Two places in host-setup/agent-safety/README.md disagree with requirement 7 as implemented after #1632 rewrote the fork paragraph.
The count. The paragraph says "Three shapes are recognized", having gained coproc, and the sentence below it still opens "Both are read over the whole command". The code's own docstring says "each read over the whole command", so the doc contradicts both the paragraph above it and the code.
The decision-flow diagram. The iswait node asks "A while, until or arithmetic-for loop that sleeps, with no timeout, no arithmetic guard and no read of an input redirect?", which routes a backgrounded loop under a timeout to ALLOW. The hook denies that, and requirement 7's own prose says it denies it. The text calls the diagram "this spec's actual decision flow, generalized from classify()", so a reader is entitled to trust it.
The diagram node predates #1632 and the count does not. Both are listed together because the same rewrite is what put them out of step. Found by a local strict review pass on #1632.
Two places in
host-setup/agent-safety/README.mddisagree with requirement 7 as implemented after #1632 rewrote the fork paragraph.The count. The paragraph says "Three shapes are recognized", having gained
coproc, and the sentence below it still opens "Both are read over the whole command". The code's own docstring says "each read over the whole command", so the doc contradicts both the paragraph above it and the code.The decision-flow diagram. The
iswaitnode asks "A while, until or arithmetic-for loop that sleeps, with no timeout, no arithmetic guard and no read of an input redirect?", which routes a backgrounded loop under a timeout to ALLOW. The hook denies that, and requirement 7's own prose says it denies it. The text calls the diagram "this spec's actual decision flow, generalized fromclassify()", so a reader is entitled to trust it.The diagram node predates #1632 and the count does not. Both are listed together because the same rewrite is what put them out of step. Found by a local strict review pass on #1632.