technical accuracy pass: kubelet/runtime split, image vs container layer, exit 137 = SIGKILL, ArgoCD maps helm hooks, selfHeal/prune opt-in, scoped absolutes (reviewer findings)

content/course-VI-gitops.md

@@ -21,8 +21,9 @@ Course II taught the reconciliation loop: desired vs actual, fix the difference,
 ArgoCD is the same habit applied to DELIVERY. An Application names a repo + path + revision
 (the GitHub linkage: watch this branch of this repository); the controller renders what it
 finds there, compares it against the live cluster, and shows the diff. Sync = make actual
-match desired. The deploy button is a git commit; the audit log is git log; code review IS
-change control.
+match desired. The deploy button is a git commit; the change history is git log; code review IS
+change control. (Accuracy: git records INTENT - the cluster's own audit log + the reconciler's
+sync history still hold what actually happened.)
 Say it like you mean it: **kubectl apply is for archaeology, not for change.**
 
 ## Move 2 - Pull, not push - the security inversion
@@ -31,14 +32,17 @@ GitHub Action holds a credential that can touch the cluster. The agent inside th
 holds a read-only deploy key to the repo - the trust arrow points OUT. Compromise the build
 system and you can propose a change (a commit, which is visible); you cannot reach into
 production. Drift works the same way: hand-edit a live object and the controller flags it
-OutOfSync - with selfHeal on, it puts it back; with prune on, what leaves git leaves the
-cluster. Rollback is `git revert`, which is why commit hygiene is an operational skill.
+OutOfSync - with selfHeal ENABLED it puts it back; with prune ENABLED what leaves git leaves
+the cluster. Both are opt-in (2026-08-17 review): without them the reconciler reports drift and
+waits for a human. Scope the pull-model claims as 'in this architecture' - push-based delivery
+is still GitOps to many. Rollback is `git revert`, which is why commit hygiene is an operational skill.
 FIELD NOTE (amber): fighting the reconciler by SSH/kubectl is arm-wrestling a machine that
 does not get tired (Course II's note, now with a face). The fix is always upstream, in git.
 
 ## Move 3 - The one thing git never holds
 Git holds everything - manifests, charts, config, the whole desired state - except secrets.
-A secret in git is published, forever, to everyone who ever clones. So the pattern splits
+A plaintext secret committed to git is COMPROMISED from that moment - deleting it later does
+not guarantee it is gone from history, forks, clones, CI caches or backups. So the pattern splits
 the reference from the value: git carries an ExternalSecret manifest naming a LOGICAL key
 ("this app needs db-password from the vault"); a vault - Azure Key Vault as the worked
 example, any ESO-supported store works - holds the value; an operator inside the cluster

content/course-VIII-helm-contexts.md

@@ -24,10 +24,11 @@ every manifest calls, and `include`/`toYaml`/`default` compose them. The mental
 you are not writing YAML, you are writing a program whose OUTPUT is YAML - so render
 locally (`helm template`), read the output, and lint what came out, not what went in.
 Say it like you mean it: **review the render, not just the template.**
-FIELD NOTE (amber): ArgoCD deploys charts by running `helm template` - a pure render.
-Anything that needs a live cluster or an install lifecycle (`lookup`, hooks) is silently
-dead there. A chart that works under `helm install` can behave differently under GitOps -
-render the way your deployer renders.
+FIELD NOTE (amber, CORRECTED 2026-08-17): ArgoCD renders with `helm template` rather than
+running `helm install`, so the lifecycle differs. `lookup` comes back empty (no live cluster at
+render). Hooks are NOT dead: Argo maps Helm hooks onto its sync phases (pre-install/pre-upgrade
+-> PreSync, post-install/post-upgrade -> PostSync); rollback and test hooks have no equivalent.
+Render the way your deployer renders and check where hooks land.
 
 ## Move 2 - Contexts: the cluster's whole voice is one small file
 The fleet pattern: the chart owns EVERYTHING structural - resources, probes, security