Is this spec's executed code trusted? Inline settings/files you authored
are trusted; any external plugin / pluginDir brings in third-party hooks
and is NOT — committing it to your repo is the same trust decision as a
dependency, so the trust boundary follows provenance: foreign = confined.
Is this spec's executed code trusted? Inline
settings/filesyou authored are trusted; any externalplugin/pluginDirbrings in third-party hooks and is NOT — committing it to your repo is the same trust decision as a dependency, so the trust boundary follows provenance: foreign = confined.