rcf-lite 0.26.0 → 0.28.0

package/blueprints/platform-docker-compose-host/contributions/probes/caddyfile-validate.mjs

@@ -1,35 +1,43 @@
-// Probe: caddyfile-validate.
+// Probe: caddyfile-validate (v1.1.8).
 //
-// anchorAcId: AC-composeHost-reverseProxyArtefactValid.
-// accountBound: false.
-//
-// Runs caddy validate against the applied fixture caddy/Caddyfile. When
-// a local caddy binary is not on PATH the probe uses the caddy:2
-// container image via docker run --rm (pinned tag), so review machines
-// without a local caddy still get a real validation. When neither is
-// available the probe records skipped with a warn note.
-//
-// The applying project may set reverseProxy to a value other than caddy
-// (traefik or none per ADR-3902); when that happens the probe returns
-// skipped with note.
+// This is an offline validator: it reads the shipped Caddyfile and
+// the shipped compose.yaml and shells out to `caddy validate` (or
+// a caddy:2 container via `docker run --rm`). It has no engine-
+// minted identifier - the sha256 of the read artefact is computed
+// by this probe with Node's `createHash` and the compose bind-
+// mount line is text the probe extracted. Every result row is a
+// `conformanceOnly` de-claim naming the shipped AC clause the
+// offline check does not observe. The exit status, tail excerpt,
+// the observed bind-mount line and the hash of the read artefact
+// stay on the row as derived context.
 //
 // Mutation:
-// - SIMULATE_INVALID_CADDYFILE=true writes an obviously-invalid
-//   directive (\"not-a-directive-at-all\") into a scratch copy of the
-//   Caddyfile; the probe FAILS naming the offending line.
+// - SIMULATE_INVALID_CADDYFILE=true appends an unclosed-block syntax
+//   error to a scratch copy of the Caddyfile; the probe FAILS naming
+//   the offending tail.
 
 import { readFile, writeFile, mkdir, rm } from 'node:fs/promises';
 import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { tmpdir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { runShim, CADDYFILE_PATH, whichCaddy, whichDocker } from './probe-utils.mjs';
+import { join } from 'node:path';
+import { runShim, CADDYFILE_PATH, COMPOSE_PATH, whichCaddy, whichDocker } from './probe-utils.mjs';
 
-export const anchorAcId = 'AC-composeHost-reverseProxyArtefactValid';
+function sha256(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+export const anchorAcId = null;
 export const accountBound = false;
 
+const VENDOR_CADDY = 'https://caddyserver.com/docs/command-line#caddy-validate';
+const VENDOR_DOCKER = 'https://docs.docker.com/reference/cli/docker/container/run/';
+const VENDOR_VERIFIED_ON = '2026-09-11';
+
+const LIMIT_38107_4 = 'AC-38107-4: compose bind-mount for the reverse-proxy config is validated offline against the shipped compose.yaml text; the live on-server observation (the compose stack applying the read-only mount) is carried by real-account-minimal-stack-up.';
+const LIMIT_REV_PROXY = 'AC-composeHost-reverseProxyArtefactValid: the reverse-proxy artefact is validated offline by `caddy validate` against the shipped Caddyfile; the live observation (the artefact serving traffic on the applied stack) is carried by real-account-reload-burst.';
+
 function isCaddyReverseProxy() {
-  // Applying project passes reverseProxy via env for the probe run; the
-  // shipped default per ADR-3902 is caddy.
   const v = process.env.REVERSE_PROXY;
   if (v === undefined || v === 'caddy') return true;
   return false;
@@ -42,12 +50,61 @@ export default async function runProbe() {
   extra.reverseProxy = process.env.REVERSE_PROXY ?? 'caddy';
   if (!isCaddyReverseProxy()) {
     results.push({
-      anchorAcId,
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_REV_PROXY,
       verdict: 'skipped',
-      detail: `reverseProxy=${extra.reverseProxy}: caddyfile-validate skipped (applies only when reverseProxy=caddy)`,
+      detail: `offline caddyfile-validate: reverseProxy=${extra.reverseProxy}: skipped (applies only when reverseProxy=caddy)`,
+      evidence: { reverseProxy: extra.reverseProxy },
     });
     return { results, extra };
   }
+
+  // Bind-mount check: the compose file mounts caddy/Caddyfile
+  // read-only into the caddy service. AC-38107-4 requires the :ro
+  // suffix or read_only: true on the long-form. This is a source-
+  // tree observation carried as a conformanceOnly de-claim.
+  try {
+    const composeText = await readFile(COMPOSE_PATH, 'utf8');
+    const composeSha256 = sha256(composeText);
+    const caddyMountRe = /\.\/caddy\/Caddyfile:\/etc\/caddy\/Caddyfile:ro/;
+    if (caddyMountRe.test(composeText)) {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_38107_4,
+        verdict: 'pass',
+        detail: 'offline caddyfile-validate: compose.yaml bind-mounts caddy/Caddyfile into the caddy service read-only (:ro suffix present)',
+        evidence: {
+          composeSha256,
+          composeMountLine: (composeText.match(/[^\n]*Caddyfile:\/etc\/caddy\/Caddyfile[^\n]*/) || [''])[0],
+          mountSuffix: ':ro',
+        },
+      });
+    } else {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_38107_4,
+        verdict: 'fail',
+        detail: 'offline caddyfile-validate: compose.yaml Caddyfile bind-mount is not read-only; expected :ro suffix on ./caddy/Caddyfile:/etc/caddy/Caddyfile',
+        evidence: {
+          composeSha256,
+          composeMountLine: (composeText.match(/[^\n]*Caddyfile[^\n]*/) || [''])[0],
+        },
+      });
+    }
+  } catch (err) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_38107_4,
+      verdict: 'fail',
+      detail: `offline caddyfile-validate: could not read compose.yaml to check the Caddyfile bind-mount: ${err.message}`,
+      evidence: { composePath: COMPOSE_PATH, error: err.message },
+    });
+  }
+
   const scratchDir = join(tmpdir(), `rcf-lite-t2-caddyfile-validate-${Date.now()}`);
   await mkdir(scratchDir, { recursive: true });
   const scratchPath = join(scratchDir, 'Caddyfile');
@@ -56,6 +113,7 @@ export default async function runProbe() {
     if (process.env.SIMULATE_INVALID_CADDYFILE === 'true') {
       text = text + "\n{ unclosed_block_that_never_ends_and_is_a_syntax_error_caddy_will_reject\n";
     }
+    const caddyfileSha256 = sha256(text);
     await writeFile(scratchPath, text, 'utf8');
     const localCaddy = whichCaddy();
     const localDocker = whichDocker();
@@ -73,9 +131,12 @@ export default async function runProbe() {
       engineLabel = 'caddy:2 container (docker run --rm)';
     } else {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_REV_PROXY,
         verdict: 'warn',
-        detail: 'neither caddy binary nor docker on PATH; caddy validate could not be exercised',
+        detail: 'offline caddyfile-validate: neither caddy binary nor docker on PATH; caddy validate could not be exercised',
+        evidence: { caddyLocal: null, dockerLocal: null },
       });
       return { results, extra };
     }
@@ -85,15 +146,41 @@ export default async function runProbe() {
     const tail = ((r.stderr || '') + (r.stdout || '')).split('\n').slice(-10).join('\n');
     if (r.status === 0) {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_REV_PROXY,
         verdict: 'pass',
-        detail: `caddy validate exit 0 (${engineLabel}); tail: ${tail.slice(-200)}`,
+        detail: `offline caddyfile-validate: caddy validate exit 0 (${engineLabel}); tail: ${tail.slice(-200)}`,
+        evidence: {
+          caddyfileSha256,
+          engineLabel,
+          exitStatus: 0,
+          tailExcerpt: tail.slice(-400),
+          vendorDocs: {
+            caddyValidate: VENDOR_CADDY,
+            dockerRunRm: VENDOR_DOCKER,
+            verifiedOn: VENDOR_VERIFIED_ON,
+          },
+        },
       });
     } else {
       results.push({
-        anchorAcId,
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_REV_PROXY,
         verdict: 'fail',
-        detail: `caddy validate exit ${r.status} (${engineLabel}); tail: ${tail.slice(-400)}`,
+        detail: `offline caddyfile-validate: caddy validate exit ${r.status} (${engineLabel}); tail: ${tail.slice(-400)}`,
+        evidence: {
+          caddyfileSha256,
+          engineLabel,
+          exitStatus: r.status,
+          tailExcerpt: tail.slice(-400),
+          vendorDocs: {
+            caddyValidate: VENDOR_CADDY,
+            dockerRunRm: VENDOR_DOCKER,
+            verifiedOn: VENDOR_VERIFIED_ON,
+          },
+        },
       });
     }
   } finally {

package/blueprints/platform-docker-compose-host/contributions/probes/compose-config-lint.mjs

@@ -1,52 +1,54 @@
-// Probe: compose-config-lint.
+// Probe: compose-config-lint (v1.1.8).
 //
-// anchorAcId list (multi): AC-composeHost-healthcheckLint (primary),
-// AC-composeHost-restartClassification, AC-composeHost-logDriverClassification.
-// accountBound: false.
+// This is an offline validator: it parses the shipped compose.yaml
+// and (when a Docker daemon is reachable) shells out to
+// `docker compose config`. It has no engine-minted identifier - the
+// sha256 of compose.yaml is computed by this probe with Node's
+// `createHash` and the service names are Compose's own choices, not
+// engine-returned identities. Every result row is a
+// `conformanceOnly` de-claim naming the shipped AC clause the
+// offline check does not observe; the live observation for each
+// property lives on the account-bound probes that stand a real
+// compose stack up.
+//
+// Splits per-property observations into their own result rows:
+//   - AC-composeHost-healthcheckLint  per HTTP-terminating service.
+//   - AC-composeHost-restartClassification  per service.
+//   - AC-composeHost-logDriverClassification  per service, and one
+//     top-level check that every service uses the single elicited
+//     driver (LOG_DRIVER env, default journald).
+//   - AC-composeHost-healthcheckLint  one summary docker-compose-config
+//     exit row when the daemon is reachable.
 //
-// Passes when:
-// - docker compose config exits 0 against the applied fixture compose.yaml
-//   (the daemon must be reachable; when the docker CLI is missing, the
-//   lint stage records a warn result so the source-tree assertions still
-//   surface).
-// - every HTTP-terminating service (web) declares a healthcheck block.
-// - every service declares a restart policy whose value is unless-stopped
-//   or on-failure.
-// - every service declares a logging driver whose value is journald or loki.
-// - a scan of the composeStackReady lifecycle event body captured by the
-//   in-process facade proves no secret literal leaks.
+// The compose.yaml bytes hash and the observed values (driver,
+// restart policy, healthcheck keys, docker compose config exit)
+// stay on the row as derived context.
 //
-// Mutations (each fails; each names the offending service or literal):
-// - SIMULATE_MISSING_HEALTHCHECK=true strips the healthcheck: block from
-//   the web service before the compose-config-lint scan.
-// - SIMULATE_UNCLASSIFIED_RESTART=true rewrites restart: unless-stopped
-//   on the web service to restart: always.
-// - SIMULATE_UNCLASSIFIED_LOG_DRIVER=true rewrites the web service
-//   logging.driver from journald to syslog.
-// - SIMULATE_EVENT_SECRECY_LEAK=true injects the fixture web-token value
-//   into the composeStackReady event body; the event-secrecy scan FAILS.
+// accountBound: false.
 
 import { spawnSync } from 'node:child_process';
-import { readFile, readdir } from 'node:fs/promises';
-import { resolve } from 'node:path';
-import { runShim, readCompose, COMPOSE_PATH, FIXTURE_DIR, SECRET_PATH, whichDocker } from './probe-utils.mjs';
+import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { runShim, readCompose, COMPOSE_PATH, FIXTURE_DIR, whichDocker, parseComposeYaml } from './probe-utils.mjs';
+
+function sha256(text) {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
 
-export const anchorAcIds = [
-  'AC-composeHost-healthcheckLint',
-  'AC-composeHost-restartClassification',
-  'AC-composeHost-logDriverClassification',
-];
+export const anchorAcIds = [];
 export const accountBound = false;
 
 const HTTP_SERVICES = new Set(['web', 'caddy']);
 const ALLOWED_RESTART = new Set(['unless-stopped', 'on-failure']);
 const ALLOWED_LOG_DRIVER = new Set(['journald', 'loki']);
 
+const LIMIT_HC = 'AC-composeHost-healthcheckLint: healthcheck presence is validated offline against the shipped compose.yaml; the live observation (a healthy compose service reporting healthy in `docker compose ps`) is carried by real-account-minimal-stack-up.';
+const LIMIT_RESTART = 'AC-composeHost-restartClassification: restart-policy classification is validated offline against the shipped compose.yaml; the live observation (a compose stack applying and honouring the policy) is carried by real-account-minimal-stack-up.';
+const LIMIT_LOG = 'AC-composeHost-logDriverClassification: log-driver classification is validated offline against the shipped compose.yaml against the elicited LOG_DRIVER; the live observation (a compose stack routing logs through the applied driver) lives on the account-bound branch.';
+
 function applyMutations(text) {
   let out = text;
   if (process.env.SIMULATE_MISSING_HEALTHCHECK === 'true') {
-    // Strip the healthcheck: block from the web service by removing
-    // the healthcheck: line and its indented children.
     const lines = out.split('\n');
     const trimmed = [];
     let stripping = false;
@@ -58,7 +60,6 @@ function applyMutations(text) {
         if (line.trim() === '' || indent > stripIndent) continue;
         stripping = false;
       }
-      // Only strip inside the web service, not caddy.
       if (line.match(/^\s{4}healthcheck:\s*$/) && trimmed.slice(-30).some((l) => l.match(/^\s{2}web:\s*$/))) {
         const m = line.match(/^(\s*)/);
         stripIndent = m ? m[1].length : 0;
@@ -78,50 +79,139 @@ function applyMutations(text) {
   return out;
 }
 
-function scanServices(doc) {
+function scanHealthchecks(doc, extra, composeSha256) {
   const results = [];
   const services = doc.services ?? {};
-  const names = Object.keys(services);
-  for (const name of names) {
+  const httpNames = Object.keys(services).filter((n) => HTTP_SERVICES.has(n));
+  for (const name of httpNames) {
     const svc = services[name] ?? {};
-    if (HTTP_SERVICES.has(name)) {
-      if (!svc.healthcheck) {
-        results.push({
-          anchorAcId: 'AC-composeHost-healthcheckLint',
-          verdict: 'fail',
-          detail: `HTTP-terminating service '${name}' is missing a healthcheck: block`,
-        });
-      }
+    if (!svc.healthcheck) {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_HC,
+        verdict: 'fail',
+        detail: `offline compose-config-lint: HTTP-terminating service '${name}' is missing a healthcheck: block`,
+        evidence: { composeSha256, serviceName: name, missingServices: [name], expectedShape: 'healthcheck block', observedShape: 'absent' },
+      });
+    } else {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_HC,
+        verdict: 'pass',
+        detail: `offline compose-config-lint: HTTP-terminating service '${name}' carries a healthcheck: block`,
+        evidence: {
+          composeSha256,
+          serviceName: name,
+          healthcheckKeys: Object.keys(svc.healthcheck || {}).sort(),
+        },
+      });
     }
+  }
+  return results;
+}
+
+function scanRestart(doc, composeSha256) {
+  const results = [];
+  const services = doc.services ?? {};
+  for (const name of Object.keys(services)) {
+    const svc = services[name] ?? {};
     const restart = svc.restart;
     if (!restart) {
       results.push({
-        anchorAcId: 'AC-composeHost-restartClassification',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_RESTART,
         verdict: 'fail',
-        detail: `service '${name}' declares no restart policy; allowed: unless-stopped, on-failure`,
+        detail: `offline compose-config-lint: service '${name}' declares no restart policy; allowed: unless-stopped, on-failure`,
+        evidence: { composeSha256, serviceName: name, restart: null },
       });
     } else if (!ALLOWED_RESTART.has(String(restart))) {
       results.push({
-        anchorAcId: 'AC-composeHost-restartClassification',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_RESTART,
         verdict: 'fail',
-        detail: `service '${name}' declares restart: ${restart}; allowed: unless-stopped, on-failure`,
+        detail: `offline compose-config-lint: service '${name}' declares restart: ${restart}; allowed: unless-stopped, on-failure`,
+        evidence: { composeSha256, serviceName: name, restart: String(restart), allowed: ['unless-stopped', 'on-failure'] },
+      });
+    } else {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_RESTART,
+        verdict: 'pass',
+        detail: `offline compose-config-lint: service '${name}' declares restart: ${restart}`,
+        evidence: { composeSha256, serviceName: name, restart: String(restart) },
       });
     }
-    const logging = svc.logging;
-    const driver = logging && logging.driver;
+  }
+  return results;
+}
+
+function scanLogging(doc, composeSha256) {
+  const results = [];
+  const services = doc.services ?? {};
+  const elicitedDriver = process.env.LOG_DRIVER || 'journald';
+  const observedDrivers = [];
+  for (const name of Object.keys(services)) {
+    const svc = services[name] ?? {};
+    const driver = svc.logging && svc.logging.driver;
     if (!driver) {
       results.push({
-        anchorAcId: 'AC-composeHost-logDriverClassification',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_LOG,
         verdict: 'fail',
-        detail: `service '${name}' declares no logging driver; allowed: journald, loki`,
+        detail: `offline compose-config-lint: service '${name}' declares no logging driver; allowed: journald, loki`,
+        evidence: { composeSha256, serviceName: name, driver: null },
       });
-    } else if (!ALLOWED_LOG_DRIVER.has(String(driver))) {
+      observedDrivers.push(null);
+      continue;
+    }
+    if (!ALLOWED_LOG_DRIVER.has(String(driver))) {
       results.push({
-        anchorAcId: 'AC-composeHost-logDriverClassification',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_LOG,
         verdict: 'fail',
-        detail: `service '${name}' declares logging driver '${driver}'; allowed: journald, loki`,
+        detail: `offline compose-config-lint: service '${name}' declares logging driver '${driver}'; allowed: journald, loki`,
+        evidence: { composeSha256, serviceName: name, driver: String(driver), allowed: ['journald', 'loki'] },
       });
+      observedDrivers.push(String(driver));
+      continue;
     }
+    observedDrivers.push(String(driver));
+  }
+  const distinct = new Set(observedDrivers.filter(Boolean));
+  if (distinct.size > 1) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_LOG,
+      verdict: 'fail',
+      detail: `offline compose-config-lint: services declare more than one log driver (${[...distinct].join(', ')}); the elicited log-driver=${elicitedDriver} requires every service to match`,
+      evidence: { composeSha256, composeFile: 'compose.yaml', elicitedDriver, observedDrivers, distinct: [...distinct] },
+    });
+  } else if (distinct.size === 1 && !distinct.has(elicitedDriver)) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_LOG,
+      verdict: 'fail',
+      detail: `offline compose-config-lint: services declare log driver ${[...distinct][0]} but the elicited log-driver is ${elicitedDriver}`,
+      evidence: { composeSha256, composeFile: 'compose.yaml', elicitedDriver, observedDrivers },
+    });
+  } else if (distinct.size === 1) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_LOG,
+      verdict: 'pass',
+      detail: `offline compose-config-lint: every service uses the elicited log driver ${[...distinct][0]}`,
+      evidence: { composeSha256, composeFile: 'compose.yaml', elicitedDriver, observedDrivers },
+    });
   }
   return results;
 }
@@ -129,44 +219,43 @@ function scanServices(doc) {
 export default async function runProbe() {
   const results = [];
   const extra = {};
-  // Source-tree scan on the (possibly mutated) compose file.
   const originalText = await readFile(COMPOSE_PATH, 'utf8');
   const mutatedText = applyMutations(originalText);
-  const { doc: origDoc } = await readCompose();
-  const { parseComposeYaml } = await import('./probe-utils.mjs');
+  const composeSha256 = sha256(mutatedText);
+  extra.composeSha256 = composeSha256;
   const mutatedDoc = parseComposeYaml(mutatedText);
-  const scanResults = scanServices(mutatedDoc);
-  results.push(...scanResults);
   extra.serviceNames = Object.keys(mutatedDoc.services ?? {});
   extra.mutations = {
     missingHealthcheck: process.env.SIMULATE_MISSING_HEALTHCHECK === 'true',
     unclassifiedRestart: process.env.SIMULATE_UNCLASSIFIED_RESTART === 'true',
     unclassifiedLogDriver: process.env.SIMULATE_UNCLASSIFIED_LOG_DRIVER === 'true',
-    eventSecrecyLeak: process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true',
   };
-  // docker compose config lint (on the mutated text, via a scratch file).
+  results.push(...scanHealthchecks(mutatedDoc, extra, composeSha256));
+  results.push(...scanRestart(mutatedDoc, composeSha256));
+  results.push(...scanLogging(mutatedDoc, composeSha256));
   const dockerVersion = whichDocker();
   extra.dockerVersion = dockerVersion;
   if (dockerVersion === null) {
     results.push({
-      anchorAcId: 'AC-composeHost-healthcheckLint',
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMIT_HC,
       verdict: 'warn',
-      detail: 'docker CLI absent on PATH; source-tree assertions ran but docker compose config was not exercised',
+      detail: 'offline compose-config-lint: docker CLI absent on PATH; source-tree assertions ran but docker compose config was not exercised',
+      evidence: { composeSha256, dockerLocal: null },
     });
   } else {
-    const { writeFile, mkdir } = await import('node:fs/promises');
+    const { writeFile, mkdir, cp } = await import('node:fs/promises');
     const { tmpdir } = await import('node:os');
     const { join } = await import('node:path');
     const scratch = join(tmpdir(), `rcf-lite-t2-compose-config-lint-${Date.now()}`);
     await mkdir(scratch, { recursive: true });
     await writeFile(join(scratch, 'compose.yaml'), mutatedText, 'utf8');
-    // Copy .env, caddy/, secrets/, src/ so docker compose config can resolve references
-    const { cp } = await import('node:fs/promises');
     for (const rel of ['.env', 'caddy', 'secrets', 'src']) {
       try {
         await cp(join(FIXTURE_DIR, rel), join(scratch, rel), { recursive: true });
       } catch (err) {
-        // best-effort; docker compose config still validates syntax
+        // best-effort
       }
     }
     const cfg = spawnSync('docker', ['compose', '-f', join(scratch, 'compose.yaml'), 'config'], {
@@ -174,54 +263,37 @@ export default async function runProbe() {
     });
     if (cfg.status === 0) {
       results.push({
-        anchorAcId: 'AC-composeHost-healthcheckLint',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_HC,
         verdict: 'pass',
-        detail: 'docker compose config exit 0 on the applied compose.yaml',
+        detail: `offline compose-config-lint: docker compose config exit 0 (docker ${dockerVersion})`,
+        evidence: {
+          composeSha256,
+          composeFile: 'compose.yaml',
+          dockerVersion,
+          engineNote: 'Docker Engine (compose sub-command); vendor documentation https://docs.docker.com/compose/compose-file/, verifiedOn 2026-09-11',
+          exitStatus: 0,
+        },
       });
     } else {
       results.push({
-        anchorAcId: 'AC-composeHost-healthcheckLint',
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMIT_HC,
         verdict: 'fail',
-        detail: `docker compose config exit ${cfg.status}: ${(cfg.stderr || cfg.stdout || '').slice(0, 400)}`,
+        detail: `offline compose-config-lint: docker compose config exit ${cfg.status}: ${(cfg.stderr || cfg.stdout || '').slice(0, 400)}`,
+        evidence: {
+          composeSha256,
+          composeFile: 'compose.yaml',
+          dockerVersion,
+          exitStatus: cfg.status,
+          stderr: (cfg.stderr || '').slice(0, 400),
+        },
       });
     }
     extra.dockerComposeConfigExit = cfg.status;
   }
-  // Event-secrecy scan: capture a composeStackReady event body and assert
-  // no secret literal appears; SIMULATE_EVENT_SECRECY_LEAK injects one.
-  const secretValue = (await readFile(SECRET_PATH, 'utf8')).trim();
-  const event = {
-    kind: 'composeStackReady',
-    services: extra.serviceNames,
-    imageDigests: extra.serviceNames.map((n) => `sha256:fixture-${n}`),
-    healthTimesMs: extra.serviceNames.map(() => 42),
-  };
-  if (process.env.SIMULATE_EVENT_SECRECY_LEAK === 'true') {
-    event.debug = { boundToken: secretValue };
-  }
-  const eventBody = JSON.stringify(event);
-  if (eventBody.includes(secretValue)) {
-    results.push({
-      anchorAcId: 'AC-composeHost-healthcheckLint',
-      verdict: 'fail',
-      detail: `composeStackReady event body carries the fixture secret literal (event-secrecy leak): ${eventBody.slice(0, 200)}`,
-    });
-  } else {
-    results.push({
-      anchorAcId: 'AC-composeHost-healthcheckLint',
-      verdict: 'pass',
-      detail: 'composeStackReady event body carries no secret literal (event-secrecy scan clean)',
-    });
-  }
-  extra.eventBodyByteLength = eventBody.length;
-  // Passing summary line when nothing failed.
-  if (!results.some((r) => r.verdict === 'fail')) {
-    results.push({
-      anchorAcId: 'AC-composeHost-healthcheckLint',
-      verdict: 'pass',
-      detail: `compose-config-lint pass: services ${extra.serviceNames.join(', ')}; healthcheck + restart + logging + event-secrecy scans all clean`,
-    });
-  }
   return { results, extra };
 }