The local extractor consumes untrusted chunk text and EXTRACTION_REVIEW=false writes extracted nodes/edges live; recalled global chunks reach every downstream agent (indirect prompt-injection). Keep review mandatory for untrusted sources, tag chunk trust/provenance, and treat recalled content as untrusted in client prompts.
Part of #208
The local extractor consumes untrusted chunk text and EXTRACTION_REVIEW=false writes extracted nodes/edges live; recalled global chunks reach every downstream agent (indirect prompt-injection). Keep review mandatory for untrusted sources, tag chunk trust/provenance, and treat recalled content as untrusted in client prompts.
Part of #208