Safety model
The boundaries the runtime enforces in code, whatever a model or a page says.
Overview#
- Typed actions only — no selector, coordinate or JavaScript ever comes from a model.
- Risk can only be raised by target context; a model cannot lower it.
- Secrets are a takeover floor, never typed or traced.
- Instruction-like page content is quarantined, not negotiated.
- A stale decision never executes: freshness, visibility and occlusion are re-checked before every interaction.
- Unknown-effect actions (submits, uploads) are never retried blindly.