fix(compose): retain mounted secret file authority - #281

ACTIVE Draft — retained mounted-secret descriptor authority

Protected main@b84f0c94154043a3473939c01bb6471de5a129ae remains unchanged. This source lane is fix/compose-secret-file-authority-b84f0c9, an explicit child of dependency-root #233@5951b7a4d779903b8924abaef2a387cae50b7f54. Exact current head is c00111e54f21c4cf90036ee66072d5fafaed3ef6, Draft and mechanically mergeable. No source or documentation was written directly to protected main.

Defects proven test-first

Final-component substitution

The earlier standalone Compose bootstrap opened an explicit mounted password-file path through ordinary pathname resolution. A final symlink could therefore redirect password authority away from the mounted-secret object selected by the operator.

The branch retains one package-owned descriptor opened with O_RDONLY | O_CLOEXEC | O_NOFOLLOW | O_NONBLOCK, rejects platforms that cannot provide the no-follow boundary instead of silently downgrading, proves a regular-file inode before reading, bounds the read, and closes retained authority explicitly. FIFO/non-regular objects, descriptor metadata failures, and close failures remain fixed/content-free failures.

In-place mutation after initial inspection

Test-first commit e0ec0b08bf9ebffbbf5310d86e549a47a0fd1f36 adds a deterministic regression that changes the same retained secret object after the initial descriptor stat and requires fail-closed ConfigError rather than accepting modified bytes.

Current GREEN c00111e54f21c4cf90036ee66072d5fafaed3ef6 snapshots retained regular-file metadata before the bounded read and re-reads descriptor metadata afterward. It rejects observed mode, size, link-count, owner/group, device/inode, mtime, or ctime change through the existing fixed unavailable category. Both observations and the read use the same retained descriptor, so pathname substitution cannot regain authority; mutation after the final metadata observation cannot change the already captured password bytes.

The repair intentionally does not add host-owner/mode assumptions that would reject ordinary container secret mounts, claim immutability against host-root compromise, or expose secret text in argv/logs/telemetry/errors.

Exact current-head validation

The previous body’s queued/pending description is stale. Fresh commit-scoped inventory for unchanged exact c00111e54f21c4cf90036ee66072d5fafaed3ef6 now shows:

• CI 32372722989: success;
• Release Acceptance 32372723081: success;
• Security Scan: absent on this exact head; and
• SAST Semgrep: absent on this exact head.

Fresh formal reviews and inline review threads are empty. Exact-head CI/release success does not transfer predecessor security evidence; absent Security/SAST and absent approval remain non-passing.

Writer / integration boundary

Fresh lifecycle adjudication in #316 proves retained agent/compose-loopback-publishing@4debfc68655e300a6c393b0cbd3c251daf4faf03 is SUPERSEDED_RETAINED, not current Compose implementation/writer authority: its owning Draft #91 is closed unmerged and explicitly superseded by merged #138, whose merge commit b7f8a48d4745ebd1b429027168c3d2f776c6a4a7 is independently proven in current protected-main ancestry. Preserve that historical ref for provenance; do not delete, rewrite, or transfer its old evidence. fix/compose-bootstrap-runpy-warning-b84f0c9 remains a separate warning-test slice. This correction does not declare the mounted-secret source/test surface globally writer-free: before any future source mutation, freshly inventory all then-current PR/no-PR refs and exact changed paths, and freeze this lane if another actor moves or overlaps it.

Keep #281 Draft behind #233. After #233 reaches protected main through then-live governance, reconcile/retarget this branch to the resulting exact protected base and reacquire one unchanged exact-final-head proof for supported Python including 3.14, exact 100% owned production statement/branch coverage, public docstrings, package/container, Security Scan, SAST, SBOM/provenance/release acceptance, zero valid findings/threads, and any qualifying independent current-last-push approval required by live policy. Do not copy or bypass read-only central .github control-plane logic.