Security
Private repository access is workspace-scoped. Execution uses isolated, disposable environments, and physical-effect claims require independent evidence.
Workspace-scoped access · isolated execution · independent observation
Every conclusion remains bound to the repository revision, action, execution path, and available Evidence.