Re-review surfaced one new BLOCKER + two CONCERNs + four NITs. Folded:
N1 BLOCKER: `|%s*sh%f[%s]` missed `curl x | sh` (end-of-string canonical
wrapper-bypass — Lua's `%f[%s]` requires transition INTO whitespace,
which doesn't happen at EOL). Replaced with two patterns each for
sh and bash: `|%s*sh%s` (followed by whitespace/args) and
`|%s*sh%s*$` (end-of-string). Same for bash. Verified against 18
wrapper-bypass test cases — all canonical idioms now HALT.
N2 CONCERN: `ci=true` rule flag had no implementation note. Added one
sentence to §5 explaining the matcher lowercases the input string
when ci is set.
N3 CONCERN: §12 commit #5 description was stale — still said
"extends interactive CMD: extraction to consult is_destructive"
which contradicts the R-B3 resolution (Norris-only). Rewrote
commit #5 description to match R-B3, and bundled the
ffi/readline.lua `_bound[seq]:free()` removal into commit #5's
scope with explicit "Phase 1 amendment" callout. Same for the
§12 risk note that still referenced the dropped behavior change.
Other NITs (N4 skip threshold, N5 approved-turn mention, N6 :model
swap interaction, N7 commit-attribution wording) are cosmetic and
will fold in-flight during implement if material.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
marfrit
125f800513