[acamarata]

Four low-severity debt rows fixed, one blocked.

D-0587: cache password off argv (fixed)

buildRedisService now hands the password to redis-server/valkey-server as a requirepass config line on stdin (-, heredoc, value escaped for the config parser). It is no longer a process argument and is never written to disk; exec keeps the server as PID 1. New secret_argv_expanded_test.go runs the generated command with a stub server and asserts the server's real argv carries no part of the password and stdin carries the escaped line (password with quotes, backslash, spaces, $, backtick). A control test shows the old command leaks. Checked by hand against a real redis-server 8: auth works, no-auth gets NOAUTH. Existing assertions on the old string updated.

D-1171: entitlement no-write test (fixed)

The assertion read a t.TempDir() that Check never saw. The test now points cwd, HOME and TMPDIR at one fresh dir and asserts it stays empty; a control test shows a write is caught. Verified by temporarily making Check write a file: the E110 test failed with Check wrote [stray].

D-0864: error-json=<code> tag (fixed)

json-conversion-check.sh gains error-json=E###: head binary in v1.5 --json must exit non-zero, print exactly one error envelope that validates against envelope.v1.schema.json, and carry the named code. lifecycle.txt start/stop/restart now use it (E004, E400, E400). Ran the script on the lifecycle fragment (5 rows pass) and on a negative file (wrong code, zero exit, bad tag all fail). README documents the tag. The Go tests in json_lifecycle_test.go are not pure duplicates (stub docker, stdout-empty-on-failure, success documents), so none were dropped.

D-0130: one container-name helper (fixed)

config.Config.ServiceContainerName already existed but the builders formatted %s_<svc> themselves. All 14 compose sites now use it (postgres, hasura, auth, nginx, minio, mailpit, meilisearch, meilisearch_init, typesense, admin, functions, redis, seaweedfs, seaweedfs_init, custom services), plus the same literal in build orchestrator, admin cmd_root, start/functions commands and exporter dump. New container_name_guard_test.go fails on any hand-rolled ContainerName in internal/compose (it caught the two seaweedfs sites).

D-0264: image tags (not changed, blocked)

Still true on main (six version: latest entries and python 3.12-slim). Needs the owner to pick concrete versions for admin, functions, mailpit, minio, otel-collector, tempo and python and a registry re-resolve of images.lock.json. The row defers that to the cli#617 decision; #617 is closed as superseded by #919 with no decision recorded.

Checks run

• go build ./..., go vet ./internal/... ./cmd/...: clean
• go test ./cmd/commands ./internal/exporter ./internal/templates/... ./internal/compose ./internal/build ./internal/builtin/... ./internal/config ./internal/health: all ok
• bash scripts/ci/json-conversion-check.sh lifecycle (head and base both the built binary): PASS 5 rows