Whether stage_session can already tell the capsule may start a native subprocess: a
shell.allow, a spawn.allow or an install.tool grant, whose pattern can match a native
tool a pull installs. mur doctor asks the same question before its checklist.
Pure decision for the capabilities.env.allow secret warning, split out of
warn_on_secret_shaped_env_grants on the same terms as
[crate::sandbox::aggregate_bounding_warning], so a test can assert it without capturing
stderr.
Every distinct policy.env_allow name the credential backstop drops, in first-declaration
order, each attributed through crate::credential_backstop_match against
policy.shell_strip_env. Empty when every declared name reaches the guest, including when
env_allow is empty. Judged from names alone.
The manifest text that declares a manage.pull() pin in a role only an operator-declared pin
may carry — runtime: hook, runtime: driver, a gateway: block, or
inference.system_prompt_artifact naming a skill — or None when the entry asks only for
what a pull can produce: a tool or a skill with no gateway, reached as a callable entry.
Warns (non-fatal, once per matching entry) when a capabilities.network.allow entry names the
host of an artifact’s gateway.endpoint: a capsule-wide entry against every artifact’s gateway,
an entry on an artifact’s own capabilities: against that artifact’s.
Warns (non-fatal, once per declared grant) for every capabilities.shell.interpreter_runtime
entry. Declaring one narrows an allowlisted binary’s Landlock scope to specific host
directories so a path-based interpreter can reach its stdlib — but it couples the capsule to a
specific host distro/interpreter-version layout (e.g. /usr/lib/python3.11 stops resolving the
moment the host ships Python 3.12), which the operator should see plainly. The durable fix is
the still-unbuilt staged runtime bind-mount; this grant only bridges until then.
Warns (non-fatal, once per gateway credential) when an artifact’s gateway.api_key can only be
read at launch: a literal in the manifest, or a ${NAME} that the global config’s
credentials: map does not hold and the environment supplies.
Warns (non-fatal, once per gateway) when an artifact reaches its upstream through a credential
gateway that is not a driver choice’s — the configured transport: http driver’s or an
inference.alternates driver’s — and so is not metered.
Warns (non-fatal) when this host’s unprivileged user namespaces are
unrestricted because kernel.apparmor_restrict_unprivileged_userns is off, rather than because
the shipped mur-sealed AppArmor profile is confining this binary.