v0.328.0 (unreleased): the security review's four findings — the entry is bound to its image and start; symlinks out of a root; the missed classes; roots only under the drive namespace or system data

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -32,6 +32,14 @@ still refuses and the app page still says so.
   `err.stacks.definition_refused` for a refused install / settings change / restore.
 - Red-proofs: felhom.eu `audits/agent-allowlist-rotation-2026-10-17/P2/redproof-allowlist.txt` (six mutations, each
   convicted by its test).
+- **Security review of `6d90374` (four findings, fixed before the release):** (1) an allow-list entry now holds only
+  for the image REPOSITORY it names (`image` field) and only while the service keeps the image's own entrypoint and
+  command — a push could otherwise keep homepage's socket and swap the image or the command under it; (2) on the box a
+  bind source inside a data root is judged where it really points (`Policy.Resolve` = `filepath.EvalSymlinks`): a
+  symlink out of the root is outside; (3) the classes the first version missed: `cgroup_parent`, `runtime`,
+  `isolation`, `gpus`, `deploy.resources.reservations.devices`, a `provider` service, `post_start` / `pre_stop` hooks;
+  (4) a data root must lie under `/mnt/felhom-drives/` or the system data path, not anywhere under `/mnt/`. Each
+  red-proved (`P2/redproof-security-review-fixes.txt`); the catalog gate mirrors all four.
 
 ## v0.327.1 — files.<domain> reaches FileBrowser again: a file route by name, not Docker labels (2026-10-17)