Security Model

Draft. This page has not been written yet because the feature it documents does not exist yet. Nothing here should be read as working instructions.

Planned scope

Trust boundaries: untrusted patches, untrusted model output, operator approval.

Want to help shape it? See Contributing.