CONSTANTS
    D1 = d1
    S1 = s1
    S2 = s2
    R1 = r1
    R2 = r2
    R3 = r3
    ExactCmd = exactCmd
    PromptCmd = promptCmd
    ShellCmd = shellCmd
    EditedCmd = editedCmd
    Domains <- DomainsFixture
    Sessions <- SessionsFixture
    Requests <- RequestsFixture
    Commands <- CommandsFixture
    NoSession = NoSession
    NoRequest = NoRequest
    NoCommand = NoCommand
    NoApproval = NoApproval
    SessionDomain <- SessionDomainFixture
    SessionFingerprint <- SessionFingerprintFixture
    DomainFingerprint <- DomainFingerprintFixture
    ConfigSafe <- ConfigSafeFixture
    RequestSession <- RequestSessionFixture
    RequestCommand <- RequestCommandFixture
    CertificateValid <- CertificateValidFixture
    SignatureValid <- SignatureValidFixture
    AutoRuleMatches <- AutoRuleMatchesFixture
    CommandRequiresShell <- CommandRequiresShellFixture

SPECIFICATION Spec
\* Fully closed or failed application states intentionally have no successor.
CHECK_DEADLOCK FALSE

INVARIANTS
    TypeOK
    ConfigurationConfinement
    OrderedNetworkStartup
    PublishedDomainsReady
    RegisteredSessionsConnected
    AttachedSessionsValid
    AuthenticatedRequestsOnly
    HostExecutionAuthorized
    AutoApprovalNoShell
    TerminalIsolation
    NoOrphanHostProcess
    StateAnchorOwnership

PROPERTIES
    SessionEventuallyResolves
    RequestEventuallyResolves
    PromptEventuallyRestoresTerminal
    EmptyDomainEventuallyStops