Restricted \write18 allowlist portability across TeX distributions

Portable restricted shell-escape allowlist

A document that runs an external converter through \code{\write18} works on a local workstation but fails in production CI. The goal is to keep the same source compiling under both environments without weakening production security.

pdfTeX, XeTeX, and LuaTeX read \code{shell_escape} from texmf.cnf: \code{f} disables \code{\write18}, \code{p} restricts it to \code{shell_escape_commands}, and \code{t} permits all commands. The restricted allowlist is distribution- and release-specific, so a command allowed locally may not appear on the production server even with the same engine.

Because the failure is engine-level configuration rather than TeX syntax, package updates do not resolve it, and the log may only show a generic disabled-shell-escape message.

• Which settings define the restricted \code{\write18} allowlist under \code{shell_escape=p}?
• Is that allowlist portable across TeX Live and MiKTeX releases?
• What configuration preserves local external-command use while keeping production at \code{f} or \code{p}?