Generated Community support directory

Supported tools, with the boundary in view.

Browse the current development capabilities from the accepted local inventory, then inspect the retained source references that support discovery and provenance. Projects start collapsed: expand a project to inspect its scoped scenarios, evidence and local commands. Capabilities cover exact reviewed transitions, named local checks, standards conformance subsets, target preflight profiles or bounded community project checks. The current scope includes Kubernetes FlowSchema and PriorityLevelConfiguration API checks, Cilium cluster-name validation, containerd CRI and selected bundled-runtime checks, a Prometheus remote-write HTTP/2 requirement, and separate MariaDB Server and MariaDB Operator checks. When the inventory declares a local preparer, the card shows its bounded command and limit; it reuses an existing rule and does not infer runtime behavior or add coverage counts. This page describes the open-source CLI; an official prebuilt release and metadata feed are not published yet. The directory does not turn references or catalogue identities into compatibility support.

Open source · early alphaExecutable checks use exact reviewed transitions, named local checks, explicitly named conformance profiles, exact target preflight profiles or bounded community project checks, each with its declared input scope. Missing, ambiguous or unsupported evidence remains UNKNOWN. Whole-upgrade compatibility remains UNKNOWN.

Find a local check: use prufyx catalog checks --project SLUG to list embedded source-rule identities and the available exact input routes. See the community checks guide for version filters and input boundaries.

Generated Community support directory

Find the project and evidence you need.

Every entry below comes from the generated support inventory. Executable checks cover exact reviewed transitions, named local checks, standards conformance subsets, target preflight profiles or bounded community project checks. Retained source references are counted separately and never become compatibility support by selection alone.

65projects with executable checks

190CNCF transition rules across 53 CNCF projects

34community-project checks across 8 projects

2named local checks

2conformance profiles across 2 projects

1target preflight profiles across 1 project

11additional reference-only projects

110selected records across 58 projects

Search projectsShow

argo-cdArgoEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project argo-cd

argo-cd.plain-http-oci-repository-helm4.3-0-23-to-3-5-2pkg:github/argoproj/argo-cd · 3.0.23 → 3.5.2

Evidence: source · reference · lines 1-1 · source · reference · lines 446-453 · source · reference · lines 5-31 · source · reference · lines 80-143 · source · reference · lines 330-382 · source · reference · lines 195-272 · source · reference · lines 49-57

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

argo-cd.plain-http-oci-repository-helm4.3-1-16-to-3-5-2pkg:github/argoproj/argo-cd · 3.1.16 → 3.5.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

argo-cd.plain-http-oci-repository-helm4.3-2-12-to-3-5-2pkg:github/argoproj/argo-cd · 3.2.12 → 3.5.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

argo-cd.plain-http-oci-repository-helm4.3-3-14-to-3-5-2pkg:github/argoproj/argo-cd · 3.3.14 → 3.5.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

argo-cd.plain-http-oci-repository-helm4.3-4-8-to-3-5-2pkg:github/argoproj/argo-cd · 3.4.8 → 3.5.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

argo-cd.required-rbac-inheritance.3-0pkg:github/argoproj/argo-cd · 2.14.0 → 3.0.0

Evidence: source · reference · lines 12-24

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

argo-cd.resource-exclusions-v2-visibility-preservation.3-0pkg:github/argoproj/argo-cd · 2.14.0 → 3.0.0

Checks one caller-selected complete, precedence-resolved native Argo CD argocd-cm YAML from 2.14.0 to 3.0.0 only when explicit v2-visibility-preservation intent is true. The exact reviewed target resource.exclusions default is a scoped blocker; absent or explicit empty is a scoped pass. Other values, resource existence, watches, UI, reconciliation, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 1-7 · source · reference · lines 759-782 · source · reference · lines 59-118 · source · reference · lines 60-75 · source · reference · lines 787-810

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project argo-cd · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

Local preparer: prufyx check cncf --project argo-cd --config-map FILE --from 2.14.0 --to 3.0.0 · Checks one caller-selected native Argo CD argocd-cm JSON for the selected inheritance setting and explicit RBAC intent. It evaluates only that selected rule; other project rules, ConfigMap keys, RBAC grants, resource existence, watches, UI, reconciliation, runtime behavior, and whole-upgrade safety remain UNKNOWN.

Local preparer: prufyx check cncf --project argo-cd --resource-exclusions-config-map FILE --from 2.14.0 --to 3.0.0 --resource-exclusions-config-complete --resource-exclusions-precedence-resolved --requires-v2-visibility-of-v3-default-excluded-resources true · Checks one caller-selected complete, precedence-resolved native Argo CD argocd-cm YAML for an absent, explicit empty, or exact reviewed resource.exclusions target default with explicit v2-visibility-preservation intent. Other values, resource existence, watches, UI, reconciliation, runtime behavior, and whole-upgrade safety remain UNKNOWN.

2 selected source records

changelog · reference_only · lines 1-5 · migration_guide · reference_only · lines 12-24

Reference metadata only; source selection does not create executable upgrade support.

argo-workflowsArgo WorkflowsEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project argo-workflows

argo-workflows.server-basehref.3-4-18-to-4-1-3pkg:github/argoproj/argo-workflows · 3.4.18 → 4.1.3

Evidence: source · reference · lines 1-30 · source · reference · lines 194-208 · source · reference · lines 130-140 · source · reference · lines 195-224

Scoped literal argv constraint for one selected native Kubernetes workload container; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

argo-workflows.server-basehref.3-5-15-to-4-1-3pkg:github/argoproj/argo-workflows · 3.5.15 → 4.1.3

Evidence: source · reference · lines 194-208 · source · reference · lines 1-30 · source · reference · lines 130-140 · source · reference · lines 195-224

Scoped literal argv constraint for one selected native Kubernetes workload container; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

argo-workflows.server-basehref.3-5-to-3-6pkg:github/argoproj/argo-workflows · 3.5.0 → 3.6.0

Evidence: source · reference · lines 208-221 · source · reference · lines 14-26 · source · reference · lines 114-116 · source · reference · lines 447-449 · source · reference · lines 23-28 · source · reference · lines 192-197 · source · reference · lines 19-27

Scoped literal argv constraint for one selected native Kubernetes workload container; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

argo-workflows.server-basehref.3-6-19-to-4-1-3pkg:github/argoproj/argo-workflows · 3.6.19 → 4.1.3

Evidence: source · reference · lines 194-208 · source · reference · lines 1-30 · source · reference · lines 130-140 · source · reference · lines 195-224

Scoped literal argv constraint for one selected native Kubernetes workload container; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

argo-workflows.server-basehref.3-7-18-to-4-1-3pkg:github/argoproj/argo-workflows · 3.7.18 → 4.1.3

Evidence: source · reference · lines 194-208 · source · reference · lines 1-30 · source · reference · lines 130-140 · source · reference · lines 195-224

Scoped literal argv constraint for one selected native Kubernetes workload container; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

argo-workflows.server-basehref.4-0-11-to-4-1-3pkg:github/argoproj/argo-workflows · 4.0.11 → 4.1.3

Evidence: source · reference · lines 194-208 · source · reference · lines 1-30 · source · reference · lines 130-140 · source · reference · lines 195-224

Scoped literal argv constraint for one selected native Kubernetes workload container; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

Local preparer: prufyx prepare project --project argo-workflows · Requires a caller-declared complete selected-container argv, exact reviewed image, and explicit command or the reviewed exact-image ENTRYPOINT default; unsupported context remains UNKNOWN.

buildpacksBuildpacksEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project buildpacks

buildpacks.lifecycle-platform-api-support.0-16-5-to-0-17-7pkg:oci/buildpacksio/lifecycle · 0.16.5 → 0.17.7

Checks the operator-selected Platform API against support declared by the supplied current and proposed Lifecycle OCI configuration labels. Lifecycle and Platform API versions are separate inputs. It does not establish registry or image provenance, run a build, or prove that the platform implementation supports the selected API.

Evidence: source · reference · lines 66-100 · source · reference · lines 10-12 · source · reference · lines 10-18

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cephCephEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project ceph

ceph.selected-osd-filestore.15-2-17-to-20-2-4pkg:github/ceph/ceph · 15.2.17 → 20.2.4

Evidence: source · reference · lines 6511-6524 · source · reference · lines 5656-5700 · source · reference · lines 1-6 · source · reference · lines 46-56 · source · reference · lines 1-6

Scoped current-backend constraint for one explicitly selected caller-supplied OSD metadata object; it does not assert other OSDs, cluster inventory, target deployment, whole-upgrade safety, or runtime behavior.

ceph.selected-osd-filestore.16-2-15-to-20-2-4pkg:github/ceph/ceph · 16.2.15 → 20.2.4

Evidence: source · reference · lines 6743-6756 · source · reference · lines 5776-5821 · source · reference · lines 1-6 · source · reference · lines 46-56 · source · reference · lines 1-6

ceph.selected-osd-filestore.17-2-9-to-20-2-4pkg:github/ceph/ceph · 17.2.9 → 20.2.4

Evidence: source · reference · lines 7001-7014 · source · reference · lines 5772-5817 · source · reference · lines 1-6 · source · reference · lines 46-56 · source · reference · lines 1-6

ceph.selected-osd-filestore.17-2-to-18-2pkg:github/ceph/ceph · 17.2.7 → 18.2.0

Evidence: source · reference · lines 49-64 · source · reference · lines 6896-6913 · source · reference · lines 5758-5793 · source · reference · lines 46-63

ceph.selected-osd-filestore.18-2-8-to-20-2-4pkg:github/ceph/ceph · 18.2.8 → 20.2.4

Evidence: source · reference · lines 7052-7065 · source · reference · lines 5788-5833 · source · reference · lines 1-6 · source · reference · lines 46-56 · source · reference · lines 1-6

ceph.selected-osd-filestore.19-2-6-to-20-2-4pkg:github/ceph/ceph · 19.2.6 → 20.2.4

Evidence: source · reference · lines 6979-6992 · source · reference · lines 5745-5790 · source · reference · lines 1-6 · source · reference · lines 46-56 · source · reference · lines 1-6

Local preparer: prufyx prepare project --project ceph · Requires one caller-selected current OSD metadata object, an exact matching numeric OSD id, and explicit object completeness; it does not inspect a cluster or target deployment.

cert-managercert-managerEXECUTABLE + SELECTED SOURCES1 executable capability; 3 retained sources

Official repository

Named local check

prufyx check cert-manager-values

Exact reviewed transition: 1.20.3 → 1.21.1

Exact reviewed transition: 1.20.3 → 1.21.2

Exact reviewed transition: 1.19.6 → 1.21.2

Exact reviewed transition: 1.18.6 → 1.21.2

Exact reviewed transition: 1.17.4 → 1.21.2

Exact reviewed transition: 1.16.5 → 1.21.2

Checks only three curated removed values paths; it does not validate the full target schema, runtime behavior, or whole-upgrade compatibility.

Official source evidence: source · reference

Official source evidence: source · reference · lines 211-213 · source · reference · lines 28-32

Official source evidence: source · reference · lines 44-56

Official source evidence: source · reference · lines 1233-1244 · source · reference · lines 1330-1346 · source · reference · lines 138-138

3 selected source records

release_note · reference_only · lines 1-5 · release_note · reference_only · lines 8-12 · release_note · reference_only · lines 28-83 · release_note · reference_only · lines 120-136 · migration_guide · reference_only · lines 6-18

Reference metadata only; source selection does not create executable upgrade support.

ciliumCiliumEXECUTABLE + SELECTED SOURCES1 executable capability; 5 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project cilium

cilium.cluster-name-invalid.1-16-19-to-1-17-18pkg:github/cilium/cilium · 1.16.19 → 1.17.18

Checks only the whitespace-trimmed literal cluster-name in one caller-selected complete, precedence-resolved official-upstream v1 ConfigMap from Cilium 1.16.19 to 1.17.18. ClusterMesh, networking, name collisions, source discovery, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 85-94 · source · reference · lines 83-91 · source · reference · lines 64-79 · source · reference · lines 2693-2703 · source · reference · lines 2784-2784 · source · reference · lines 2874-2874

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cilium.nonempty-requires-crd-maxitems.1-18-13-to-1-19-7pkg:github/cilium/cilium · 1.18.13 → 1.19.7

Evidence: source · reference · lines 1069-2192 · source · reference · lines 3109-4362 · source · reference · lines 4924-5481 · source · reference · lines 6399-6404 · source · reference · lines 1072-2195 · source · reference · lines 3112-4365 · source · reference · lines 4927-5484 · source · reference · lines 6402-6407

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cilium.nonempty-requires-rejected.1-19pkg:github/cilium/cilium · 1.18.6 → 1.19.0

Evidence: source · reference · lines 300-303

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project cilium --cilium-config-map FILE --from 1.16.19 --to 1.17.18 --cilium-distribution official_upstream --cilium-config-complete --cilium-config-precedence-resolved · Checks only the whitespace-trimmed literal cluster-name in one caller-selected complete, precedence-resolved official-upstream v1 ConfigMap for the exact Cilium 1.16.19 to 1.17.18 transition. ClusterMesh, networking, name collisions, source configuration discovery, runtime behavior, and whole-upgrade safety remain UNKNOWN.

5 selected source records

migration_guide · reference_only · lines 1-5 · migration_guide · reference_only · lines 293-350 · migration_guide · reference_only · lines 281-345 · migration_guide · reference_only · lines 123-160 · migration_guide · reference_only · lines 300-303

Reference metadata only; source selection does not create executable upgrade support.

cloud-custodianCloud CustodianEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project cloud-custodian

cloud-custodian.iam-access-key-json-diff-rejected.0-9-47-to-0-9-52pkg:github/cloud-custodian/cloud-custodian · 0.9.47 → 0.9.52

Evidence: source · reference · lines 1-2 · source · reference · lines 3339-3354 · source · reference · lines 153-179 · source · reference · lines 1-2 · source · reference · lines 797-991

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cloud-custodian.iam-access-key-json-diff-rejected.0-9-48-to-0-9-52pkg:github/cloud-custodian/cloud-custodian · 0.9.48 → 0.9.52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cloud-custodian.iam-access-key-json-diff-rejected.0-9-49-to-0-9-52pkg:github/cloud-custodian/cloud-custodian · 0.9.49 → 0.9.52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cloud-custodian.iam-access-key-json-diff-rejected.0-9-50-to-0-9-52pkg:github/cloud-custodian/cloud-custodian · 0.9.50 → 0.9.52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cloud-custodian.iam-access-key-json-diff-rejected.0-9-51-to-0-9-52pkg:github/cloud-custodian/cloud-custodian · 0.9.51 → 0.9.52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cloud-custodian.iam-access-key-json-diff-removed.0-9-50-to-0-9-51pkg:github/cloud-custodian/cloud-custodian · 0.9.50 → 0.9.51

Checks one caller-selected IAM access-key JSON policy for the reviewed 0.9.50 to 0.9.51 json-diff removal. A scoped absence PASS requires explicitly empty filters []; other filter forms remain UNKNOWN. The check does not call AWS, inspect other policies, execute Custodian, or establish runtime behavior or whole-upgrade safety.

Evidence: source · reference · lines 3327-3347 · source · reference · lines 3327-3342 · source · reference · lines 150-183 · source · reference · lines 1-2 · source · reference · lines 55-84 · source · reference · lines 32-60 · source · reference · lines 9-103 · source · reference · lines 976-983

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project cloud-custodian · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

cloudeventsCloudEventsEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Standards conformance subset

prufyx check cloudevents-structured-json

Profile: structured-json-core-envelope-v1

Checks one named CloudEvents 1.0 structured JSON core-envelope subset only; it does not validate source URI semantics, source-plus-id uniqueness, data schemas, base64 decoding, extensions, batching, transport, SDK/runtime behavior, delivery, signing, or authentication.

Official source evidence: source · reference · lines 171-215 · source · reference · lines 237-255 · source · reference · lines 256-289 · source · reference · lines 290-300 · source · reference · lines 301-315

Official source evidence: source · reference · lines 106-115 · source · reference · lines 131-142 · source · reference · lines 42-45 · source · reference · lines 49-70

1 selected source record

repository_metadata · reference_only · lines 1-35

Reference metadata only; source selection does not create executable upgrade support.

cloudnativepgCloudNativePGEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project cloudnativepg

cloudnativepg.cluster-reference-immutable.1-29-to-1-30pkg:github/cloudnative-pg/cloudnative-pg · 1.29.0 → 1.30.0

Evidence: source · reference · lines 62-64 · source · reference · lines 89-92 · source · reference · lines 43-45 · source · reference · lines 25-30 · source · reference · lines 41-43 · source · reference · lines 43-45

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project cloudnativepg · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

release_note · 1.30.0 · lines 25-30 · release_note · 1.30.0 · lines 14-24

Reference metadata only; source selection does not create executable upgrade support.

container-network-interface-cniContainer Network Interface (CNI)EXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project container-network-interface-cni

cni-spec.non-list-configuration-removed.0-4-0-to-1-0-0pkg:generic/cni-configuration-spec · 0.4.0 → 1.0.0

Evidence: source · reference · lines 225-310 · source · reference · lines 41-109 · source · reference · lines 1-7

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project container-network-interface-cni · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

migration_guide · reference_only · lines 1-7 · migration_guide · reference_only · lines 1-17

Reference metadata only; source selection does not create executable upgrade support.

containerdcontainerdEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project containerd

containerd.cri-v1alpha2-removed.2-0pkg:github/containerd/containerd · 1.7.28 → 2.0.0

Checks the declared containerd CRI API major for the exact 1.7.28 to 2.0.0 transition. The result does not inspect runtime handlers, configuration, endpoint health, startup, runtime behavior or whole-upgrade safety.

Evidence: source · reference · lines 131-133 · source · reference · lines 190-200 · source · reference · lines 342-350

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

containerd.selected-official-runtime-shim-removed.1-7-28-to-2-0-0pkg:github/containerd/containerd · 1.7.28 → 2.0.0

Checks one explicitly selected effective CRI runtime handler for containerd 1.7.28 to 2.0.0 when the caller binds the input to the upstream distribution and official bundled runtimes without an external runtime_path override. Config v2 is supported and is not itself a blocker; custom shims, unresolved imports or paths, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 21-28 · source · reference · lines 56-83 · source · reference · lines 35-37 · source · reference · lines 54-65 · source · reference · lines 201-217 · source · reference · lines 123-125

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project containerd --input FILE --runtime-handler NAME --containerd-config-complete --containerd-config-precedence-resolved --containerd-official-upstream --containerd-official-bundled-runtimes-only · Prepares only the selected CRI runtime_type predicate from one caller-supplied native containerd config version 2 or 3. Version-pair coverage is selected by the rule pack. Imports, runtime_path overrides, custom runtimes, missing handlers, host shim availability, runtime behavior, and whole-upgrade safety remain UNKNOWN.

Local preparer: prufyx check cncf --project containerd --containerd-config FILE --runtime-handler NAME --from 1.7.28 --to 2.0.0 --containerd-config-complete --containerd-config-precedence-resolved --containerd-official-upstream --containerd-official-bundled-runtimes-only · Checks only whether one explicitly selected CRI handler uses an official bundled runtime shim removed in 2.0. Config version 2 is admitted through the reviewed target migration. Caller declarations bind completeness, precedence, upstream distribution, and absence of a separately installed custom shim; startup, container creation, runtime behavior, and whole-upgrade safety remain UNKNOWN.

1 selected source record

release_note · reference_only · lines 160-160

Reference metadata only; source selection does not create executable upgrade support.

contourContourEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project contour

contour.gateway-v1alpha1-removed.1-19-0-to-1-20-0pkg:github/projectcontour/contour · 1.19.0 → 1.20.0

Evidence: source · reference · lines 17-24 · source · reference · lines 96-103

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project contour · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

changelog · 1.20.0 · lines 17-24 · release_note · reference_only · lines 1-19

Reference metadata only; source selection does not create executable upgrade support.

corednsCoreDNSEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project coredns

coredns.federation-removed.1-7pkg:github/coredns/coredns · 1.6.9 → 1.7.0

Evidence: source · reference · lines 13-18

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

coredns.official-federation-absent-at-1-14-7-from-1-10-1pkg:github/coredns/coredns · 1.10.1 → 1.14.7

Evidence: source · reference · lines 3-7 · source · reference · lines 1-82 · source · reference · lines 3-7

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

coredns.official-federation-absent-at-1-14-7-from-1-11-4pkg:github/coredns/coredns · 1.11.4 → 1.14.7

Evidence: source · reference · lines 3-7 · source · reference · lines 1-82 · source · reference · lines 3-7

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

coredns.official-federation-absent-at-1-14-7-from-1-12-4pkg:github/coredns/coredns · 1.12.4 → 1.14.7

Evidence: source · reference · lines 3-7 · source · reference · lines 1-82 · source · reference · lines 3-7

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

coredns.official-federation-absent-at-1-14-7-from-1-13-2pkg:github/coredns/coredns · 1.13.2 → 1.14.7

Evidence: source · reference · lines 3-7 · source · reference · lines 1-82 · source · reference · lines 3-7

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

coredns.official-federation-absent-at-1-14-7-from-1-9-4pkg:github/coredns/coredns · 1.9.4 → 1.14.7

Evidence: source · reference · lines 3-7 · source · reference · lines 1-82 · source · reference · lines 3-7

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project coredns --coredns-corefile FILE --coredns-corefile-complete --coredns-distribution official --from 1.13.2 --to 1.14.7 · Checks only direct federation directive presence in one caller-selected complete Corefile under a caller-declared official distribution. The route is limited to the reviewed 1.6.9 to 1.7.0 transition and origins 1.9.4, 1.10.1, 1.11.4, 1.12.4, or 1.13.2 to target 1.14.7. Imports, snippets, substitutions, custom distributions, unsupported structure, plugin validity, DNS behavior, runtime state, and whole-upgrade safety remain UNKNOWN.

1 selected source record

release_note · reference_only · lines 13-18

Reference metadata only; source selection does not create executable upgrade support.

cortexCortexEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project cortex

cortex.querier-at-modifier-flag-removed.1-21pkg:github/cortexproject/cortex · 1.17.2 → 1.21.1

For the exact reviewed Cortex target image only, an omitted command can use the source-derived default entrypoint. That is not image or runtime verification; null, empty, wrapper, custom-image, and unresolved command or argument forms remain UNKNOWN.

Evidence: source · reference · lines 1-8 · source · reference · lines 40-56 · source · reference · lines 322-361 · source · reference · lines 17-45 · source · reference · lines 96-105 · source · reference · lines 6-18 · source · reference · lines 119-132 · source · reference · lines 61-114

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cortex.querier-at-modifier-flag-target-argv.1-16-1-to-1-21-1pkg:github/cortexproject/cortex · 1.16.1 → 1.21.1

Evidence: source · reference · lines 319-319 · source · reference · lines 1-721 · source · reference · lines 1-8

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cortex.querier-at-modifier-flag-target-argv.1-18-1-to-1-21-1pkg:github/cortexproject/cortex · 1.18.1 → 1.21.1

Evidence: source · reference · lines 319-319 · source · reference · lines 1-721 · source · reference · lines 1-8

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cortex.querier-at-modifier-flag-target-argv.1-19-1-to-1-21-1pkg:github/cortexproject/cortex · 1.19.1 → 1.21.1

Evidence: source · reference · lines 319-319 · source · reference · lines 1-721 · source · reference · lines 1-8

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

cortex.querier-at-modifier-flag-target-argv.1-20-1-to-1-21-1pkg:github/cortexproject/cortex · 1.20.1 → 1.21.1

Evidence: source · reference · lines 319-319 · source · reference · lines 1-721 · source · reference · lines 1-8

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project cortex --native-resource FILE · Checks one selected Cortex container in a caller-supplied Kubernetes workload with the exact reviewed image and literal argv. Explicit /bin/cortex is admitted; an omitted command is source-derived only for the exact admitted target image, never runtime observation. Null, empty, wrapper, custom-image, or unresolved entrypoints and arguments remain UNKNOWN; query semantics, runtime behavior, and whole-upgrade safety remain UNKNOWN.

1 selected source record

changelog · reference_only · lines 3-13

Reference metadata only; source selection does not create executable upgrade support.

crossplaneCrossplaneEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project crossplane

crossplane.composition-resources-mode-removed.1-20-2-0pkg:github/crossplane/crossplane · 1.20.0 → 2.0.0

Evidence: source · reference · lines 79-99 · source · reference · lines 79-89

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project crossplane · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

repository_metadata · reference_only · lines 79-89 · repository_metadata · reference_only · lines 79-99

Reference metadata only; source selection does not create executable upgrade support.

cubefsCubeFSEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project cubefs

cubefs.metanode-raft-snapshot-format.3-2-1-to-3-3-2pkg:github/cubefs/cubefs · 3.2.1 → 3.3.2

Checks the MetaNode raft snapshot format setting for an explicitly declared MetaNode upgrade phase. One proposed MetaNode configuration does not establish the effective cluster configuration, peer state, rollout order or data safety.

Evidence: source · reference · lines 33-74 · source · reference · lines 29-52 · source · reference · lines 271-283 · source · reference · lines 3-10

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

daprDaprEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project dapr

dapr.scheduler-persisted-data-loss.1-14-to-1-15pkg:github/dapr/dapr · 1.14.0 → 1.15.0

Evidence: source · reference · lines 476-484 · source · reference · lines 19-44

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

release_note · reference_only · lines 1-19 · release_note · reference_only · lines 21-48

Reference metadata only; source selection does not create executable upgrade support.

distributionDistributionEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project distribution

distribution.schema1-manifest-removed.2-8-3-to-3-0-0pkg:github/distribution/distribution · 2.8.3 → 3.0.0

Evidence: source · reference · lines 14-107 · source · reference · lines 1-135 · source · reference · lines 1-132

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project distribution · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

source_code · 3.0.0 · lines 1-132 · release_note · 3.1.1 · lines 12-32

Reference metadata only; source selection does not create executable upgrade support.

dragonflyDragonflyEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project dragonfly

dragonfly.manager-retained-debug.2-2-3-2-2-4pkg:github/dragonflyoss/dragonfly · 2.2.3 → 2.2.4

Evidence: source · reference · lines 19-24 · source · reference · lines 55-77 · source · reference · lines 36-65 · source · reference · lines 65-74 · source · reference · lines 56-89 · source · reference · lines 38-67 · source · reference · lines 32-37 · source · reference · lines 69-78

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

dragonfly.scheduler-retained-debug.2-2-3-2-2-4pkg:github/dragonflyoss/dragonfly · 2.2.3 → 2.2.4

Evidence: source · reference · lines 19-24 · source · reference · lines 55-77 · source · reference · lines 36-65 · source · reference · lines 69-78 · source · reference · lines 56-89 · source · reference · lines 38-67 · source · reference · lines 31-36 · source · reference · lines 69-78

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

2 selected source records

changelog · reference_only · lines 5-20 · changelog · reference_only · lines 162-170 · changelog · reference_only · lines 5-30 · changelog · reference_only · lines 194-203

Reference metadata only; source selection does not create executable upgrade support.

emissary-ingressEmissary-IngressEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project emissary-ingress

emissary-ingress.metrics-endpoint-removed.3-10-to-4-0pkg:github/emissary-ingress/emissary · 3.10.0 → 4.0.1

Evidence: source · reference · lines 62-65 · source · reference · lines 2309-2314 · source · reference · lines 2140-2202

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project emissary-ingress · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

source_code · 4.0.1 · lines 2140-2202 · changelog · 4.1.0 · lines 9-19

Reference metadata only; source selection does not create executable upgrade support.

envoyEnvoyEXECUTABLE + SELECTED SOURCES1 executable capability; 3 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project envoy

envoy.xds-v2-removed.1-18pkg:github/envoyproxy/envoy · 1.17.2 → 1.18.0

Evidence: source · reference · lines 4-9

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

envoy.xds-v2-unsupported-at-1-39-1-from-1-34-14pkg:github/envoyproxy/envoy · 1.34.14 → 1.39.1

Evidence: source · reference · lines 1-1 · source · reference · lines 28-38 · source · reference · lines 152-169 · source · reference · lines 1-1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

envoy.xds-v2-unsupported-at-1-39-1-from-1-35-13pkg:github/envoyproxy/envoy · 1.35.13 → 1.39.1

Evidence: source · reference · lines 1-1 · source · reference · lines 28-38 · source · reference · lines 152-169 · source · reference · lines 1-1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

envoy.xds-v2-unsupported-at-1-39-1-from-1-36-10pkg:github/envoyproxy/envoy · 1.36.10 → 1.39.1

Evidence: source · reference · lines 1-1 · source · reference · lines 28-38 · source · reference · lines 152-169 · source · reference · lines 1-1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

envoy.xds-v2-unsupported-at-1-39-1-from-1-37-6pkg:github/envoyproxy/envoy · 1.37.6 → 1.39.1

Evidence: source · reference · lines 1-1 · source · reference · lines 28-38 · source · reference · lines 152-169 · source · reference · lines 1-1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

envoy.xds-v2-unsupported-at-1-39-1-from-1-38-4pkg:github/envoyproxy/envoy · 1.38.4 → 1.39.1

Evidence: source · reference · lines 1-1 · source · reference · lines 28-38 · source · reference · lines 152-169 · source · reference · lines 1-1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project envoy --envoy-bootstrap FILE --envoy-bootstrap-selected --from 1.38.4 --to 1.39.1 · Blocker-only route checking direct V2 transport_api_version at ADS, LDS, or CDS api_config_source paths in one caller-selected directly loaded JSON bootstrap. It is limited to origins 1.34.14, 1.35.13, 1.36.10, 1.37.6, or 1.38.4 to target 1.39.1. V3, AUTO, absence, and unsupported structure remain UNKNOWN; there is no native PASS or historical 1.18 native route. Bootstrap completeness, distribution identity, xDS behavior, runtime state, and whole-upgrade safety remain UNKNOWN.

3 selected source records

changelog · reference_only · lines 1-145 · changelog · reference_only · lines 1-140 · repository_metadata · reference_only · lines 4-9

Reference metadata only; source selection does not create executable upgrade support.

etcdetcdEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project etcd

etcd.direct-minor-skip.3-2-32-to-3-7-1pkg:github/etcd-io/etcd · 3.2.32 → 3.7.1

Evidence: source · reference · lines 9-24

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.direct-minor-skip.3-3-27-to-3-7-1pkg:github/etcd-io/etcd · 3.3.27 → 3.7.1

Evidence: source · reference · lines 9-24

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.direct-minor-skip.3-4-45-to-3-7-1pkg:github/etcd-io/etcd · 3.4.45 → 3.7.1

Evidence: source · reference · lines 9-24

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.direct-minor-skip.3-5-33-to-3-7-1pkg:github/etcd-io/etcd · 3.5.33 → 3.7.1

Evidence: source · reference · lines 9-24

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.experimental-flags-unsupported.3-2-32-to-3-7-1pkg:github/etcd-io/etcd · 3.2.32 → 3.7.1

Evidence: source · reference · lines 245-254 · source · reference · lines 38-68 · source · reference · lines 603-773

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.experimental-flags-unsupported.3-3-27-to-3-7-1pkg:github/etcd-io/etcd · 3.3.27 → 3.7.1

Evidence: source · reference · lines 245-254 · source · reference · lines 38-68 · source · reference · lines 603-773

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.experimental-flags-unsupported.3-4-45-to-3-7-1pkg:github/etcd-io/etcd · 3.4.45 → 3.7.1

Evidence: source · reference · lines 245-254 · source · reference · lines 38-68 · source · reference · lines 603-773

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.experimental-flags-unsupported.3-5-33-to-3-7-1pkg:github/etcd-io/etcd · 3.5.33 → 3.7.1

Evidence: source · reference · lines 245-254 · source · reference · lines 38-68 · source · reference · lines 603-773

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.experimental-flags-unsupported.3-6-14-to-3-7-1pkg:github/etcd-io/etcd · 3.6.14 → 3.7.1

Evidence: source · reference · lines 245-254 · source · reference · lines 38-68 · source · reference · lines 603-773

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

etcd.v2-proxy-flags-removed.3-6pkg:github/etcd-io/etcd · 3.5.17 → 3.6.0

Evidence: source · reference · lines 210-220 · source · reference · lines 104-139 · source · reference · lines 752-965

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project etcd · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

1 selected source record

changelog · reference_only · lines 337-355

Reference metadata only; source selection does not create executable upgrade support.

falcoFalcoEXECUTABLE + SELECTED SOURCES1 executable capability; 3 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project falco

falco.deprecated-cli-flags-removed.0-40-to-0-41pkg:github/falcosecurity/falco · 0.40.0 → 0.41.0

Evidence: source · reference · lines 1-11 · source · reference · lines 32-43 · source · reference · lines 107-108 · source · reference · lines 129-129

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

falco.deprecated-cli-flags-removed.0-40-to-0-42pkg:github/falcosecurity/falco · 0.40.0 → 0.42.0

Evidence: source · reference · lines 107-108 · source · reference · lines 129-129 · source · reference · lines 32-43 · source · reference · lines 65-73 · source · reference · lines 92-130

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project falco · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

3 selected source records

source_code · reference_only · lines 32-43 · source_code · reference_only · lines 107-108 · source_code · reference_only · lines 129-129 · changelog · reference_only · lines 1-11

Reference metadata only; source selection does not create executable upgrade support.

fluent-bitFluent BitEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project fluent-bit

fluent-bit.http2-setting.3-2-to-4-0pkg:github/fluent/fluent-bit · 3.2.0 → 4.0.0

Checks one caller-selected complete classic OpenTelemetry OUTPUT configuration only when the caller declares that Fluent Bit 3.2.0's current default was used and that HTTP/2 must remain enabled. It evaluates only that setting; protocol negotiation, TLS, connectivity, collector behavior, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 30-32 · source · reference · lines 553-718 · source · reference · lines 545-562 · source · reference · lines 666-678 · source · reference · lines 30-32 · source · reference · lines 558-723 · source · reference · lines 563-596 · source · reference · lines 814-826

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

fluent-bit.http2-target-required.3-2-to-5-1pkg:github/fluent/fluent-bit · 3.2.10 → 5.1.2

Evidence: source · reference · lines 650-723 · source · reference · lines 588-615 · source · reference · lines 1127-1136 · source · reference · lines 708-744

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

fluent-bit.http2-target-required.4-0-to-5-1pkg:github/fluent/fluent-bit · 4.0.14 → 5.1.2

Evidence: source · reference · lines 650-723 · source · reference · lines 588-615 · source · reference · lines 1127-1136 · source · reference · lines 708-744

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

fluent-bit.http2-target-required.4-1-to-5-1pkg:github/fluent/fluent-bit · 4.1.2 → 5.1.2

Evidence: source · reference · lines 650-723 · source · reference · lines 588-615 · source · reference · lines 1127-1136 · source · reference · lines 708-744

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

fluent-bit.http2-target-required.4-2-to-5-1pkg:github/fluent/fluent-bit · 4.2.8 → 5.1.2

Evidence: source · reference · lines 650-723 · source · reference · lines 588-615 · source · reference · lines 1127-1136 · source · reference · lines 708-744

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

fluent-bit.http2-target-required.5-0-to-5-1pkg:github/fluent/fluent-bit · 5.0.10 → 5.1.2

Evidence: source · reference · lines 650-723 · source · reference · lines 588-615 · source · reference · lines 1127-1136 · source · reference · lines 708-744

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

Local preparer: prufyx prepare project --project fluent-bit --effective-config FILE --from 3.2.0 --to 4.0.0 --effective-config-complete --current-default-was-used --preserve-http2-enabled · Requires one caller-selected complete classic [OUTPUT] configuration and caller declarations that the current default was used and HTTP/2 must remain enabled; it evaluates only that setting. Unsupported syntax remains UNKNOWN.

fluentdFluentdEXECUTABLE + SELECTED SOURCES1 executable capability; 4 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project fluentd

fluentd.ruby-minimum-target.1-14-6-to-1-19-3pkg:github/fluent/fluentd · 1.14.6 → 1.19.3

Evidence: source · reference · lines 22-32

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

fluentd.ruby-minimum-target.1-15-3-to-1-19-3pkg:github/fluent/fluentd · 1.15.3 → 1.19.3

Evidence: source · reference · lines 22-32

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

fluentd.ruby-minimum-target.1-16-11-to-1-19-3pkg:github/fluent/fluentd · 1.16.11 → 1.19.3

Evidence: source · reference · lines 22-32

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

fluentd.ruby-minimum-target.1-17-1-to-1-19-3pkg:github/fluent/fluentd · 1.17.1 → 1.19.3

Evidence: source · reference · lines 22-32

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

fluentd.ruby-minimum-target.1-18-0-to-1-19-3pkg:github/fluent/fluentd · 1.18.0 → 1.19.3

Evidence: source · reference · lines 22-32

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

fluentd.ruby-minimum.1-16-to-1-17pkg:github/fluent/fluentd · 1.16.0 → 1.17.0

Evidence: source · reference · lines 17-22 · source · reference · lines 17-22 · source · reference · lines 1-30

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

fluentd.z-literal-treatment.1-17-1-to-1-18-0pkg:github/fluent/fluentd · 1.17.1 → 1.18.0

Checks one caller-declared complete Fluentd selected literal value from 1.17.1 to 1.18.0 with current-default and literal-preservation intent. The current and proposed literal bytes must be unchanged, except for the exact permitted outer single-quote wrapper: an unchanged unwrapped simple interpolation marker is a scoped blocker, while changed content or unsupported forms remain UNKNOWN. Ruby interpolation, includes, variables, runtime behavior and the rest of the Fluentd configuration remain UNKNOWN.

Evidence: source · reference · lines 226-280 · source · reference · lines 299-309 · source · reference · lines 67-289 · source · reference · lines 299-324 · source · reference · lines 15-20 · source · reference · lines 107-135

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project fluentd · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

4 selected source records

changelog · 1.19.0 · lines 1-25 · changelog · reference_only · lines 1-30 · repository_metadata · reference_only · lines 17-22 · repository_metadata · reference_only · lines 17-22

Reference metadata only; source selection does not create executable upgrade support.

fluxFluxEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project flux

flux.beta-api-removal.2-7pkg:github/fluxcd/flux2 · 2.6.4 → 2.7.0

Checks one caller-selected strict JSON Kubernetes resource or v1 List for five removed beta API versions. An absence PASS requires an explicitly complete, non-paginated selected rendered-resource set; stored versions, cluster inventory, reconciliation, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 316-327

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

flux.latest-beta-api-removal.2.4.0-to-2-9pkg:github/fluxcd/flux2 · 2.4.0 → 2.9.5

Evidence: source · reference · lines 3-10 · source · reference · lines 316-327 · source · reference · lines 164-174 · source · reference · lines 285-297

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

flux.latest-beta-api-removal.2.5.1-to-2-9pkg:github/fluxcd/flux2 · 2.5.1 → 2.9.5

Evidence: source · reference · lines 3-10 · source · reference · lines 316-327 · source · reference · lines 164-174 · source · reference · lines 285-297

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

flux.latest-beta-api-removal.2.6.4-to-2-9pkg:github/fluxcd/flux2 · 2.6.4 → 2.9.5

Evidence: source · reference · lines 3-10 · source · reference · lines 316-327 · source · reference · lines 164-174 · source · reference · lines 285-297

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

flux.latest-beta-api-removal.2.7.5-to-2-9pkg:github/fluxcd/flux2 · 2.7.5 → 2.9.5

Evidence: source · reference · lines 3-10 · source · reference · lines 316-327 · source · reference · lines 164-174 · source · reference · lines 285-297

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

flux.latest-beta-api-removal.2.8.8-to-2-9pkg:github/fluxcd/flux2 · 2.8.8 → 2.9.5

Evidence: source · reference · lines 3-10 · source · reference · lines 316-327 · source · reference · lines 164-174 · source · reference · lines 285-297

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project flux --native-resource FILE · Checks one caller-selected JSON Kubernetes resource or v1 List for the historical five beta API versions and the additive Flux 2.9.5 beta2 union; latest coverage is limited to the reviewed toolkit kinds and five exact origins, while source-watcher, extensions, and unreviewed API versions remain UNKNOWN. Absence requires an explicit complete non-paginated selected set, and stored versions, cluster inventory, reconciliation, runtime behavior, and whole-upgrade safety remain UNKNOWN.

1 selected source record

repository_metadata · reference_only · lines 316-327

Reference metadata only; source selection does not create executable upgrade support.

grafanaGrafanaEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project grafana

grafana.legacy-alerting-config.10-4-to-11-0pkg:github/grafana/grafana · 10.4.0 → 11.0.0

Checks one caller-declared complete Grafana native effective configuration for the legacy alerting setting across 10.4.0 to 11.0.0. Environment and CLI precedence must already be resolved by the caller; this local check does not inspect dashboards, run Grafana, or prove that alerting content was migrated.

Evidence: source · reference · lines 1332-1335 · source · reference · lines 86-93 · source · reference · lines 1147-1149 · source · reference · lines 1743-1751

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

grafana.legacy-alerting-config.12-2-10-to-13-2-1pkg:github/grafana/grafana · 12.2.10 → 13.2.1

Evidence: source · reference · lines 2288-2294

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

grafana.legacy-alerting-config.12-3-11-to-13-2-1pkg:github/grafana/grafana · 12.3.11 → 13.2.1

Evidence: source · reference · lines 2288-2294

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

grafana.legacy-alerting-config.12-4-10-to-13-2-1pkg:github/grafana/grafana · 12.4.10 → 13.2.1

Evidence: source · reference · lines 2288-2294

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

grafana.legacy-alerting-config.13-0-8-to-13-2-1pkg:github/grafana/grafana · 13.0.8 → 13.2.1

Evidence: source · reference · lines 2288-2294

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

grafana.legacy-alerting-config.13-1-5-to-13-2-1pkg:github/grafana/grafana · 13.1.5 → 13.2.1

Evidence: source · reference · lines 2288-2294

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

Local preparer: prufyx prepare project --project grafana · Requires caller-declared complete configuration with environment and CLI precedence resolved; unsupported syntax remains UNKNOWN.

harborHarborEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project harbor

harbor.installer-config-format.1-8pkg:github/goharbor/harbor · 1.7.5 → 1.8.0

Evidence: source · reference · lines 3-14

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

harbor.installer-with-chartmuseum-flag-removed.2-10-to-2-15pkg:github/goharbor/harbor · 2.10.3 → 2.15.2

Evidence: source · reference · lines 10-13 · source · reference · lines 24-35

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

harbor.installer-with-chartmuseum-flag-removed.2-11-to-2-15pkg:github/goharbor/harbor · 2.11.2 → 2.15.2

Evidence: source · reference · lines 10-13 · source · reference · lines 24-35

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

harbor.installer-with-chartmuseum-flag-removed.2-12-to-2-15pkg:github/goharbor/harbor · 2.12.4 → 2.15.2

Evidence: source · reference · lines 10-13 · source · reference · lines 24-35

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

harbor.installer-with-chartmuseum-flag-removed.2-13-to-2-15pkg:github/goharbor/harbor · 2.13.5 → 2.15.2

Evidence: source · reference · lines 10-13 · source · reference · lines 24-35

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

harbor.installer-with-chartmuseum-flag-removed.2-14-to-2-15pkg:github/goharbor/harbor · 2.14.4 → 2.15.2

Evidence: source · reference · lines 10-13 · source · reference · lines 24-35

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

harbor.installer-with-chartmuseum-flag-removed.2-8pkg:github/goharbor/harbor · 2.7.0 → 2.8.0

Checks one caller-declared complete Harbor installer argv for 2.7.0 to 2.8.0. The removed --with-chartmuseum option is a scoped blocker; help, wrapper, unknown, duplicate and dynamic argv forms remain UNKNOWN. It does not execute the installer or establish chart, database, migration or runtime behavior.

Evidence: source · reference · lines 28-45 · source · reference · lines 76-91 · source · reference · lines 72-83 · source · reference · lines 26-42

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project harbor · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

1 selected source record

changelog · reference_only · lines 3-14

Reference metadata only; source selection does not create executable upgrade support.

helmHelmEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project helm

helm.post-renderer-argument-form.4-0pkg:github/helm/helm · 3.14.4 → 4.0.0

Evidence: source · reference · lines 118-121 · source · reference · lines 168-172

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

2 selected source records

source_code · reference_only · lines 118-121 · source_code · reference_only · lines 168-172

Reference metadata only; source selection does not create executable upgrade support.

in-totoin-totoEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project in-toto

in-toto.run-legacy-key-argument-removed.2-2-to-3-0pkg:github/in-toto/in-toto · 2.2.0 → 3.0.0

Checks removed -k/--key options before the command separator in a narrowly admitted in-toto-run argument array. It does not read keys, execute commands or validate the replacement key's format, trust or signing behavior.

Evidence: source · reference · lines 83-93 · source · reference · lines 298-305 · source · reference · lines 233-243 · source · reference · lines 213-220 · source · reference · lines 3-12 · source · reference · lines 225-235 · source · reference · lines 207-212 · source · reference · lines 132-142

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

istioIstioEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project istio

istio.compatibility-profile-1-20-removed.1-24pkg:github/istio/istio · 1.23.6 → 1.24.0

Evidence: source · reference · lines 5-9

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

release_note · reference_only · lines 5-9

Reference metadata only; source selection does not create executable upgrade support.

jaegerJaegerEXECUTABLE + SELECTED SOURCES1 executable capability; 5 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project jaeger

jaeger.explicit-config-required-for-non-memory.1-76-2-20pkg:github/jaegertracing/jaeger · 1.76.0 → 2.20.0

Evidence: source · reference · lines 133-150 · source · reference · lines 18-25 · source · reference · lines 35-39 · source · reference · lines 61-99 · source · reference · lines 67-90

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

jaeger.explicit-config-required-for-non-memory.target.2-15-to-2-20pkg:github/jaegertracing/jaeger · 2.15.1 → 2.20.0

Evidence: source · reference · lines 61-99 · source · reference · lines 35-39

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

jaeger.explicit-config-required-for-non-memory.target.2-16-to-2-20pkg:github/jaegertracing/jaeger · 2.16.0 → 2.20.0

Evidence: source · reference · lines 61-99 · source · reference · lines 35-39

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

jaeger.explicit-config-required-for-non-memory.target.2-17-to-2-20pkg:github/jaegertracing/jaeger · 2.17.0 → 2.20.0

Evidence: source · reference · lines 61-99 · source · reference · lines 35-39

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

jaeger.explicit-config-required-for-non-memory.target.2-18-to-2-20pkg:github/jaegertracing/jaeger · 2.18.0 → 2.20.0

Evidence: source · reference · lines 61-99 · source · reference · lines 35-39

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

jaeger.explicit-config-required-for-non-memory.target.2-19-to-2-20pkg:github/jaegertracing/jaeger · 2.19.0 → 2.20.0

Evidence: source · reference · lines 61-99 · source · reference · lines 35-39

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project jaeger · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

5 selected source records

repository_metadata · reference_only · lines 35-39 · repository_metadata · reference_only · lines 67-90 · source_code · reference_only · lines 133-150 · source_code · reference_only · lines 61-99 · source_code · reference_only · lines 18-25

Reference metadata only; source selection does not create executable upgrade support.

karmadaKarmadaEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project karmada

karmada.application-purge-mode-legacy-values-removed.1-19pkg:github/karmada-io/karmada · 1.18.3 → 1.19.0

Evidence: source · reference · lines 155-169 · source · reference · lines 152-166 · source · reference · lines 279-365 · source · reference · lines 328-357 · source · reference · lines 156-167 · source · reference · lines 153-164 · source · reference · lines 279-339 · source · reference · lines 328-351

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project karmada · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

1 selected source record

changelog · reference_only · lines 55-97

Reference metadata only; source selection does not create executable upgrade support.

kedaKEDAEXECUTABLE + SELECTED SOURCES1 executable capability; 4 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project keda

keda.external-scaler-legacy-tls-transport.2-17pkg:github/kedacore/keda · 2.16.0 → 2.17.0

Evidence: source · reference · lines 308-336 · source · reference · lines 150-154 · source · reference · lines 315-334 · source · reference · lines 66-159

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project keda · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

4 selected source records

changelog · reference_only · lines 1-5 · source_code · reference_only · lines 66-159 · source_code · reference_only · lines 315-334 · changelog · reference_only · lines 150-154 · source_code · reference_only · lines 308-336

Reference metadata only; source selection does not create executable upgrade support.

keycloakKeycloakEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project keycloak

keycloak.oidc-fragment-response-parameter-rejected.26-7-2-to-26-7-3pkg:github/keycloak/keycloak · 26.7.2 → 26.7.3

Evidence: source · reference · lines 117-120 · source · reference · lines 162-185 · source · reference · lines 550-553 · source · reference · lines 15-21 · source · reference · lines 166-194 · source · reference · lines 117-138

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

release_note · reference_only · lines 1-21

Reference metadata only; source selection does not create executable upgrade support.

kibanaKibanaEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project kibana

kibana.reporting-roles-allow.8-18-to-9-0pkg:github/elastic/kibana · 8.18.0 → 9.0.0

Checks one caller-declared complete Kibana native effective configuration for the reporting roles setting across 8.18.0 to 9.0.0. Environment and CLI precedence must already be resolved by the caller; this local check does not start Kibana, inspect saved objects, or prove a complete upgrade.

Evidence: source · reference · lines 71-96 · source · reference · lines 346-361

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

kibana.status-page-monitor-bypass.9-0-8-to-9-5-3pkg:github/elastic/kibana · 9.0.8 → 9.5.3

Evidence: source · reference · lines 14-17 · source · reference · lines 81-105 · source · reference · lines 199-230 · source · reference · lines 134-143

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

kibana.status-page-monitor-bypass.9-1-10-to-9-5-3pkg:github/elastic/kibana · 9.1.10 → 9.5.3

Evidence: source · reference · lines 14-17 · source · reference · lines 81-105 · source · reference · lines 199-230 · source · reference · lines 134-143

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

kibana.status-page-monitor-bypass.9-2-8-to-9-5-3pkg:github/elastic/kibana · 9.2.8 → 9.5.3

Evidence: source · reference · lines 14-17 · source · reference · lines 81-105 · source · reference · lines 199-230 · source · reference · lines 134-143

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

kibana.status-page-monitor-bypass.9-3-8-to-9-5-3pkg:github/elastic/kibana · 9.3.8 → 9.5.3

Evidence: source · reference · lines 14-17 · source · reference · lines 81-105 · source · reference · lines 199-230 · source · reference · lines 134-143

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

kibana.status-page-monitor-bypass.9-4-6-to-9-5-3pkg:github/elastic/kibana · 9.4.6 → 9.5.3

Evidence: source · reference · lines 14-17 · source · reference · lines 81-105 · source · reference · lines 199-230 · source · reference · lines 134-143

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

Local preparer: prufyx prepare project --project kibana · Requires caller-declared complete configuration with environment and CLI precedence resolved; unsupported syntax remains UNKNOWN.

knativeKnativeEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project knative

knative.serving-startup-http-named-port.1-22-to-1-23pkg:github/knative/serving · 1.22.0 → 1.23.0

Checks a named HTTP startup-probe port in a narrowly admitted native Knative Service with one user container. Numeric ports and unsupported shapes remain UNKNOWN; this does not establish admission or runtime readiness for the whole Service.

Evidence: source · reference · lines 588-595 · source · reference · lines 875-893 · source · reference · lines 829-832 · source · reference · lines 857-868 · source · reference · lines 781-790 · source · reference · lines 605-614 · source · reference · lines 772-799 · source · reference · lines 71-79

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubeedgeKubeEdgeEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project kubeedge

kubeedge.keadm-init-profile-version-selector.1-18-to-1-19pkg:github/kubeedge/kubeedge · 1.18.0 → 1.19.0

Evidence: source · reference · lines 85-89 · source · reference · lines 112-129 · source · reference · lines 103-113 · source · reference · lines 75-77 · source · reference · lines 93-108 · source · reference · lines 101-104 · source · reference · lines 47-64

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

repository_metadata · reference_only · lines 1-33

Reference metadata only; source selection does not create executable upgrade support.

kubeflowKubeflowEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project kubeflow

kubeflow.kfp-create-component-from-func-removed.1-8-22-to-2-0-0pkg:pypi/kfp · 1.8.22 → 2.0.0

Checks one unaliased, directly imported KFP decorator form in a supplied Python file: create_component_from_func or dsl.component. A Go static parser reads the file as data without invoking a Python interpreter or executing user code. Installed KFP provenance, pipeline compilation, inputs, outputs, packages, backend behavior and the rest of Kubeflow remain unchecked.

Evidence: source · reference · lines 13-17 · source · reference · lines 13-27 · source · reference · lines 15-31 · source · reference · lines 15-24 · source · reference · lines 75-131

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetesKubernetesEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project kubernetes

kubernetes.admissionwebhook-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 170-185 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.apiservice-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 208-214 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.crd-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 187-206 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.cronjob-v1beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 87-93 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.csistoragecapacity-v1beta1-removed.1-26-0-to-1-27-0pkg:github/kubernetes/kubernetes · 1.26.0 → 1.27.0

Evidence: source · reference · lines 55-61 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.csr-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 232-247 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.endpointslice-v1beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 95-104 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.event-v1beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 106-126 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.flowcontrol-v1beta1-removed.1-25-0-to-1-26-0pkg:github/kubernetes/kubernetes · 1.25.0 → 1.26.0

Evidence: source · reference · lines 67-73 · source · reference · lines 40-49 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.flowcontrol-v1beta2-removed.1-28-0-to-1-29-0pkg:github/kubernetes/kubernetes · 1.28.0 → 1.29.0

Evidence: source · reference · lines 40-49 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.flowcontrol-v1beta3-removed.1-31-0-to-1-32-0pkg:github/kubernetes/kubernetes · 1.31.0 → 1.32.0

Checks one caller-selected complete, non-paginated rendered target apply set for FlowSchema and PriorityLevelConfiguration at flowcontrol.apiserver.k8s.io/v1beta3 from Kubernetes 1.31.0 to 1.32.0, with official-upstream distribution and target API apply intent declared. General manifest admission, CRDs, stored objects, runtime clients, API-server configuration and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 23-34

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.hpa-v2beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 128-135 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.hpa-v2beta2-removed.1-25-0-to-1-26-0pkg:github/kubernetes/kubernetes · 1.25.0 → 1.26.0

Evidence: source · reference · lines 75-82 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.in-tree-dockershim-removed.1-24pkg:github/kubernetes/kubernetes · 1.23.17 → 1.24.0

Evidence: source · reference · lines 1002-1008

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.ingress-extensions-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 257-269 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.ingress-networking-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 257-269 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.ingressclass-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 271-277 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.lease-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 249-255 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.pdb-v1beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 137-146 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.priorityclass-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 288-294 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.psp-v1beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 148-156 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.rbac-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 279-286 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.runtimeclass-v1beta1-removed.1-24-0-to-1-25-0pkg:github/kubernetes/kubernetes · 1.24.0 → 1.25.0

Evidence: source · reference · lines 158-164 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.storage-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 296-306 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.subjectaccessreview-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 223-230 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kubernetes.tokenreview-v1beta1-removed.1-21-0-to-1-22-0pkg:github/kubernetes/kubernetes · 1.21.0 → 1.22.0

Evidence: source · reference · lines 216-221 · source · reference · lines 189-193

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project kubernetes --native-resource FILE --from 1.31.0 --to 1.32.0 --distribution official_upstream --target-api-apply-required --resource-scope-complete · Checks one caller-selected complete non-paginated rendered target apply set for FlowSchema and PriorityLevelConfiguration at flowcontrol.apiserver.k8s.io/v1beta3 under caller-declared official-upstream distribution and target API apply intent. General manifest admission, CRDs, stored objects, runtime clients, API-server configuration, and whole-upgrade safety remain UNKNOWN.

1 selected source record

changelog · reference_only · lines 1002-1008

Reference metadata only; source selection does not create executable upgrade support.

kubevirtKubeVirtEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project kubevirt

kubevirt.interface-binding-cardinality.1-8-4-to-1-9-0pkg:github/kubevirt/kubevirt · 1.8.4 → 1.9.0

Evidence: source · reference · lines 1442-1571 · source · reference · lines 48-64 · source · reference · lines 48-79

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project kubevirt · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

source_code · 1.9.0 · lines 48-79 · migration_guide · reference_only · lines 1-20 · migration_guide · reference_only · lines 50-84

Reference metadata only; source selection does not create executable upgrade support.

kumaKumaEXECUTABLE + SELECTED SOURCES1 executable capability; 3 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project kuma

kuma.deprecated-exclude-uid-flags-removed.2-8-to-2-9pkg:github/kumahq/kuma · 2.8.0 → 2.9.0

Evidence: source · reference · lines 220-222 · source · reference · lines 113-115 · source · reference · lines 126-133 · source · reference · lines 173-177 · source · reference · lines 260-260

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project kuma · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

3 selected source records

source_code · reference_only · lines 220-222 · source_code · reference_only · lines 126-133 · source_code · reference_only · lines 173-177 · source_code · reference_only · lines 260-260 · migration_guide · reference_only · lines 113-115

Reference metadata only; source selection does not create executable upgrade support.

kyvernoKyvernoEXECUTABLE + SELECTED SOURCES1 executable capability; 3 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project kyverno

kyverno.reports-chunk-size-removed.1-13pkg:github/kyverno/kyverno · 1.12.5 → 1.13.0

Evidence: source · reference · lines 1074-1146 · source · reference · lines 222-235 · source · reference · lines 253-255 · source · reference · lines 202-208 · source · reference · lines 1-6 · source · reference · lines 253-255 · source · reference · lines 192-208

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kyverno.reports-chunk-size-unsupported-at-1-19-1-from-1-14-5pkg:github/kyverno/kyverno · 1.14.5 → 1.19.1

Evidence: source · reference · lines 1075-1146 · source · reference · lines 156-170 · source · reference · lines 1-5 · source · reference · lines 1-5 · source · reference · lines 284-305 · source · reference · lines 1-3 · source · reference · lines 1-6 · source · reference · lines 292-362

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kyverno.reports-chunk-size-unsupported-at-1-19-1-from-1-15-3pkg:github/kyverno/kyverno · 1.15.3 → 1.19.1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kyverno.reports-chunk-size-unsupported-at-1-19-1-from-1-16-4pkg:github/kyverno/kyverno · 1.16.4 → 1.19.1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kyverno.reports-chunk-size-unsupported-at-1-19-1-from-1-17-2pkg:github/kyverno/kyverno · 1.17.2 → 1.19.1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

kyverno.reports-chunk-size-unsupported-at-1-19-1-from-1-18-2pkg:github/kyverno/kyverno · 1.18.2 → 1.19.1

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project kyverno · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

3 selected source records

changelog · reference_only · lines 1-7 · changelog · reference_only · lines 1-5 · changelog · reference_only · lines 1-6

Reference metadata only; source selection does not create executable upgrade support.

linkerdLinkerdEXECUTABLE + SELECTED SOURCES1 executable capability; 5 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project linkerd

linkerd.mtls-identity-selector-minitems.2-13-2-14pkg:github/linkerd/linkerd2 · 2.13.7 → 2.14.0

Evidence: source · reference · lines 36-54 · source · reference · lines 36-55

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project linkerd · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

5 selected source records

changelog · reference_only · lines 1-5 · changelog · reference_only · lines 1-31 · changelog · reference_only · lines 1-23 · changelog · reference_only · lines 46-55 · helm_chart · reference_only · lines 36-54 · helm_chart · reference_only · lines 36-55

Reference metadata only; source selection does not create executable upgrade support.

lokiGrafana LokiEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project loki

loki.compactor-shared-store.2-9-to-3-0pkg:github/grafana/loki · 2.9.8 → 3.0.0

Checks one caller-declared complete native Loki YAML document with a selected top-level compactor mapping for the reviewed shared_store and shared_store_key_prefix settings from 2.9.8 to 3.0.0. Environment and CLI precedence must already be resolved; this does not parse every Loki configuration form or establish storage, migration or runtime behavior.

Evidence: source · reference · lines 73-108 · source · reference · lines 36-45 · source · reference · lines 73-109 · source · reference · lines 28-44 · source · reference · lines 13-40 · source · reference · lines 40-120 · source · reference · lines 74-102 · source · reference · lines 85-145

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

loki.structured-metadata-tsdb-v13.2-9-8-to-3-0-0pkg:github/grafana/loki · 2.9.8 → 3.0.0

Checks one caller-selected complete, precedence-resolved native Loki schema configuration from 2.9.8 to 3.0.0: exactly one canonical schema period with literal store and schema plus explicit allow_structured_metadata. An omitted allow setting needs the exact-pair --use-reviewed-target-default opt-in. Multiple periods, unsupported YAML, storage migration, retention, data access, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 208-269 · source · reference · lines 183-294 · source · reference · lines 154-294 · source · reference · lines 136-481 · source · reference · lines 210-387 · source · reference · lines 8-10 · source · reference · lines 24-52 · source · reference · lines 47-84

Scoped native effective-configuration constraint; it does not assert CNCF membership, whole-upgrade safety, or runtime behavior.

Local preparer: prufyx prepare project --project loki · Requires caller-declared complete configuration with environment and CLI precedence resolved; unsupported syntax remains UNKNOWN.

Local preparer: prufyx check project --project loki --loki-schema-config FILE --from 2.9.8 --to 3.0.0 --effective-config-complete --precedence-resolved · Checks one caller-selected complete, precedence-resolved native Loki schema configuration: one canonical period with literal store and schema plus explicit allow_structured_metadata. An omitted allow setting requires exact-pair --use-reviewed-target-default. Multiple periods, aliases, tags, duplicate or near-key spellings, templates, unsupported values, other precedence, storage migration, retention, data access, runtime behavior, and whole-upgrade safety remain UNKNOWN.

longhornLonghornEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project longhorn

longhorn.intermediate-1-8.1-9pkg:github/longhorn/longhorn · 1.7.3 → 1.9.0

Evidence: source · reference · lines 222-273

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

migration_guide · reference_only · lines 222-273

Reference metadata only; source selection does not create executable upgrade support.

mariadbMariaDB ServerEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project mariadb

mariadb.innodb-defragmentation-required.10-11-8-to-11-4-2pkg:github/mariadb/server · 10.11.8 → 11.4.2

Checks whether the caller explicitly requires InnoDB defragmentation behavior for the upstream MariaDB 10.11.8 to 11.4.2 transition. MariaDB 11.4.2 retains innodb-defragment only as an ignored compatibility option that warns and does nothing, so option presence or absence alone is not a blocker; an explicit required behavior is. Configuration parsing, startup, data safety and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 19108-19114 · source · reference · lines 19771-19778 · source · reference · lines 19704-19723 · source · reference · lines 8049-8052 · source · reference · lines 4836-4838 · source · reference · lines 5273-5278

Scoped explicit requirement for removed upstream MariaDB InnoDB defragmentation behavior; option presence alone does not assert startup failure, packaged or fork behavior, whole-upgrade safety, or runtime behavior.

Local preparer: prufyx prepare project --project mariadb --effective-config FILE --from 10.11.8 --to 11.4.2 --effective-config-complete --precedence-resolved --upstream-distribution --require-innodb-defragmentation true|false · Requires one caller-selected complete, precedence-resolved upstream MariaDB option file and an explicit true or false removed-behavior requirement. Includes, aliases, prefixes, unsupported groups, packaged or fork-specific behavior remain UNKNOWN.

mariadb-operatorMariaDB OperatorEXECUTABLE1 executable capability; no retained sources

Official repository

Executable community project check

prufyx check project --project mariadb-operator

mariadb-operator.upgrade-26-6.requires-dataplane-prerequisitepkg:github/mariadb-operator/mariadb-operator · 26.3.0 → 26.6.0

Checks one caller-selected complete native MariaDB Operator k8s.mariadb.com/v1alpha1 MariaDB resource for the 26.3.0 to 26.6.0 Galera-only autoUpdateDataPlane prerequisite, with pre-operator-update declared. It is separate from MariaDB Server. Admission, cluster state, controller progress, data-plane completion, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 980-993 · source · reference · lines 5774-5781 · source · reference · lines 358-374 · source · reference · lines 1021-1034 · source · reference · lines 304-313 · source · reference · lines 6301-6308 · source · reference · lines 371-386 · source · reference · lines 8-20

Scoped Galera-only prerequisite for one complete caller-selected MariaDB resource before the 26.3.0 to 26.6.0 operator update; it does not inspect admission, cluster state, runtime behavior, controller progress, data-plane completion, or whole-upgrade safety.

Local preparer: prufyx prepare project --project mariadb-operator --mariadb-resource FILE --from 26.3.0 --to 26.6.0 --resource-complete --pre-operator-update · Requires one caller-selected complete native apiVersion k8s.mariadb.com/v1alpha1, kind MariaDB resource, explicit Galera-only scope, and the pre-operator-update declaration. It checks only the documented autoUpdateDataPlane prerequisite; admission, cluster state, runtime behavior, controller progress, data-plane completion, and whole-upgrade safety remain UNKNOWN.

metallbMetalLBEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project metallb

metallb.legacy-configmap-removed.0-12-1-to-0-13-2pkg:github/metallb/metallb · 0.12.1 → 0.13.2

Evidence: source · reference · lines 6-12 · source · reference · lines 34-42 · source · reference · lines 6-13

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project metallb · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

release_note · 0.13.2 · lines 6-13 · release_note · 0.16.1 · lines 5-12

Reference metadata only; source selection does not create executable upgrade support.

natsNATSEXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project nats

nats.names-with-ascii-spaces-rejected.2-10-0-to-2-11-0pkg:github/nats-io/nats-server · 2.10.0 → 2.11.0

Evidence: source · reference · lines 840-846 · source · reference · lines 1599-1620 · source · reference · lines 1823-1842 · source · reference · lines 980-993 · source · reference · lines 1768-1792 · source · reference · lines 2006-2027

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

nats.names-with-ascii-spaces-rejected.2-10-29-to-2-14-6pkg:github/nats-io/nats-server · 2.10.29 → 2.14.6

Evidence: source · reference · lines 56-59 · source · reference · lines 2028-2039 · source · reference · lines 14-24 · source · reference · lines 925-1039 · source · reference · lines 2278-2289 · source · reference · lines 1152-1163 · source · reference · lines 67-70

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

nats.names-with-ascii-spaces-rejected.2-11-17-to-2-14-6pkg:github/nats-io/nats-server · 2.11.17 → 2.14.6

Evidence: source · reference · lines 67-70 · source · reference · lines 2028-2039 · source · reference · lines 14-24 · source · reference · lines 925-1039 · source · reference · lines 2278-2289 · source · reference · lines 1152-1163 · source · reference · lines 67-70

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

nats.names-with-ascii-spaces-rejected.2-12-15-to-2-14-6pkg:github/nats-io/nats-server · 2.12.15 → 2.14.6

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

nats.names-with-ascii-spaces-rejected.2-8-4-to-2-14-6pkg:github/nats-io/nats-server · 2.8.4 → 2.14.6

Evidence: source · reference · lines 42-45 · source · reference · lines 2028-2039 · source · reference · lines 14-24 · source · reference · lines 925-1039 · source · reference · lines 2278-2289 · source · reference · lines 1152-1163 · source · reference · lines 67-70

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

nats.names-with-ascii-spaces-rejected.2-9-25-to-2-14-6pkg:github/nats-io/nats-server · 2.9.25 → 2.14.6

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project nats --nats-config FILE · Checks only supplied literal server_name, cluster.name, and gateway.name in a bounded native JSON configuration subset; includes, variables, defaults, startup behavior, connectivity, and whole-upgrade safety remain UNKNOWN.

opaOpen Policy Agent (OPA)EXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project opa

opa.v0-consumer-producer-option-at-1-20-2-from-1-15-2pkg:github/open-policy-agent/opa · 1.15.2 → 1.20.2

Evidence: source · reference · lines 13-13 · source · reference · lines 350-369 · source · reference · lines 84-92 · source · reference · lines 305-306 · source · reference · lines 32-37 · source · reference · lines 688-733 · source · reference · lines 174-176 · source · reference · lines 13-13

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opa.v0-consumer-producer-option-at-1-20-2-from-1-16-2pkg:github/open-policy-agent/opa · 1.16.2 → 1.20.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opa.v0-consumer-producer-option-at-1-20-2-from-1-17-1pkg:github/open-policy-agent/opa · 1.17.1 → 1.20.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opa.v0-consumer-producer-option-at-1-20-2-from-1-18-2pkg:github/open-policy-agent/opa · 1.18.2 → 1.20.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opa.v0-consumer-producer-option-at-1-20-2-from-1-19-1pkg:github/open-policy-agent/opa · 1.19.1 → 1.20.2

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opa.v0-consumer-producer-option.1-0pkg:github/open-policy-agent/opa · 0.70.0 → 1.0.0

Evidence: source · reference · lines 134-150

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

migration_guide · reference_only · lines 134-150

Reference metadata only; source selection does not create executable upgrade support.

opencostOpenCostEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project opencost

opencost.cloud-cost-source-migration.1-116-0-to-1-121-2pkg:github/opencost/opencost · 1.116.0 → 1.121.2

Evidence: source · reference · lines 55-60 · source · reference · lines 606-610 · source · reference · lines 78-101 · source · reference · lines 637-661 · source · reference · lines 229-350

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opencost.cloud-cost-source-migration.1-117-6-to-1-121-2pkg:github/opencost/opencost · 1.117.6 → 1.121.2

Evidence: source · reference · lines 55-60 · source · reference · lines 638-642 · source · reference · lines 78-101 · source · reference · lines 637-661 · source · reference · lines 229-350

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opencost.cloud-cost-source-migration.1-118-0-to-1-121-2pkg:github/opencost/opencost · 1.118.0 → 1.121.2

Evidence: source · reference · lines 59-64 · source · reference · lines 638-642 · source · reference · lines 78-101 · source · reference · lines 637-661 · source · reference · lines 229-350

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opencost.cloud-cost-source-migration.1-119-2-to-1-121-2pkg:github/opencost/opencost · 1.119.2 → 1.121.2

Evidence: source · reference · lines 66-71 · source · reference · lines 582-586 · source · reference · lines 78-101 · source · reference · lines 637-661 · source · reference · lines 229-350

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opencost.cloud-cost-source-migration.1-119-to-1-120pkg:github/opencost/opencost · 1.119.0 → 1.120.0

Checks only caller declarations about enabled cloud-cost collection, the selected source, and declared cloud-integration file presence. It does not open the declared cloud-integration file or inspect its contents, authenticate to a provider, inspect API-managed state, or establish runtime behavior or whole-upgrade safety.

Evidence: source · reference · lines 582-586 · source · reference · lines 65-72 · source · reference · lines 63-67 · source · reference · lines 609-613 · source · reference · lines 229-307

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opencost.cloud-cost-source-migration.1-120-4-to-1-121-2pkg:github/opencost/opencost · 1.120.4 → 1.121.2

Evidence: source · reference · lines 65-68 · source · reference · lines 611-615 · source · reference · lines 78-101 · source · reference · lines 637-661 · source · reference · lines 229-350

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project opencost · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

1 selected source record

repository_metadata · reference_only · lines 1-20 · repository_metadata · reference_only · lines 100-130

Reference metadata only; source selection does not create executable upgrade support.

openfgaOpenFGAEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project openfga

openfga.oidc-required-fields.1-17-1-to-1-18-0pkg:github/openfga/openfga · 1.17.1 → 1.18.0

Evidence: source · reference · lines 11-15 · source · reference · lines 74-84 · source · reference · lines 623-631

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project openfga · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

source_code · 1.18.0 · lines 623-631 · changelog · reference_only · lines 11-20

Reference metadata only; source selection does not create executable upgrade support.

opentelemetryOpenTelemetryEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project opentelemetry

opentelemetry.internal-telemetry-default-bind.0-110-to-0-111pkg:github/open-telemetry/opentelemetry-collector · 0.110.0 → 0.111.0

Checks the source-defined internal-metrics default bind from 0.110.0 to 0.111.0 for one caller-selected complete, precedence-resolved official Collector configuration without a service.telemetry.metrics override. The effective localhost-default gate and whether remote scraping is required are caller declarations. A localhost default with remote scraping required is a scoped blocker; a wildcard default, or no remote-scrape requirement, is a scoped pass. Missing authority, unsupported syntax or distribution, listener or scrape behavior, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 76-98 · source · reference · lines 9-14 · source · reference · lines 112-176 · source · reference · lines 19-113

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

opentelemetry.logging-exporter-removed.0-111pkg:github/open-telemetry/opentelemetry-collector · 0.110.0 → 0.111.0

Checks one caller-selected complete, precedence-resolved native OpenTelemetry Collector configuration for a top-level logging or logging/name exporter from 0.110.0 to 0.111.0 only when the caller declares the official distribution. If a service pipeline is supplied, its exporter references must resolve to exporter, not connector, IDs. Custom distributions, implicit defaults, unresolved sources or overrides, unsupported YAML or values, resource presence, pipeline behavior, exporter execution, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 10-17 · source · reference · lines 17-194 · source · reference · lines 80-164 · source · reference · lines 18-75 · source · reference · lines 14-25 · source · reference · lines 17-194 · source · reference · lines 14-91 · source · reference · lines 80-164

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project opentelemetry --otel-collector-config FILE --otel-distribution official|custom --otel-config-complete --otel-config-precedence-resolved --from 0.110.0 --to 0.111.0 · Checks one caller-selected complete, precedence-resolved native OpenTelemetry Collector configuration for a logging exporter under a caller-declared official distribution. Unsupported YAML or values, defaults, custom distributions, resource presence, pipeline behavior, exporter execution, runtime behavior, and whole-upgrade safety remain UNKNOWN.

Local preparer: prufyx check cncf --project opentelemetry --otel-rule internal-telemetry-default-bind --otel-collector-config FILE --otel-distribution official --otel-config-complete --otel-config-precedence-resolved --otel-metrics-localhost-default true|false --otel-metrics-remote-scrape-required true|false --from 0.110.0 --to 0.111.0 · Checks only the source-defined internal-metrics default bind for one caller-selected complete, precedence-resolved official Collector configuration without a service.telemetry.metrics override. The feature gate and remote-scrape requirement are caller declarations; missing authority, unsupported syntax or distribution, listener or scrape behavior, runtime behavior, and whole-upgrade safety remain UNKNOWN.

2 selected source records

changelog · 0.112.0 · lines 10-16 · changelog · reference_only · lines 10-17

Reference metadata only; source selection does not create executable upgrade support.

prometheusPrometheusEXECUTABLE + SELECTED SOURCES2 executable capabilities; 7 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project prometheus

prometheus.alertmanager-api-v1-removed.2-55-1-to-3-14-0pkg:github/prometheus/prometheus · 2.55.1 → 3.14.0

Checks operator-declared canonical facts for the Alertmanager api_version from 2.55.1 to 3.14.0. Explicit v1 is a scoped blocker; explicitly declared v2 or the explicitly declared target source-derived omitted_default_v2 fact is a scoped pass. The supplied complete entry is caller context for this additional pair; it has no native preparation or raw parser claim. Unsupported or incomplete declarations, image identity, addresses, credentials, reachability, alert delivery, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 959-1029 · source · reference · lines 178-184 · source · reference · lines 1393-1397 · source · reference · lines 213-219 · source · reference · lines 249-253 · source · reference · lines 1329-1360

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.alertmanager-api-v1-removed.3-1pkg:github/prometheus/prometheus · 2.55.1 → 3.1.0

Checks literal api_version in one caller-selected complete native alerting.alertmanagers entry from 2.55.1 to 3.1.0. Explicit v1 is a scoped blocker; explicit v2 and an omitted key use the exact reviewed target source-derived v2 default. Addresses, credentials, paths, Alertmanager compatibility, reachability, alert delivery, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 178-184 · source · reference · lines 959-1029 · source · reference · lines 75-86 · source · reference · lines 189-195 · source · reference · lines 969-1083 · source · reference · lines 112-160 · source · reference · lines 260-267 · source · reference · lines 210-214

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.alertmanager-api-v1.target-config.3-10-0-to-3-14-0pkg:github/prometheus/prometheus · 3.10.0 → 3.14.0

Evidence: source · reference · lines 213-218 · source · reference · lines 1334-1360 · source · reference · lines 1370-1390 · source · reference · lines 1393-1397 · source · reference · lines 248-255

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.alertmanager-api-v1.target-config.3-11-3-to-3-14-0pkg:github/prometheus/prometheus · 3.11.3 → 3.14.0

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.alertmanager-api-v1.target-config.3-12-0-to-3-14-0pkg:github/prometheus/prometheus · 3.12.0 → 3.14.0

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.alertmanager-api-v1.target-config.3-13-3-to-3-14-0pkg:github/prometheus/prometheus · 3.13.3 → 3.14.0

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.alertmanager-api-v1.target-config.3-9-1-to-3-14-0pkg:github/prometheus/prometheus · 3.9.1 → 3.14.0

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.remote-write-http2-default.2-55-1-to-3-14-0pkg:github/prometheus/prometheus · 2.55.1 → 3.14.0

Checks one uniquely named remote_write entry in a caller-selected complete Prometheus configuration, using only its direct inline enable_http2 setting, never a nested http_config value. The caller declares whether the target endpoint requires HTTP/2: when required, true is a scoped pass and false or an omitted setting is a scoped blocker; when not required, either known selected setting satisfies that declared requirement. Ambiguous selection, invalid or unresolved configuration, endpoint support, protocol negotiation, delivery, runtime behavior and whole-upgrade safety remain UNKNOWN.

Evidence: source · reference · lines 39-53 · source · reference · lines 279-304 · source · reference · lines 52-58 · source · reference · lines 186-193 · source · reference · lines 1142-1179 · source · reference · lines 206-217 · source · reference · lines 1375-1427

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms-key-renamed.2-55-1-to-3-14-0pkg:github/prometheus/prometheus · 2.55.1 → 3.14.0

Checks operator-declared canonical facts for the scrape_classic_histograms to always_scrape_classic_histograms rename from 2.55.1 to 3.14.0. The old key is a scoped blocker and the replacement key is a scoped pass; missing, conflicting or unsupported declarations remain UNKNOWN. The supplied complete, precedence-resolved scrape_config is caller context for this additional pair; it has no native preparation or raw parser claim. It does not validate a full Prometheus configuration, start scraping, inspect targets, or establish runtime behavior or whole-upgrade safety.

Evidence: source · reference · lines 637-638 · source · reference · lines 789-792 · source · reference · lines 53-58 · source · reference · lines 75-86

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms-key-renamed.3-1pkg:github/prometheus/prometheus · 2.55.1 → 3.1.0

Checks the removal of scrape_classic_histograms and the replacement always_scrape_classic_histograms in one caller-selected scrape_config from 2.55.1 to 3.1.0 only when completeness and precedence are explicitly declared. It does not validate a full Prometheus configuration, start scraping, inspect targets, or establish runtime behavior or whole-upgrade safety.

Evidence: source · reference · lines 612-638 · source · reference · lines 652-683 · source · reference · lines 75-86 · source · reference · lines 743-778 · source · reference · lines 85-160 · source · reference · lines 46-59 · source · reference · lines 5-14

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms.target-config.3-10-0-to-3-14-0pkg:github/prometheus/prometheus · 3.10.0 → 3.14.0

Evidence: source · reference · lines 530-545 · source · reference · lines 50-57

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms.target-config.3-11-3-to-3-14-0pkg:github/prometheus/prometheus · 3.11.3 → 3.14.0

Evidence: source · reference · lines 530-545 · source · reference · lines 50-57

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms.target-config.3-12-0-to-3-14-0pkg:github/prometheus/prometheus · 3.12.0 → 3.14.0

Evidence: source · reference · lines 530-545 · source · reference · lines 50-57

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms.target-config.3-13-3-to-3-14-0pkg:github/prometheus/prometheus · 3.13.3 → 3.14.0

Evidence: source · reference · lines 530-545 · source · reference · lines 50-57

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

prometheus.scrape-classic-histograms.target-config.3-9-1-to-3-14-0pkg:github/prometheus/prometheus · 3.9.1 → 3.14.0

Evidence: source · reference · lines 530-545 · source · reference · lines 50-57

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project prometheus --alertmanager-config FILE --from 2.55.1 --to 3.1.0 --alertmanager-config-complete --alertmanager-config-precedence-resolved · Checks only literal api_version in one caller-selected complete native alerting.alertmanagers entry; an omitted key uses the exact target source-derived v2 default. Addresses, credentials, paths, full configuration, Alertmanager compatibility, reachability, alert delivery, runtime behavior, and whole-upgrade safety remain unresolved.

Local preparer: prufyx check cncf --project prometheus --scrape-config FILE --scrape-job NAME --scrape-config-complete --scrape-config-precedence-resolved · Checks only the reviewed old/new key in one caller-selected complete native scrape_config; job names, targets, full configuration, startup, scraping, native-histogram behavior, and whole-upgrade safety remain unresolved.

Local preparer: prufyx check cncf --project prometheus --prometheus-config FILE --prometheus-config-complete --prometheus-config-precedence-resolved --prometheus-rule remote-write-http2-default --prometheus-remote-write-name NAME --prometheus-remote-write-http2-required=true|false --from 2.55.1 --to 3.14.0 · Checks one literal-name remote_write entry's direct inline enable_http2 value or exact reviewed omitted default against an explicit endpoint requirement. It does not validate the whole configuration, runtime flags, endpoint support, protocol negotiation, delivery, startup, or whole-upgrade safety.

Named local check

prufyx check prometheus-mode

Exact reviewed transition: 2.55.1 → 3.1.0

The result compares source-bound declared mode only; it does not prove process startup, applied runtime mode, data safety, or whole-upgrade compatibility.

Official source evidence: source · reference · lines 24-28

Official source evidence: source · reference · lines 99-102 · source · reference · lines 201-208 · source · reference · lines 176-261 · source · reference · lines 495-496

Official source evidence: source · reference · lines 22-25

Official source evidence: source · reference · lines 136-139 · source · reference · lines 217-284 · source · reference · lines 518-521 · source · reference · lines 554-561 · source · reference · lines 678-680

7 selected source records

changelog · 3.12.0 · lines 3-15 · changelog · reference_only · lines 1-5 · changelog · reference_only · lines 1-7 · changelog · reference_only · lines 1-12 · changelog · reference_only · lines 1-46 · changelog · reference_only · lines 5-33 · migration_guide · reference_only · lines 12-45 · migration_guide · reference_only · lines 48-59 · migration_guide · reference_only · lines 108-118

Reference metadata only; source selection does not create executable upgrade support.

rookRookEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project rook

rook.direct-minor-skip.1-15-9-to-1-20-7pkg:github/rook/rook · 1.15.9 → 1.20.7

Evidence: source · reference · lines 15-20 · source · reference · lines 15-28

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.direct-minor-skip.1-16-9-to-1-20-7pkg:github/rook/rook · 1.16.9 → 1.20.7

Evidence: source · reference · lines 15-20 · source · reference · lines 15-28

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.direct-minor-skip.1-17-9-to-1-20-7pkg:github/rook/rook · 1.17.9 → 1.20.7

Evidence: source · reference · lines 15-20 · source · reference · lines 15-28

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.direct-minor-skip.1-18-11-to-1-20-7pkg:github/rook/rook · 1.18.11 → 1.20.7

Evidence: source · reference · lines 15-20 · source · reference · lines 15-28

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.helm-intermediate-1-19-5.1-20pkg:github/rook/rook · 1.19.4 → 1.20.0

Evidence: source · reference · lines 87-101

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.minimum-kubernetes.1-20pkg:github/rook/rook · 1.19.5 → 1.20.0

Evidence: source · reference · lines 37-44

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.minimum-kubernetes.1-20-7pkg:github/rook/rook · 1.19.11 → 1.20.7

Evidence: source · reference · lines 47-52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.minimum-kubernetes.1-20-7-from-1-15-9pkg:github/rook/rook · 1.15.9 → 1.20.7

Evidence: source · reference · lines 140-142 · source · reference · lines 47-52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.minimum-kubernetes.1-20-7-from-1-16-9pkg:github/rook/rook · 1.16.9 → 1.20.7

Evidence: source · reference · lines 130-132 · source · reference · lines 47-52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.minimum-kubernetes.1-20-7-from-1-17-9pkg:github/rook/rook · 1.17.9 → 1.20.7

Evidence: source · reference · lines 150-152 · source · reference · lines 47-52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

rook.minimum-kubernetes.1-20-7-from-1-18-11pkg:github/rook/rook · 1.18.11 → 1.20.7

Evidence: source · reference · lines 148-150 · source · reference · lines 47-52

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

migration_guide · reference_only · lines 37-44 · migration_guide · reference_only · lines 87-101

Reference metadata only; source selection does not create executable upgrade support.

spiffeSPIFFEEXECUTABLE1 executable capability; no retained sources

Official repository

Standards conformance subset

prufyx check spiffe-x509-svid

Profile: public-non-ca-leaf-single-spiffe-uri-non-root-path-v1

Checks one named URI-SAN subset only; it does not validate a complete SPIFFE ID, X.509-SVID, trust chain, possession, authentication, issuance, or runtime use.

Official source evidence: source · reference · lines 99-103 · source · reference · lines 40-43 · source · reference · lines 48-52

spireSPIREEXECUTABLE + SELECTED SOURCES1 executable capability; 5 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project spire

spire.removed-entry-ttl.1-11pkg:github/spiffe/spire · 1.10.4 → 1.11.0

Evidence: source · reference · lines 137-156 · source · reference · lines 93-100 · source · reference · lines 137-156 · source · reference · lines 21-24 · source · reference · lines 88-104

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project spire · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

5 selected source records

release_note · reference_only · lines 21-24 · source_code · reference_only · lines 93-100 · source_code · reference_only · lines 88-104 · source_code · reference_only · lines 137-156 · source_code · reference_only · lines 137-156

Reference metadata only; source selection does not create executable upgrade support.

strimziStrimziEXECUTABLE + SELECTED SOURCES1 executable capability; 2 retained sources

Official repository

Executable source-rule check

prufyx check cncf --project strimzi

strimzi.kafka-v1beta2-api-removed.1-0pkg:github/strimzi/strimzi-kafka-operator · 0.51.0 → 1.0.0

Evidence: source · reference · lines 19-27 · source · reference · lines 3-8 · source · reference · lines 8-25 · source · reference · lines 20-28 · source · reference · lines 4966-4973

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project strimzi · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

2 selected source records

migration_guide · reference_only · lines 1-12 · changelog · reference_only · lines 1-30

Reference metadata only; source selection does not create executable upgrade support.

tektonTektonEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project tekton

tekton.metrics-protocol-prometheus.1-10pkg:github/tektoncd/pipeline · 1.9.0 → 1.10.0

Evidence: source · reference · lines 24-24 · source · reference · lines 76-78 · source · reference · lines 26-35 · source · reference · lines 65-85 · source · reference · lines 27-30 · source · reference · lines 40-43 · source · reference · lines 37-39 · source · reference · lines 137-150

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

migration_guide · reference_only · lines 8-45 · migration_guide · reference_only · lines 138-164

Reference metadata only; source selection does not create executable upgrade support.

thanosThanosEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project thanos

thanos.receive-store-flags-removed.0-42pkg:github/thanos-io/thanos · 0.41.0 → 0.42.0

Evidence: source · reference · lines 40-45

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

thanos.receive-store-flags-target-argv.0-37-2-to-0-42-4pkg:github/thanos-io/thanos · 0.37.2 → 0.42.4

Evidence: source · reference · lines 66-68 · source · reference · lines 1-15 · source · reference · lines 1-1175 · source · reference · lines 1-597

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

thanos.receive-store-flags-target-argv.0-38-0-to-0-42-4pkg:github/thanos-io/thanos · 0.38.0 → 0.42.4

Evidence: source · reference · lines 66-68 · source · reference · lines 1-15 · source · reference · lines 1-1175 · source · reference · lines 1-597

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

thanos.receive-store-flags-target-argv.0-39-2-to-0-42-4pkg:github/thanos-io/thanos · 0.39.2 → 0.42.4

Evidence: source · reference · lines 66-68 · source · reference · lines 1-15 · source · reference · lines 1-1175 · source · reference · lines 1-597

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

thanos.receive-store-flags-target-argv.0-40-1-to-0-42-4pkg:github/thanos-io/thanos · 0.40.1 → 0.42.4

Evidence: source · reference · lines 66-68 · source · reference · lines 1-15 · source · reference · lines 1-1175 · source · reference · lines 1-597

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

thanos.receive-store-flags-target-argv.0-41-0-to-0-42-4pkg:github/thanos-io/thanos · 0.41.0 → 0.42.4

Evidence: source · reference · lines 66-68 · source · reference · lines 1-15 · source · reference · lines 1-1175 · source · reference · lines 1-597

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx check cncf --project thanos --native-resource FILE · Checks one selected Thanos Receive or Store container in a caller-supplied Kubernetes workload with an exact reviewed image and literal argv; unresolved entrypoints, arguments, images, runtime behavior, storage, Query behavior, and whole-upgrade safety remain UNKNOWN.

1 selected source record

changelog · reference_only · lines 40-45

Reference metadata only; source selection does not create executable upgrade support.

the-update-framework-tufThe Update Framework (TUF)EXECUTABLE1 executable capability; no retained sources

Official repository

Executable source-rule check

prufyx check cncf --project the-update-framework-tuf

tuf.updater-bootstrap-keyword.6-to-7pkg:github/theupdateframework/python-tuf · 6.0.0 → 7.0.0

Checks the required bootstrap keyword on one directly bound python-tuf Updater call in a narrowly admitted Python source file. A Go static parser reads the file as data without invoking a Python interpreter or executing user code. An explicit keyword passes only the presence check; its value, cached root, trust and runtime behavior remain unchecked.

Evidence: source · reference · lines 4-18 · source · reference · lines 80-111 · source · reference · lines 4-18 · source · reference · lines 5-20 · source · reference · lines 81-147

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

tikvTiKVEXECUTABLE1 executable capability; no retained sources

Official repository

Target preflight check

prufyx check tikv-gcp-v2-wif-backup

Profile: tikv-8.5.8-gcp-v2-wif-full-backup-v1

Target: pkg:github/tikv/tikv · 8.5.8
Operator-declared operation: gcs-full-backup-wif

Reads one private native TiKV TOML for an intended GCS WIF full backup. Exactly one of [backup].gcp-v2-enable or gcp_v2_enable must be Boolean: false is BLOCKED and true is PASS for this setting only. Both aliases, whether equal or different, a missing value, or a non-Boolean value remain UNKNOWN; malformed TOML is an input error. Aggregate backup readiness always remains UNKNOWN. The check does not resolve effective configuration, defaults or overrides, and does not verify credentials, GCS access, backup completion, restore, log backup, runtime behavior or data safety.

Checks one explicit TiKV 8.5.8 planned GCS WIF full-backup setting only; aggregate backup readiness, credentials, GCS access, execution, completion, restore, log backup, runtime behavior, and data safety remain UNKNOWN.

Official source evidence: source · reference · lines 2859-2877 · source · reference · lines 2910-2928

Official source evidence: source · reference · lines 63-71

Official source evidence: source · reference · lines 2430-2436

veleroVeleroEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project velero

velero.crd-update-order.1-18pkg:github/velero-io/velero · 1.17.0 → 1.18.0

Evidence: source · reference · lines 27-62

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

velero.intermediate-1-17.1-18pkg:github/velero-io/velero · 1.16.2 → 1.18.0

Evidence: source · reference · lines 6-23

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

Local preparer: prufyx prepare cncf --project velero · The adapter prepares only a bounded operator declaration from one local private input; it does not inspect a cluster, run an upgrade, or establish runtime behavior.

1 selected source record

migration_guide · reference_only · lines 6-23 · migration_guide · reference_only · lines 27-62

Reference metadata only; source selection does not create executable upgrade support.

vitessVitessEXECUTABLE + SELECTED SOURCES1 executable capability; 1 retained source

Official repository

Executable source-rule check

prufyx check cncf --project vitess

vitess.multi-statement-dba-rpc-rejected.23-0pkg:github/vitessio/vitess · 22.0.0 → 23.0.0

Evidence: source · reference · lines 78-93

Scoped operator-declared constraint; a PASS, BLOCKED, or UNKNOWN claim never proves whole-upgrade safety or runtime behavior.

1 selected source record

changelog · reference_only · lines 78-93

Reference metadata only; source selection does not create executable upgrade support.

backstageBackstageREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

release_note · reference_only · lines 1-9

Reference metadata only; source selection does not create executable upgrade support.

chaos-meshChaos MeshREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

changelog · reference_only · lines 35-63

Reference metadata only; source selection does not create executable upgrade support.

cri-oCRI-OREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

repository_metadata · reference_only · lines 49-55 · repository_metadata · reference_only · lines 374-376

Reference metadata only; source selection does not create executable upgrade support.

k0sk0sREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

migration_guide · reference_only · lines 6-13

Reference metadata only; source selection does not create executable upgrade support.

kubevelaKubeVelaREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

changelog · reference_only · lines 1-23

Reference metadata only; source selection does not create executable upgrade support.

openebsOpenEBSREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

repository_metadata · reference_only · lines 1-11 · repository_metadata · reference_only · lines 28-55

Reference metadata only; source selection does not create executable upgrade support.

openfeatureOpenFeatureREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

repository_metadata · reference_only · lines 1-30

Reference metadata only; source selection does not create executable upgrade support.

openkruiseOpenKruiseREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

changelog · reference_only · lines 1-8

Reference metadata only; source selection does not create executable upgrade support.

opentofuOpenTofuREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

changelog · reference_only · lines 5-10

Reference metadata only; source selection does not create executable upgrade support.

sopsSOPSREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

changelog · reference_only · lines 1-28

Reference metadata only; source selection does not create executable upgrade support.

wasmedge-runtimeWasmEdge RuntimeREFERENCE ONLY · NO EXECUTABLE CHECK1 retained source; reference only

Official repository

This project has retained public-source references for discovery and provenance. It has no executable check in this preview.

1 selected source record

release_note · 0.17.1 · lines 1-55

Reference metadata only; source selection does not create executable upgrade support.

Source status: reference_only; license disposition: license_unreviewed. Evidence links open selected spans in official immutable upstream files. A scoped result remains UNKNOWN outside its declared transition, named local check, conformance profile, target preflight profile, or community project check and never proves runtime behavior or whole-upgrade safety.

Use the evidence locally

Start with a recorded example.

See the homepage examples for cert-manager and Prometheus, or read the maintainer workflow before proposing a bounded project check.

View examples Contribution workflow