{
  "version": 1,
  "note": "R-971 (operator decision D2 = A, 2026-10-17). The box's catalog allow-list, compiled into the controller. Each entry allows ONE exact setting for ONE service of ONE app; a changed setting is a different one and is refused. The catalog's scripts/privilege-allowlist.json is a byte-identical copy for its CI gate. Survey: felhom.eu documentation/audits/agent-allowlist-rotation-2026-10-17/P2/survey.md",
  "entries": [
    {
      "app": "homepage",
      "service": "homepage",
      "setting": "bind /var/run/docker.sock -> /var/run/docker.sock ro",
      "why": "the Docker widget and the docker service discovery list the household's containers and their state",
      "doc": "https://gethomepage.dev/configs/docker/"
    }
  ]
}