Smart-Kickoff Config Trust Boundary is the rule in 📝Smart-Kickoff that per-repository configuration may contribute only data — never the commands that launch an agent or run the classifier — so that a repository's own config file cannot redirect which agent executes or what it executes with.
The boundary exists because per-repository configuration is convenient precisely when it is sourced like code. A file at the repository root holding the base branch, the test command, the routing description, and the identifiers of the documents a session orients on lets a new repository join the system without editing any shared script. But a file that is sourced can set anything, and a repository is a place other people's commits land. If that file could set the agent command, a pull request could change which binary every future session in that repository launches, with every permission that binary carries. The line is drawn at execution: values that name a command to run are global — set once in the operator's own shell profile — and a repository file that tries to set them is warned about and ignored.
The mechanism is a snapshot and restore around the load. Before the repository's file is sourced, the global executable values are copied; after it is sourced, the copies are compared against the live values, and any difference is reverted with a warning naming the file that tried. Ownership follows the same logic in the other direction: the repository file is created if absent and never overwritten afterward, because it holds that repository's own values and belongs to whoever maintains it. The 📝Smart-Kickoff — Agent Buildbook asks an adopting agent to find this line in its own stack — whatever holds per-project settings, and whatever names the thing that runs.
local -a _saved_agent=("${AGENT_CMD[@]}") _saved_classify=("${CLASSIFY_CMD[@]}")
source "$config"
if [ "${(j:\0:)AGENT_CMD}" != "${(j:\0:)_saved_agent}" ] \
|| [ "${(j:\0:)CLASSIFY_CMD}" != "${(j:\0:)_saved_classify}" ]; then
echo "⚠️ $config tried to set AGENT_CMD/CLASSIFY_CMD — ignored (global-only)." >&2
AGENT_CMD=("${_saved_agent[@]}"); CLASSIFY_CMD=("${_saved_classify[@]}")
fi