# Trust and safety boundaries

No database, filesystem, shell or network operations occur in the production API.
Schema labels must use ASCII identifiers; advisory SQL quotes all identifiers
and validates its prefix. Values never become executable SQL. SQL statements are
not an enforcement or migration plan and must be reviewed for the chosen dialect.

Use finite Limits and handle Budget distinctly from a negative theory answer.
Enumeration is exponential; raising limits on adversarial inputs can be expensive.
The conceptual work meter is not a real-time sandbox. String cells are limited to
4,096 code units; total input text and shapes have separate ceilings. JSON is
preflight-limited in length and nesting before the standard parser. The underlying
parser accepts repeated object keys with last-key semantics; do not sign JSON or
use it as a security canonicalization format. CSV export preserves literal strings
including spreadsheet formula prefixes; do not open untrusted exports as executable
spreadsheet formulas without independent sanitization.

Result structs, arrays and reports are caller-editable. `verify_chase_trace`
deterministically recomputes provenance; `validate_chase_witness` is a structural
consistency check only. `verify_lossy_counterexample` checks the actual instance
and projected presence rather than trusting the attached chase metadata.
An observed FD audit is about one finite instance, not a universal dependency.
Tables implement set semantics without SQL NULL, collation or bag multiplicities.

The public project contains synthetic fixtures only and needs no credentials.