A Threat Model for Automation-Friendly Dotfiles
Four boundaries that keep routine automation — human or AI — from becoming system compromise: an isolated blast radius, controlled privilege escalation, a zero-secret baseline, and human-gated mutation.