No causal path from untrusted computation to a relevant external consequence may succeed unless it crosses an explicit governed effect boundary for the exact effect under current authority.
NO_DIRECT_EFFECT_PATH remains the compatibility identifier used by existing implementation, tests and receipts.
Internal computation remains free while it stays inside its trust domain. The inventory includes direct APIs and actuators, human and agent relays, shared state, messages, files and artifacts, credentials and tokens, resource consumption, side channels, callbacks and plugins, telemetry-triggered effects, fallback routes and downstream feedback, ranking or training influence. Unknown or unclassified crossings fail closed.
The architectural invariant is absolute. A deployment proof is bounded to declared, inventoried reachability and evidence that each reachable path maps to an enforced boundary; it does not automatically prove every deployment safe. Rollback or compensation is optional recovery capability.
Formal verification · Zero Trust comparison · Governed Effect Path