Function from_wire 

pub fn from_wire(
    origin_header: Option<&str>,
    trust_header: Option<&str>,
) -> TaskProvenance

Classify a task arriving over the peer door from the two request headers.

Only peer and completion are accepted from the wire. user, schedule, event and system are enqueued locally by the CLI or by the runtime and never legitimately arrive over HTTP, so a caller naming one — or naming anything unrecognised, or sending no origin header at all — is classified event / untrusted and its trust header is not read. No HTTP caller can talk itself into a trusted class it was not given by a murmur runtime.

Provenance is the caller’s claim, whether or not the door authenticates. A door declaring network.authentication decides who may call: an operator or declared credential, or — on a formation member’s door — another member, let in as the grant member:<caller> on the formation token the launcher issued it for this door. No credential binds a trust class, so any caller a door lets in that claims peer + trusted gets what a genuine trusted peer gets, and on a public door that is any caller at all. Formation calls narrow this: the runtime presents the token, so it drops whatever origin and trust its guest set and stamps stamp_for_peer of the sending task itself. The boundary closed here is untrust laundering across an honest chain.