scripts/tests/test-compose-nvlink-escape.sh asserts no shipped compose
carries an un-escaped runtime token in a `bash -c` entrypoint —
${_NVLINK_ENABLED}, a bash ${VAR[@]} array, or $@ / ${VLLM_ENFORCE_EAGER:+}
in a detect_nvlink entrypoint. Compose v5.1+ interpolates entrypoint string
values at parse time, so an un-escaped ${_NVLINK_ENABLED:-0} is baked to its
default before the container runs → the NVLink branch dies (always PCIe).
This was live on 9 composes until #436 (lmcache via #429/#433); the guard
prevents it regressing.
Scans 54 composes (13 detect_nvlink entrypoints); negative-tested to fire on
the un-escaped form. Full guard suite 55/55.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
