trust-boundary git:20261014.402e270A

Immutable. This exact content never changes and is served at /api/v1/blob/c5cb2c217d05443b.

---
description: Where untrusted input becomes a domain type, and the rules that hold there
globs: packages/core/src/trust/**,packages/core/src/adapters/**,packages/core/src/markets/**,packages/cli/src/statusline.ts,packages/cli/src/marketCache.ts,packages/cli/src/scheduleSlice.ts,packages/cli/src/play.ts,packages/cli/src/ambient.ts
alwaysApply: false
---

# The trust boundary

Feed responses and local cache files are untrusted input. They enter through `packages/core/src/trust/` and leave as a domain type or as a stated reason they could not. Nothing else builds a `Match` or a `MarketSignal` from raw input.

The rules of this area are `AGENTS.md` "Conventions" (canonical). Their narration, and what this rule stated that no bullet does, are in `guides/conventions/trust-boundary.md`; the parts on composed windows, team identity and bounds are in `guides/conventions/off-bundle-reads.md`, `guides/conventions/stage-and-teams.md` and `guides/conventions/surfaces.md`.