Hacker News Reader

That’s my impression but the specification repository doesn’t seem to mention that at all, when it seems like it should be a requirement.

The article mentioned this:

Users stay in control — they explicitly confirm each step before any action is taken.