v0.328.0 (unreleased): security review round 2 — nearest-ancestor symlink resolve (fail closed), any extends refused, the entry binds a literal image and its exact healthcheck, no variable in a bind's options

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -40,6 +40,14 @@ still refuses and the app page still says so.
   `isolation`, `gpus`, `deploy.resources.reservations.devices`, a `provider` service, `post_start` / `pre_stop` hooks;
   (4) a data root must lie under `/mnt/felhom-drives/` or the system data path, not anywhere under `/mnt/`. Each
   red-proved (`P2/redproof-security-review-fixes.txt`); the catalog gate mirrors all four.
+- **Security review round 2 (of the fix commit `24d937d`):** a path that does not exist yet is judged through its
+  nearest EXISTING ancestor (a symlink higher up cannot carry a not-yet-created directory out of the root), and a
+  resolve error other than "does not exist" refuses; ANY `extends` is refused (a second service extending an allowed
+  one inherits its socket); an allow-list entry also binds a literal image (no `${VAR}`) and the exact
+  `healthcheck.test` it names (the test runs a command inside the privileged container); a `${VAR}` in a bind's
+  options (or a non-root one in its target) is refused. The catalog reader refuses YAML anchors, aliases and merge keys
+  (the box's YAML library expands them, the reader would judge a different document). Red-proved
+  (`P2/redproof-security-review-round2.txt`).
 
 ## v0.327.1 — files.<domain> reaches FileBrowser again: a file route by name, not Docker labels (2026-10-17)