Module invariants 

Functions

refuse_to_open_db

Refuses to open a database that is not a verified Forge DB.

validate_cea_no_raw_source

Validates that a CEA node contains no raw source code. Checks recursively through all nested objects and arrays.

validate_forbidden_paths

Validates that patches do not touch forbidden paths.

validate_patch_caps

Validates patch caps (max files, max total lines, max lines per file).