fix(migration): fail-closed legacy runtime project identity migration for imported stacks

[mstrhakr]

Summary

Imported stacks from original Compose Manager can have runtime project identity different from folder-derived identity.
This change makes migration verified and fail-closed, not best-effort.

Problem

Plus uses folder-derived identity for compose -p.
Legacy plugin used name-file identity for compose -p.
Mismatch risk:

• existing containers not matched in UI
• actions scoped to wrong project
• parallel project identities
• unexpected resource naming and storage behavior

What Changed

1. Added centralized ProjectIdentity resolver.
2. Resolver computes two candidates:

• folder candidate
• legacy name-file candidate

3. Resolver probes Docker ownership via com.docker.compose.project on:

• containers
• volumes
• networks

4. Resolver decision:

• exactly one candidate owns resources: preserve that candidate
• neither owns resources: use canonical folder candidate
• both own resources: unresolved, fail closed
• probe unavailable: unresolved, fail closed

5. Persisted effective identity in project_name metadata.
6. StackInfo now uses persisted effective identity for compose -p.
7. Added explicit owner-choice flow to resolve ambiguous stacks.
8. Added read-only identity preview endpoint for migration visibility.

Fail-Closed Enforcement

Mutating paths now block when identity unresolved:

• single-stack actions
• multi-stack actions
• compose args builder path used by event flows
• manual auto-update
• scheduled auto-update

Read-only logs path remains allowed.

UI

• stack list warning indicator for unresolved identity
• action attempt opens identity chooser
• owner can pin identity explicitly, then actions resume

Tests

Added regression coverage for:

• legacy name different from folder
• running ownership
• stopped ownership
• volume-only ownership
• both candidates present
• neither candidate present
• Docker probe failure
• pinned identity reuse
• explicit owner choice
• mutation blocked while logs allowed
• new stack behavior remains canonical

Bootstrap now sets deterministic probe default so tests never depend on host Docker state.

Outcome

Upgrade path safer for legacy users:

• preserve proven runtime identity
• no silent project rename
• no blind compose mutation when ownership unclear
• explicit owner decision required on ambiguity

[Copilot]

🟡 Changes recommended

The current fail-closed enforcement blocks composeLogs (contradicting the “logs allowed” contract) and the identity error response shape is inconsistent across single vs multi-stack callers, causing confusing/incorrect frontend behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR implements a fail-closed migration for stacks imported from the legacy Compose plugin where the runtime docker compose -p identity may differ from the folder-derived identity. It introduces a resolver that uses Docker resource ownership evidence to pick (and persist) the effective project identity, blocks mutating actions when identity is ambiguous/unverifiable, and adds UI flows and tests to support explicit owner selection.

Changes:

• Added ProjectIdentity resolver with Docker-label probing, pinned project_name metadata, and explicit owner-choice support.
• Updated backend action paths (single stack, multi stack, auto-update) to fail closed when identity is unresolved.
• Added UI warning/chooser flow and regression tests covering ownership, ambiguity, probe failure, and pinning behavior.

File summaries

File	Description
tests/unit/ProjectIdentityTest.php	Adds regression coverage for identity resolution, pinning, ambiguity, and fail-closed behavior.
tests/bootstrap.php	Sets a deterministic default probe for tests to avoid host Docker dependencies.
source/compose.manager/javascript/composeManagerMain.js	Adds identity chooser UI and handles identity-block error responses from backend actions.
source/compose.manager/include/Util.php	Integrates identity resolution into StackInfo construction and pins identity for new stacks.
source/compose.manager/include/ProjectIdentity.php	Introduces centralized identity resolution, Docker probing, pinning, and messaging.
source/compose.manager/include/Helpers.php	Enforces fail-closed behavior for compose command generation (single + multi-stack).
source/compose.manager/include/Exec.php	Adds identity preview and identity pinning endpoints.
source/compose.manager/include/ComposeList.php	Adds identity-block warning indicator and data attributes for UI chooser.
source/compose.manager/include/ComposeCommandBuilder.php	Blocks mutating compose arg generation when identity is unresolved (logs allowed).
source/compose.manager/include/AutoUpdateRunner.php	Skips scheduled auto-updates when identity is unresolved.
source/compose.manager/include/AutoUpdate.php	Blocks manual auto-updates when identity is unresolved (returns 409 + message).

Review details

Suppressed comments (1)

source/compose.manager/include/Helpers.php:388

• echoComposeCommandMultiple() returns {error: 'identity', stacks: [...]} when all stacks are blocked. Several multi-stack callers (e.g. Start All / Stop All) only treat responses as either {background:true} or a ttyd URL string, so this JSON payload will be shown as raw text (and action-in-progress spinners may never be cleared). Consider either (a) returning a ttyd script/URL that prints the blocked-stack message, or (b) using a distinct error shape/code and updating the corresponding JS callers to handle it and clear UI state.

        if (!empty($blockedStacks)) {
            echo json_encode([
                'error' => 'identity',
                'stacks' => $blockedStacks,
                'message' => 'Compose project identity is unresolved for: ' . implode(', ', $blockedStacks),

• Files reviewed: 11/11 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.