fix: Whisper liest /work/in nur, Restrisiko des Abschreib-Pods dokumentiert

Der Decoder-Container mountet /work/in schreibgeschützt und nur
/work/out beschreibbar (Policy-Test); ingest ignoriert Ergebnisse zu
Aufnahmen außerhalb des Manifests (Test). ARCHITECTURE Annahme 106
beschreibt das getragene Restrisiko (DNS im Pod-Netz, Sicht auf den
eigenen Lauf) und stärkere Optionen für später.

Refs #27

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

deploy/k8s/components/voice/cronjob-voice-transcribe.yaml

@@ -119,9 +119,16 @@ spec:
                 seccompProfile:
                   type: RuntimeDefault
               volumeMounts:
-                # Der ganze Mount, Schreibrecht fuer /work/out.
+                # Eingabe nur lesbar (Manifest und Ton kann der Decoder nicht
+                # veraendern), Ausgabe schreibbar. fetch legt in/ und out/ an
+                # (clearWorkDir, Modus 0700, uid 1000), bevor dieser Container startet.
                 - name: work
-                  mountPath: /work
+                  mountPath: /work/in
+                  subPath: in
+                  readOnly: true
+                - name: work
+                  mountPath: /work/out
+                  subPath: out
                 - name: whisper-tmp
                   mountPath: /tmp
               resources:

deploy/k8s/tests/manifest-policy.test.mjs

@@ -581,7 +581,7 @@ test('whisper container has no env from secrets, no secretKeyRef and no service
   }
   assert.deepEqual(
     (whisper.volumeMounts ?? []).map((m) => m.mountPath).sort(),
-    ['/tmp', '/work'],
+    ['/tmp', '/work/in', '/work/out'],
     'whisper mounts more than the work volume and /tmp',
   );
   assert.equal(whisper.securityContext.runAsNonRoot, true);
@@ -629,11 +629,18 @@ test('work volume is a memory emptyDir of at most 32Mi, mounted in all three con
   assert.ok(work?.emptyDir, 'work volume missing or not an emptyDir');
   assert.equal(work.emptyDir.medium, 'Memory', 'work volume is not memory-backed');
   assert.equal(work.emptyDir.sizeLimit, '32Mi');
-  for (const name of ['fetch', 'whisper', 'ingest']) {
+  for (const name of ['fetch', 'ingest']) {
     const mount = (voiceContainer(pod, name).volumeMounts ?? []).find((m) => m.name === 'work');
     assert.equal(mount?.mountPath, '/work', `${name} does not mount work on /work`);
     assert.ok(!mount.readOnly, `${name} mounts work read-only`);
   }
+  // whisper: /work/in read-only, /work/out writable, nothing else of the work volume.
+  const whisperWork = (voiceContainer(pod, 'whisper').volumeMounts ?? []).filter((m) => m.name === 'work');
+  assert.deepEqual(
+    whisperWork.map((m) => [m.mountPath, m.subPath, m.readOnly ?? false]).sort(),
+    [['/work/in', 'in', true], ['/work/out', 'out', false]].sort(),
+    'whisper must see /work/in read-only and /work/out writable only',
+  );
   // fetch, whisper and ingest share the files (0700/0600): one uid, one fsGroup.
   assert.equal(pod.spec.securityContext.runAsUser, 1000);
   assert.equal(pod.spec.securityContext.fsGroup, 1000);