Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Directory and file-volume scaffolding must fail closed on unexpected ownership, permissions, symlinks and mount structure.
- Only the narrow initialization role may adjust required service-owned filesystem permissions; it must not become an application runtime.
Verification still required
- Prove host user-namespace and bind-mount permission behavior with disposable Docker volumes before release.
- Coordinate service entrypoint and Compose initialization order without granting runtime services broad host privileges.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.