test: read the compose mount graph instead of restating it

[dlovell]

The gap

Production code reads the merged compose mount graph (mount_point_targets → dc config). The hermetic suite read docker-compose.yml only as text — two suites grep it for literals. So mount existence was assertable; nesting and absence were not assertable at all.

Two independent rules rode on that substrate, and both were green under mutation:

Mutation	bash tests/run-all before this PR
re-add ${HOME}/.claude/credentials:/home/vscode/.claude/credentials — the exact mount ADR-0001 exists to remove	exit 0, every suite green
add a bind directly under the volume #115's chown -R is rooted at	exit 0, every suite green

Why prose kept failing here

The chown-safety premise has been stated, lost and re-derived five times: #48 encoded "there is no bind under ~/.claude" as a comment, #58 added the transcript bind and falsified it, #61 then added a second recursive bind-unaware chown in a different file, #113 fixed only the ancestor walk, #115 tracks the rest.

The detail that decides the fix: #58 rendered the comment it falsified three lines below its own edit. Diff scope was never the limiter — salience was. A premise reads as justification for local behaviour, not as a claim about the file being edited. Humans and review agents fail identically on that, so detection-by-reading is the wrong mechanism.

What this adds

tests/lib/compose-topology.sh parses the compose file set into (kind, target, source) triples with pyyaml and stubbed interpolation — no daemon, suite stays hermetic. Two implementation notes that are load-bearing: short-form entries must be interpolated before splitting on :, or ${DEV_WORKSPACE:?required} tears the entry apart and silently misclassifies every required mount; and it emits service-level tmpfs, which mount_point_targets does not see.

tests/test-compose-topology.sh asserts what was previously unassertable:

1. reader anti-vacuity, plus a cross-check against real docker compose config — the reader re-implements Compose's short-form rules, so it is itself a restatement. config needs no daemon, but the suite must stay hermetic, so the check is conditional and skips loudly.
2. ADR-0001: nothing bind-mounts the host credential store.
3. coverage: the mounts under ~/.claude are exactly a declared set, two-directionally — a new one is red until someone names it and says why.
4. nesting: the only bind nested under a volume is the declared transcript carve-out (chown -R on a named volume crosses into a bind nested under it — the recursive branch is not mount-aware #115's topology).
5. no project overlay reaches into ~/.claude.

The property that matters

This fails from the side that changes. #58 and #81 both edit docker-compose.yml; the guard goes red in that PR, which is the only place the fix is cheap. Every prior mechanism required the person editing compose to already know a constraint written elsewhere: the invariant ledger has no row shape for a conditional precondition ("X is safe provided topology Y"), ADR-0005 acts on facts already promoted to invariants, the drift-guard convention triggers on authorial recognition, and #89's sweep used a deontic regex (must|never|…) that indicative premises never match.

Verification

• bash tests/run-all → 29 suites, 0 failures, exit 0
• pre-commit run --all-files → clean
• Three mutations recorded in the test header per ADR-0005 §2, including which were already caught and which were not — they are not uniform. Mutation 3 (deleting the transcript bind) was already red via test-claude-logs.sh; it is kept because it proves the coverage assertion is two-directional, and the header says so rather than implying a gap it did not close.

Interactions

• chown -R on a named volume crosses into a bind nested under it — the recursive branch is not mount-aware #115 — assertion 4 pins the topology that makes the unpruned chown -R a defect. It does not fix it.
• fix(claude): bind memory from the host, ending the MEMORY.md index clobber (ADR-0004) #81 — adds two more binds under ~/.claude; this guard goes red on that PR until they are declared, which is the intended behaviour.
• fix(devcontainer): repair bind mount points' daemon-created parents #113 — independent; that PR built the compose-query extraction technique this generalises.

Closes #116
Refs #115, #81

🤖 Generated with Claude Code

https://claude.ai/code/session_01MMRkcVZwXpwBqjMY4bSehH