pub fn spawn_process(
spec: SpawnSpec,
) -> Result<Box<dyn ProcessHandle>, ProcessError>Expand description
Spawn a process via the currently installed spawner.
This is the single chokepoint every hostlib process tool funnels through
(run_command, run_test, run_build_command, manage_packages, and the
long-running background path). The UNIVERSAL catastrophic-command floor is
enforced HERE, UNCONDITIONALLY — no command_policy on the stack is
required — so a machine/disk/data-destroying command (rm -rf /, fork bomb,
mkfs, dd of=<device>, chmod -R 000, truncate -s 0 of a source file,
redirect-over-source, project-root delete) is rejected before the child is
ever created, on standalone Harn and under every embedder alike. The
recoverable git workflow family (git reset --hard, git clean -fd,
force-push) is deliberately NOT enforced here: it stays policy-gated so
Harn’s own stdlib git.push --force-with-lease flow keeps working. The
spec’s raw program/args are classified BEFORE any sandbox wrapper is
applied, so a sandbox-exec/bwrap prefix can’t bury the real command.