visual-artifacts v1: PR 1 static renderer and trust contract#217

Merged

garagon merged 10 commits into

mainfrom

visual-artifacts-v1-pr1-static-renderer

May 11, 2026

Commits on May 11, 2026

visual-artifacts: PR 1 static renderer and trust contract
garagon
committed
visual-artifacts: fix legacy plan render and fresh-store --out
garagon
committed
visual-artifacts: reject --out paths that escape visual/ via ".."
garagon
committed
visual-artifacts: canonicalize manifest paths under relative store
garagon
committed
visual-artifacts: reject symlinked subdirectories under visual/
garagon
committed
visual-artifacts: reject symlinked or directory leaves at output
garagon
committed
visual-artifacts: write to normalized path and lock other contracts
garagon
committed
visual-artifacts: render does not mutate sprint session state
garagon
committed
visual-artifacts: secure temp files and glob-safe path normalization
garagon
committed
visual-artifacts: clean HTML temp under --manifest-only
garagon
committed