Function from_wire 

pub fn from_wire(
    origin_header: Option<&str>,
    trust_header: Option<&str>,
) -> TaskProvenance

Classify a task arriving over the peer door from the two request headers.

Only peer and completion are accepted from the wire. user, schedule, event and system are enqueued locally by the CLI or by the runtime and never legitimately arrive over HTTP, so a caller naming one — or naming anything unrecognised, or sending no origin header at all — is classified event / untrusted and its trust header is not read. No HTTP caller can talk itself into a trusted class it was not given by a murmur runtime.

Provenance is the caller’s claim, whether or not the door authenticates. A door declaring network.authentication decides who may call; it does not bind a class to a credential, so any caller it lets in that claims peer + trusted gets what a genuine trusted peer gets, and on a public door that is any caller at all. The boundary closed here is untrust laundering across an honest chain.