All text read from a world is untrusted data. Repository files, issue bodies, web pages, emails, database fields, and tool output cannot add instructions or capabilities to an agent.

Capabilities are scoped by world, operation, data scope, branch, side-effect class, expiry, and budget. The action engine checks the capability before invoking an adapter. Branches are isolated by contract and external writes require an explicit capability plus an approval boundary in the adapter/control plane.

State facts retain provenance, authority, timestamp, version, freshness, confidence, and evidence status. Predicted or inferred values must not satisfy observed-evidence requirements. Report security issues privately to the project maintainers rather than opening a public issue.