{
  "repo": "core",
  "version": "7.17.3",
  "from": "d6ef7ed0985d53ad982b51998a5bd05ae807e719",
  "to": "a135321a2f648ada1a2bd82f930f924831d5cc4a",
  "added": [],
  "removed": [],
  "changed": [],
  "narrowed": [
    {
      "id": "F1",
      "source": "behaviorFlips.summary",
      "text": "Narrowing — the read boundary judges EVERY shell segment (#758; test [7138]; B-105 P0): a segment whose program is NOT on the read-only allowlist is judged whole and verb-blind at all three sites — the boundary walk, the standalone containment gate and the refused-command whitelist — so an unlisted program's reads are subject to containment and the sensitive-path deny table exactly as a listed reader's are. The launcher special case is folded into this one rule (named special cases −2; name-table branches 6 → 3)."
    }
  ],
  "closedSetMembers": [],
  "typeKeys": [],
  "declarationMoves": [],
  "mintMoves": [],
  "criteriaObserves": [
    {
      "kind": "typeMember",
      "name": "AskRequest.ruleOffersAbsence",
      "assertions": [
        "G1.a",
        "G2.a",
        "G3.a",
        "G4.a",
        "G5.a",
        "G6.a",
        "G7.a",
        "G8.a"
      ]
    }
  ],
  "consumersHint": {
    "cli": [],
    "server": [],
    "sdk": [],
    "note": "scanned cli@e10eef84 server@feed42cd sdk@f6ae86f — a name listed is MENTIONED there today, which is evidence of consumption, not proof of it"
  },
  "breakingCount": 0,
  "breakingItems": []
}