trust-boundary 1 Crossing the Boundary: System Calls, Privilege, and the Trust Invariant Mar 26, 2026