Function is_plan_safe_build_command 

pub fn is_plan_safe_build_command(command: &str) -> bool

True when command is a build/test invocation plan mode auto-allows even though it spawns processes: every segment is either read-only or a known build tool running a known build/test subcommand. Grounding a plan in a real compile or test run makes plans materially better, and these commands only write build caches (target/, test artifacts) — not the sources the plan is about.

Deliberately anchored, like Allow policy overrides:

• any command/process substitution refuses (cargo test $(curl evil));
• wrappers refuse (sudo cargo test — the wrapper, not cargo, is the head);
• a file-writing redirect refuses via classify_segment (cargo test > src/lib.rs); safe-device redirects (2>/dev/null) stay allowed;
• the worst-segment rule holds: cargo test && rm -rf . refuses because the second segment classifies as a mutation.

The subcommand tables are curatable the same way READ_ONLY_BINARIES is — additions need the audit tests below.