Runtime selection

Before runtime-dependent work, read execution selection. In a verified T3 host follow the T3 contract and its method reference; the inline section below is the native Codex branch, not literal T3 dispatch. Outside T3, native Codex follows that inline branch unchanged. If the host is ambiguous or a required capability is unavailable, report the gap; a permission refusal never authorizes switching branches.

Native Codex branch

Boundary Discipline

Place validation, type narrowing, and error handling at system boundaries. Trust internal code unconditionally. Business logic lives in pure functions. The shell is thin and mechanical.

Why: Scattered validation is noisy, redundant, and gives a false sense of safety. Keep logic out of framework wiring so it can be tested without the framework.

The pattern:

• At boundaries (CLI args, config files, external APIs, network protocols): validate, return errors, handle defensively.
• Inside the system: typed data, error propagation, no re-validation. Trust the types.
• Across the boundary. Expose domain concepts, not the boundary's private representation. Keep general-purpose mechanism inside and special-purpose policy at the edge.

Applications: