diff --git a/crates/rutster-trunk/src/provider/mod.rs b/crates/rutster-trunk/src/provider/mod.rs
index 4c176a1..4e41f28 100644
--- a/crates/rutster-trunk/src/provider/mod.rs
+++ b/crates/rutster-trunk/src/provider/mod.rs
@@ -218,4 +218,23 @@ mod tests {
         let none: Option<SpendToken> = None;
         assert!(none.is_none());
     }
+
+    /// ADR-0009 static assertion (spec §7 done-criteria #10): `TwilioCredentials`
+    /// lives ONLY in the `rutster-trunk` crate. This test pins the type's
+    /// locality — it compiles only because `crate::provider::TwilioCredentials`
+    /// resolves (the type's canonical home). Sibling crates (`rutster-media`,
+    /// `rutster-tap`) do NOT depend on `rutster-trunk`, so they cannot re-export
+    /// the type — the invariant is structural (the Cargo dep graph). If someone
+    /// later adds a `pub use` re-export through the workspace root or a sibling,
+    /// this test's doc + the dep-graph change would both need revisiting
+    /// (a reviewable Cargo.toml edit). The binary's `config::twilio_credentials`
+    /// is the single expected import path (`rutster_trunk::provider::TwilioCredentials`).
+    #[test]
+    fn twilio_credentials_is_trunk_local_adr0009() {
+        // Compile-time path resolution: if TwilioCredentials moved out of this
+        // crate, this line fails to compile (the test breaks the build).
+        fn _accepts_trunk_local_credentials(_: crate::provider::TwilioCredentials) {}
+        // Touch the fn so it's not dead-code-eliminated before the type check.
+        let _ = _accepts_trunk_local_credentials;
+    }
 }