ADR-0022 declare↔mount cross-validation, run client-side at deploy (for
composeArtifact workloads the compose bytes never pass through here, so
this is a deploy-path lint, not a server-enforced guarantee). All findings
are WARNINGS in the MVP (promoted to hard errors once the scanner has proven
itself on real compose files):
a declared code[] entry whose EDGIBLE_CODE_<NAME> variable is never
interpolated ships, registers and pins while changing nothing;
an EDGIBLE_CODE_* reference with no declared entry interpolates to an
empty string;
a code mount without :ro voids the digest⇒content guarantee (realization
trusts a present per-digest directory without re-verification) and writes
into it are lost on the next deploy.
ADR-0022 declare↔mount cross-validation, run client-side at deploy (for
composeArtifactworkloads the compose bytes never pass through here, so this is a deploy-path lint, not a server-enforced guarantee). All findings are WARNINGS in the MVP (promoted to hard errors once the scanner has proven itself on real compose files):code[]entry whoseEDGIBLE_CODE_<NAME>variable is never interpolated ships, registers and pins while changing nothing;EDGIBLE_CODE_*reference with no declared entry interpolates to an empty string;:rovoids the digest⇒content guarantee (realization trusts a present per-digest directory without re-verification) and writes into it are lost on the next deploy.