Parent: #250. Security orthogonal pass.
Review the new presentation/projection path as an untrusted-data consumer even though it is read-only.
Required: collision-safe identities; no raw argv/env/secret-bearing metadata promotion; bounded label/path/port/network strings; safe text rendering/no HTML injection; no raw value → CSS class/style/token channel; bounded object/edge/attachment counts and layout work; pathological graph input cannot cause quadratic/unbounded browser work beyond frozen caps; authenticated APIs unchanged; screenshots/fixtures contain no live secrets; URLs follow existing safe routing/redaction policy.
Any third-party renderer/layout dependency must pass production dependency/audit and must not add runtime network egress, telemetry, remote fonts/assets, workers, WASM, or unsafe HTML requirements without explicit architecture approval.
Parent: #250. Security orthogonal pass.
Review the new presentation/projection path as an untrusted-data consumer even though it is read-only.
Required: collision-safe identities; no raw argv/env/secret-bearing metadata promotion; bounded label/path/port/network strings; safe text rendering/no HTML injection; no raw value → CSS class/style/token channel; bounded object/edge/attachment counts and layout work; pathological graph input cannot cause quadratic/unbounded browser work beyond frozen caps; authenticated APIs unchanged; screenshots/fixtures contain no live secrets; URLs follow existing safe routing/redaction policy.
Any third-party renderer/layout dependency must pass production dependency/audit and must not add runtime network egress, telemetry, remote fonts/assets, workers, WASM, or unsafe HTML requirements without explicit architecture approval.