Pure decision for the capabilities.env.allow secret warning, split out of
warn_on_secret_shaped_env_grants on the same terms as
[unreachable_delegation_outcomes_warning], so a test can assert it without capturing stderr.
Every distinct policy.env_allow name the credential backstop drops, in first-declaration
order, each attributed through crate::credential_backstop_match against
policy.shell_strip_env. Empty when every declared name reaches the guest, including when
env_allow is empty. Judged from names alone.
Warns (non-fatal, once per declared grant) for every capabilities.shell.interpreter_runtime
entry. Declaring one narrows an allowlisted binary’s Landlock scope to specific host
directories so a path-based interpreter can reach its stdlib — but it couples the capsule to a
specific host distro/interpreter-version layout (e.g. /usr/lib/python3.11 stops resolving the
moment the host ships Python 3.12), which the operator should see plainly. The durable fix is
the still-unbuilt staged runtime bind-mount; this grant only bridges until then.
Warns (non-fatal, once) when a transport: http capsule’s inference.api_key can only be read
at launch: a literal in the manifest, or a ${NAME} that the global config’s credentials:
map does not hold and the environment supplies.
Warns (non-fatal, once per session) when this host’s unprivileged user namespaces are
unrestricted because kernel.apparmor_restrict_unprivileged_userns is off, rather than because
the shipped mur-sealed AppArmor profile is confining this binary.