{
  "suite": "Compose Clinic isolated model verification",
  "checked_at": "2026-09-12T13:36:01.023802+00:00",
  "compose_version": "5.3.0",
  "scope": "docker compose config only; no container execution, no Docker daemon calls",
  "case_count": 16,
  "cases": [
    {
      "id": "dot-env-is-not-container-env",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        ".env": "CC_IMAGE_TAG=1.37\nCC_ONLY=not-automatically-injected\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:${CC_IMAGE_TAG}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "image": "busybox:1.37",
        "environment": null
      },
      "observed": {
        "image": "busybox:1.37",
        "environment": null
      }
    },
    {
      "id": "explicit-map-passes-dot-env",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        ".env": "CC_IMAGE_TAG=1.37\nCC_ONLY=not-automatically-injected\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:${CC_IMAGE_TAG}\n    environment:\n      CC_ONLY: ${CC_ONLY:?CC_ONLY must be set}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "image": "busybox:1.37",
        "environment": {
          "CC_ONLY": "not-automatically-injected"
        }
      },
      "observed": {
        "image": "busybox:1.37",
        "environment": {
          "CC_ONLY": "not-automatically-injected"
        }
      }
    },
    {
      "id": "env-file-does-not-feed-model-interpolation",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        "app.env": "CC_IMAGE_TAG=9.9\nCC_APP_MODE=debug\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:${CC_IMAGE_TAG:-1.37}\n    env_file: app.env\n    environment:\n      CC_PASSED: ${CC_APP_MODE:-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "image": "busybox:1.37",
        "environment": {
          "CC_IMAGE_TAG": "9.9",
          "CC_APP_MODE": "debug",
          "CC_PASSED": "fallback"
        }
      },
      "observed": {
        "image": "busybox:1.37",
        "environment": {
          "CC_APP_MODE": "debug",
          "CC_IMAGE_TAG": "9.9",
          "CC_PASSED": "fallback"
        }
      }
    },
    {
      "id": "literal-environment-wins",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        "app.env": "CC_LEVEL=file\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: app.env\n    environment:\n      CC_LEVEL: literal\n"
      },
      "shell_fixture_values": {
        "CC_LEVEL": "shell"
      },
      "expected": {
        "environment": {
          "CC_LEVEL": "literal"
        }
      },
      "observed": {
        "environment": {
          "CC_LEVEL": "literal"
        }
      }
    },
    {
      "id": "interpolation-shell-wins",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof --env-file cli.env config --format json",
      "files": {
        ".env": "CC_LEVEL=dot-env\n",
        "cli.env": "CC_LEVEL=cli-file\n",
        "app.env": "CC_LEVEL=service-file\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: app.env\n    environment:\n      CC_LEVEL: ${CC_LEVEL:-fallback}\n"
      },
      "shell_fixture_values": {
        "CC_LEVEL": "shell"
      },
      "expected": {
        "environment": {
          "CC_LEVEL": "shell"
        }
      },
      "observed": {
        "environment": {
          "CC_LEVEL": "shell"
        }
      }
    },
    {
      "id": "interpolation-cli-file",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof --env-file cli.env config --format json",
      "files": {
        ".env": "CC_LEVEL=dot-env\n",
        "cli.env": "CC_LEVEL=cli-file\n",
        "app.env": "CC_LEVEL=service-file\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: app.env\n    environment:\n      CC_LEVEL: ${CC_LEVEL:-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "environment": {
          "CC_LEVEL": "cli-file"
        }
      },
      "observed": {
        "environment": {
          "CC_LEVEL": "cli-file"
        }
      }
    },
    {
      "id": "interpolation-default-dot-env",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        ".env": "CC_LEVEL=dot-env\n",
        "cli.env": "CC_LEVEL=cli-file\n",
        "app.env": "CC_LEVEL=service-file\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: app.env\n    environment:\n      CC_LEVEL: ${CC_LEVEL:-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "environment": {
          "CC_LEVEL": "dot-env"
        }
      },
      "observed": {
        "environment": {
          "CC_LEVEL": "dot-env"
        }
      }
    },
    {
      "id": "default-dot-env-project-path",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof -f project/compose.yaml config --format json",
      "files": {
        ".env": "CC_WHICH=caller\n",
        "cli.env": "CC_WHICH=explicit-caller-file\n",
        "project/.env": "CC_WHICH=project\n",
        "project/config/service.env": "CC_SERVICE_PATH=relative-to-compose-file\n",
        "project/compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: config/service.env\n    environment:\n      CC_WHICH: ${CC_WHICH:-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "environment": {
          "CC_WHICH": "project",
          "CC_SERVICE_PATH": "relative-to-compose-file"
        }
      },
      "observed": {
        "environment": {
          "CC_SERVICE_PATH": "relative-to-compose-file",
          "CC_WHICH": "project"
        }
      }
    },
    {
      "id": "explicit-env-file-caller-path",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof --env-file cli.env -f project/compose.yaml config --format json",
      "files": {
        ".env": "CC_WHICH=caller\n",
        "cli.env": "CC_WHICH=explicit-caller-file\n",
        "project/.env": "CC_WHICH=project\n",
        "project/config/service.env": "CC_SERVICE_PATH=relative-to-compose-file\n",
        "project/compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: config/service.env\n    environment:\n      CC_WHICH: ${CC_WHICH:-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "environment": {
          "CC_WHICH": "explicit-caller-file",
          "CC_SERVICE_PATH": "relative-to-compose-file"
        }
      },
      "observed": {
        "environment": {
          "CC_SERVICE_PATH": "relative-to-compose-file",
          "CC_WHICH": "explicit-caller-file"
        }
      }
    },
    {
      "id": "wrong-cli-env-path-fails",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof --env-file config/service.env -f project/compose.yaml config --format json",
      "files": {
        ".env": "CC_WHICH=caller\n",
        "cli.env": "CC_WHICH=explicit-caller-file\n",
        "project/.env": "CC_WHICH=project\n",
        "project/config/service.env": "CC_SERVICE_PATH=relative-to-compose-file\n",
        "project/compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    env_file: config/service.env\n    environment:\n      CC_WHICH: ${CC_WHICH:-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "exit_nonzero": true,
        "contains": "couldn't find env file"
      },
      "observed": {
        "exit_nonzero": true,
        "contains": "couldn't find env file"
      }
    },
    {
      "id": "empty-and-unset-defaults",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        ".env": "CC_EMPTY=\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    environment:\n      CC_A: ${CC_EMPTY:-fallback}\n      CC_B: ${CC_EMPTY-fallback}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "environment": {
          "CC_A": "fallback",
          "CC_B": ""
        }
      },
      "observed": {
        "environment": {
          "CC_A": "fallback",
          "CC_B": ""
        }
      }
    },
    {
      "id": "required-empty-fails",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        ".env": "CC_EMPTY=\n",
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    environment:\n      CC_VALUE: ${CC_EMPTY:?CC_EMPTY must be set}\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "exit_nonzero": true,
        "contains": "CC_EMPTY must be set"
      },
      "observed": {
        "exit_nonzero": true,
        "contains": "CC_EMPTY must be set"
      }
    },
    {
      "id": "port-loopback-v4",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    ports:\n      - \"127.0.0.1:8080:80/tcp\"\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "127.0.0.1",
            "target": 80,
            "published": "8080",
            "protocol": "tcp"
          }
        ]
      },
      "observed": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "127.0.0.1",
            "target": 80,
            "published": "8080",
            "protocol": "tcp"
          }
        ]
      }
    },
    {
      "id": "port-loopback-v6",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    ports:\n      - \"[::1]:8443:443/tcp\"\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "::1",
            "target": 443,
            "published": "8443",
            "protocol": "tcp"
          }
        ]
      },
      "observed": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "::1",
            "target": 443,
            "published": "8443",
            "protocol": "tcp"
          }
        ]
      }
    },
    {
      "id": "port-all-v4-udp",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    ports:\n      - \"0.0.0.0:5353:53/udp\"\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "0.0.0.0",
            "target": 53,
            "published": "5353",
            "protocol": "udp"
          }
        ]
      },
      "observed": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "0.0.0.0",
            "target": 53,
            "published": "5353",
            "protocol": "udp"
          }
        ]
      }
    },
    {
      "id": "port-all-v6",
      "status": "passed",
      "command": "docker compose -p composeclinic-proof config --format json",
      "files": {
        "compose.yaml": "services:\n  probe:\n    image: busybox:1.37\n    ports:\n      - \"[::]:8080:80/tcp\"\n"
      },
      "shell_fixture_values": {},
      "expected": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "::",
            "target": 80,
            "published": "8080",
            "protocol": "tcp"
          }
        ]
      },
      "observed": {
        "ports": [
          {
            "mode": "ingress",
            "host_ip": "::",
            "target": 80,
            "published": "8080",
            "protocol": "tcp"
          }
        ]
      }
    }
  ]
}