Function from_wire 

pub fn from_wire(
    origin_header: Option<&str>,
    trust_header: Option<&str>,
) -> TaskProvenance

Classify a task arriving over the peer door from the two request headers.

Only peer and completion are accepted from the wire. user, schedule, event and system are enqueued locally by the CLI or by the runtime and never legitimately arrive over HTTP, so a caller naming one — or naming anything unrecognised, or sending no origin header at all — is classified event / untrusted and its trust header is not read. No HTTP caller can talk itself into a trusted class it was not given by a murmur runtime.

This does not authenticate the door: a caller that claims peer + trusted gets what a genuine trusted peer gets, and nothing on the A2A path tells the two apart. The boundary closed here is untrust laundering across an honest chain.