475d381e0c
Independent critical review of the implementation plan (audit-context -> sharp-edges -> variant-analysis -> systematic-debugging, grounded against real M1-M6 code). 8 findings, all code-grounded, no ghosts: - P-1 (CRIT): content-floor "full port" was a SUBSET of BASH_HARD_BLACKLIST (lost #21 env-prefix / #22 --watch / #34 echo-inj / C16 2>file / cp-mv-chmod-chown-chgrp; cp X ~/.claude/runtime = escape-grant forge) -> single source matchBashHardBlacklist relocated to shell-content-rules (Task 1.0.5) + §12 content-floor invariant proves completeness. - P-2 (CRIT): canonicalAction has no PowerShell branch -> every PS command collapses to 'write:' -> one escape unlocks ALL PS commands; Task 1.5 test was spuriously green (both sides equally broken) -> Task 1.2b + specificity. - P-3 (HIGH): PS floor branch returned block:false skipping runtime/secret guard (command field not parsed) -> Set-Content ~/.claude/runtime forge -> psProtectedWrite guard (Task 1.4). - P-4 (MED): content-block whole-string only -> bashIsContentBlock whole+per -segment parity with bashIsFloor (Task 1.3). - P-5 (MED): suspicious blind to content-danger -> suspicious |= contentBlock. - P-6 (MED): §12 CI-invariants ownerless -> assigned per phase (phase rule). - P-7 (LOW): Phase 0 fail-CLOSE "subset" unlisted -> explicit hook list. - P-8 (LOW): plan = detailed Phase 1 + scoped skeleton -> honest framing. Plan: Tasks 1.0.5/1.1/1.2b/1.3/1.4/1.5/1.6 + phase-transition rule + self-review. Spec: §5 PowerShell row, §12 M5 line, §13 addendum. No code built. commit-not-push.