.
• The practical next work is visible: add variants to high-rank proof-grade charts, record target-scoped support decisions for review-ready catalog charts, and create recipes for high-rank rows with no current proof.

Recent Catalog Learnings (2026-06)

• "Supported" means Level 2. A chart is supported when every Helm quirk it uses is either modeled or explicitly disclosed (operator-decision / blocker) with zero silent gaps. Variant richness is an enhancement on top of that bar, not the bar itself - all 100 current proof recipes are Level-2 supported.
• A deterministic variant generator now promotes enhancement variants. scripts/generate-variant-proof.mjs captures a helm template render as a package base, proves Helm-equivalence (cub installer setup re-emits it), and regenerates all bookkeeping; scripts/run-variant-wave.mjs drives it in resumable waves. Three waves (no-crds ×2, ha) lifted multi-variant proofs in this matrix to 62.
• Hooks are routed through lifecycle policy. Render equivalence does not prove hook execution. A chart with hooks still needs a lifecycle disposition for the chosen route, such as plain applied resources, GitOps-controller behavior, or an operator-reviewed action, plus lifecycle or observation receipts before production support.
• Placeholders ≠ extension slots. Safe, bounded fill-fields (image, replicas, hostname) are placeholders - filled on derived ConfigHub variants with no re-render. Open injection points (extraManifests, tpl) are extension slots - arbitrary, shape-changing, flagged for per-use review. Governed differently.
• Honest gaps, disclosed not hidden: secret-delivery (many secret-rendering charts ship no existing-secret toggle, so that variant isn't buildable); template-rendered CRDs (17 charts bake CRDs in templates/ not crds/, so a clean no-crds variant needs a chart-specific --set toggle or isn't available); curated proof-lane drift (the 20 curated per-chart lanes carry a pre-existing installer.yaml source-SHA mismatch from target-facts / namespace-transformer changes - tracked separately).

How To Read The Files

Important Boundary

This matrix is an evidence map, not a blanket certification.

catalog-supported = recommended only for the declared scope
proof-grade = deterministic proof exists, but product variants/review remain
source reconnaissance only = no product proof yet

Next Promotion Candidates

These are high-rank proof-grade rows that need real variants before promotion.

First Rows Without Current Proof

Outputs

data/top500-catalog-analysis/raw.json
data/top500-catalog-analysis/review.csv
data/top500-catalog-analysis/drilldown.csv
data/top500-catalog-analysis/summary.md
data/top500-catalog-analysis/source/source-feature-scan.raw.json