Roadmap: corpus, tests, fuzz, and migration-UX

UNOFFICIAL/EXPERIMENTAL. Planning doc for the non-website work - corpus, tests, fuzz, and the doc/data surfaces that feed UX. Filed as source-only PRs (no self-merge). Codex owns website UX; this roadmap deliberately stays out of the site renderer.

Principle: test OUR tool, honestly

The pivot that drives this roadmap: stop cataloging Helm's footguns and asserting our model is better - test cub itself for bugs, and report findings (rough edges) honestly rather than taking a victory lap. The cub-installer fuzz already earned that posture (0 serious bugs, but 2 real namespace-validation rough edges surfaced, not buried).

The persona taxonomy - who breaks the tool

Lane H is the adoption-friction lane: the dev does everything right by Helm's rules, and it breaks anyway because cub's model (declared inputs / bases / kustomize) isn't Helm's free-form --set. The question that decides adoption isn't "does cub reject it" - it's **does cub reject it *with guidance*** or opaquely. Its classification is therefore about error-message quality: guided / opaque / silent-wrong / supported.

PR sequence (offline-first)

1. cub-installer fuzz + #1006 reframe (shipped) - fuzz cub installer with careless + adversarial input; classify cub's behavior (reject-unknown / reject-validation / rendered / crash / injection / silent-swallow) + honest rough-edge findings. Reframe the merged Helm comparison (#1006) to drop the unmeasured "config-as-data surfaces 100%" claim → "Helm's footgun profile," pointing to the cub fuzz as the measured lane.
2. Helm-fluent migrant friction lane (shipped) - feed valid Helm idioms to cub installer (--input replicaCount=3, -f values.yaml, --set image.tag, --set-string, array syntax, release-name semantics) and classify the guidance quality. Headline metric: how often does cub guide the Helm migrant vs leave them stuck? Current result: safe but opaque, with a user-facing Helm→cub migration guide.
3. cub-installer determinism (shipped first cut) - same input twice → byte-identical render, across the current package sample. This proves the diff premise for that sample.
4. cub-installer fuzz expansion - more packages (8 → ~20 that render), more input classes (bad values for declared inputs, --select/--components fuzzing, --set-image ref fuzzing, edge values: unicode / empty / huge / whitespace). Hunt more cub rough edges.
5. Careless-dev corpus broadening - more charts (10 → 20+ that baseline-render) and more decision types, including security-relevant ones (privileged, hostPath, capabilities, runAsRoot) so the footgun profile covers the dangerous cases, not just the silly ones.
6. Helm→cub migration cheat-sheet (shipped) - turn the lane-H findings into a user-facing "you did X in Helm; here's the cub way" surface (md + csv + colored HTML). UX content that Codex's site can render; not the site itself.
7. Default-credential check (shipped first cut) - detect deterministic placeholder credentials in default bases and keep them visible as watch until names, warnings, and production routes are clear.
8. cub-direct prune gap proof (shipped first cut) - prove the no-controller apply path does not prune removed resources unless it uses kubectl apply --prune or an equivalent delete-set.
9. Test-map + doctrine update - fold the cub-installer fuzz and lane H into tests/README.md and tests/doctrine.md; refresh the persona taxonomy above.

Constraints (so this survives an unattended session)

• Offline-first. helm template and cub installer setup are local renders - no cluster, no quota, robust to the Mac sleeping. Prefer them while unattended.
• Honest disposition. Findings (rough edges) are surfaced, not buried; bugs flagged; never a victory lap. watch ≠ pass.
• One source of truth for shared corpora (the scripts/lib/bad-decisions.mjs pattern).
• Source-only; no self-merge. Codex / the user owns merges and all website UX.

Here is what the command does. cub installer is an open-source plugin for the cub CLI. cub installer setup pulls a catalog package and writes its Kubernetes files locally, leaving delivery to kubectl, Argo CD or Flux. The generated scripts stop before doing any work when the plugin or kustomize is missing.

Deferred - needs an attended session (live cub-lk, sleep-kill risk)

• Real catalog hook charts through the OCI 3-controller proof (extend run-oci-hook-delivery-proof).
• Day-2 upgrade + rollback live receipt (back day2-upgrade-rollback.md with evidence).

These are valuable but need a live rig that survives the run; do them at-keyboard.