svg_conform 0.2.4 → 0.2.7

data/TODO.issue-100/03-ship-svg-1-1-full-static.md

@@ -0,0 +1,138 @@
+# 03 — Ship SVG 1.1 Full/static
+
+Effort: **8–12 person-days**
+
+Repository: `claricle/svg_conform`
+
+Depends on: Card 02
+
+## Purpose
+
+Add an opt-in profile for SVG 1.1 Full documents under static processing. The
+profile validates the Recommendation's document grammar instead of treating an
+element allow-list as standards conformance, and it behaves the same through
+the repository's DOM and SAX entry points.
+
+## Requirement matrix
+
+Add `config/profiles/svg_1_1_full_static.yml` with this stable matrix. Every
+entry carries its listed normative URI and emits an error with its own ID.
+
+| Requirement ID | Rule | Normative citation |
+| --- | --- | --- |
+| `svg11.document.xml` | The source is well-formed XML and exposes its original declaration, doctype, and processing instructions to document-level validation. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments` |
+| `svg11.document.root` | The document element is `svg` in `http://www.w3.org/2000/svg`. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElement` |
+| `svg11.document.version` | The root declares SVG version `1.1`. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElementVersionAttribute` |
+| `svg11.document.grammar` | After the Appendix G.2 foreign-namespace transform, elements, attributes, content models, and required values validate against the pinned SVG 1.1 Full flat DTD. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments` |
+| `svg11.document.css2` | Style attributes and style sheets accepted by the document conform to the CSS 2 core grammar required by SVG 1.1; this checks syntax, not browser rendering or every CSS property semantic. | `https://www.w3.org/TR/2008/REC-CSS2-20080411/grammar.html` |
+| `svg11.document.xml_stylesheet` | `xml-stylesheet` processing instructions obey their Recommendation's pseudo-attribute syntax and SVG applicability rules. | `https://www.w3.org/TR/1999/REC-xml-stylesheet-19990629/` |
+| `svg11.processing.script` | Static mode rejects script elements and event-handler attributes. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers` |
+| `svg11.processing.animation` | Static mode rejects SVG animation elements and animation-timing attributes. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers` |
+| `svg11.processing.interaction` | Static mode rejects interaction-only event attributes and cursor behavior. | `https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers` |
+
+The profile's `specification_uri` is the dated SVG 1.1 Second Edition
+Recommendation. Profile and requirement citations flow into LensCore reports.
+
+## Source-level validation plumbing
+
+Document conformance needs bytes that parsed DOMs can discard. Add an optional
+`source` and `source_path` to `ValidationContext`, retain the original content
+in `Document`, and pass `SaxDocument#content` into `SaxValidationHandler`.
+Extend `BaseRequirement` with a no-op
+`validate_source(source, context)` hook. Invoke it exactly once before DOM
+traversal or SAX element dispatch; source diagnostics then share the normal
+tracker and LensCore adapter.
+
+For `Document.from_node`, serialize the node and mark the source as serialized
+so a source-sensitive requirement can report that a declaration/doctype/PI
+claim cannot be proved instead of silently accepting it. File and string entry
+points retain exact input bytes. Add focused parity specs for file and string
+entry points in both modes.
+
+## Validators and shared processing requirement
+
+- Vendor the dated flat DTD at
+  `data/svg_1_1/svg11-flat-20110816.dtd`. Add
+  `data/svg_1_1/manifest.yml` with its W3C source URL, retrieval date, and
+  computed SHA-256. Resolution is local-only: external entity or network access
+  during validation is an error.
+- Add `SvgConform::Validation::Svg11DocumentConformance` in
+  `lib/svg_conform/validation/svg_1_1_document_conformance.rb` and expose it
+  through `Svg11DocumentRequirement`. Implement the Appendix G.2 transform in
+  an isolated helper and validate the transformed copy; never rewrite the
+  caller's document.
+- Add a focused CSS 2 core tokenizer/parser at
+  `lib/svg_conform/validation/css2_core_grammar.rb` and reuse it for style
+  attributes, style elements, and applicable stylesheet content. Keep property
+  support and rendering semantics outside this syntax check.
+- Add `ProcessingFeaturesRequirement` in
+  `lib/svg_conform/requirements/processing_features_requirement.rb`. Its YAML
+  configuration names `script`, `animation`, and `interaction` categories and
+  their separate IDs/citations. Implement DOM and SAX paths once here. Card 04
+  consumes the same serialized requirement unchanged.
+- Require both new requirement files from `lib/svg_conform/requirements.rb` and
+  include them in `SvgConform::Requirements.all`. The existing
+  `Profile::REQUIREMENTS_CLASS_MAP` discovers their files, and
+  `ProfileCompiler` loads and precomputes them; cover those existing mechanisms
+  in the profile spec rather than adding a competing registry.
+
+### Open implementation question resolved by this card
+
+Before building the grammar validator, run four tiny probes (valid document,
+invalid content model, external-entity attempt, and Appendix G.2 foreign
+content) against the currently bundled Moxml/Leptris stack. Record the result in
+the validator spec. If that stack cannot perform offline validating-DTD checks,
+select the smallest maintained Ruby-compatible validating XML library, add it
+to `svg_conform.gemspec` and `Gemfile`, and lock it. Selection criteria are the
+four probes, supported Ruby versions, no network/entity resolution, and no
+shelling out. Do not substitute a hand-maintained element list for DTD
+validation.
+
+## Corpus, tests, and documentation
+
+Create `spec/fixtures/profiles/svg_1_1_full_static/` with small fixtures that
+isolate each matrix row:
+
+- valid minimal Full, CSS, XML-stylesheet, and foreign-metadata documents;
+- invalid malformed-XML source (for `svg11.document.xml`), root/namespace,
+  version, DTD content-model, attribute, CSS grammar, and XML-stylesheet cases;
+- one invalid script, animation, and interaction case.
+
+Add `spec/svg_conform/validation/svg_1_1_document_conformance_spec.rb`,
+`spec/svg_conform/validation/css2_core_grammar_spec.rb`,
+`spec/svg_conform/requirements/svg_1_1_document_requirement_spec.rb`,
+`spec/svg_conform/requirements/processing_features_requirement_spec.rb`, and
+`spec/svg_conform/profiles/svg_1_1_full_static_profile_spec.rb`. The profile spec
+runs every fixture through DOM and SAX, compares validity and stable requirement
+IDs, and asserts that all errors have the normative citation. Update
+the existing `docs/profiles.adoc`, `docs/cli_guide.adoc`, and the profile-list
+command coverage with
+the profile ID, scope, citations, non-goals, and example command.
+
+## Done when
+
+- `svg_1_1_full_static` is discoverable and opt-in; no existing profile or
+  default selection changes.
+- All nine matrix rows have a stable ID, normative citation, isolated invalid
+  fixture, and matching DOM/SAX result.
+- Valid SVG 1.1 Full fixtures pass local DTD, CSS, and stylesheet checks without
+  network access; invalid grammar is rejected by the appropriate requirement.
+- Appendix G.2 foreign content is handled on a validation copy, and an external
+  entity attempt cannot read a file or make a network request.
+- Script, animation, and interaction categories are enforced by the serialized
+  shared `ProcessingFeaturesRequirement` in both validation modes.
+- Profile documentation states exactly what Full/static covers and does not
+  claim Tiny, Basic, rendering, or remediation support.
+- All changed Ruby passes the repository linter and the gem builds.
+
+```sh
+bundle exec rspec spec/svg_conform/validation/svg_1_1_document_conformance_spec.rb spec/svg_conform/validation/css2_core_grammar_spec.rb spec/svg_conform/requirements/svg_1_1_document_requirement_spec.rb spec/svg_conform/requirements/processing_features_requirement_spec.rb spec/svg_conform/profiles/svg_1_1_full_static_profile_spec.rb spec/svg_conform/commands/profiles_command_spec.rb
+bundle exec svg_conform check spec/fixtures/profiles/svg_1_1_full_static/valid/minimal-full.svg --profile svg_1_1_full_static --format json
+bundle exec rubocop
+bundle exec rake build
+```
+
+## Status
+
+State: done
+PR: https://github.com/claricle/svg_conform/pull/109

data/TODO.issue-100/04-ship-svg-2-secure-static.md

@@ -0,0 +1,131 @@
+# 04 — Ship SVG 2 secure-static
+
+Effort: **4–6 person-days**
+
+Repository: `claricle/svg_conform`
+
+Depends on: Cards 02 and 03
+
+## Purpose
+
+Add an opt-in SVG 2 profile for the dated Candidate Recommendation's
+secure-static processing mode. Reuse the shared processing-feature requirement
+and the established reference classifier rather than creating a second URI
+model.
+
+## Requirement matrix
+
+Add `config/profiles/svg_2_secure_static.yml` with the dated SVG 2 Candidate
+Recommendation as its `specification_uri` and these stable errors:
+
+| Requirement ID | Rule | Normative citation |
+| --- | --- | --- |
+| `svg2.secure_static.script` | Reject script elements and event-handler attributes. | `https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode` |
+| `svg2.secure_static.animation` | Reject SVG/CSS animation and animation-timing features. | `https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode` |
+| `svg2.secure_static.interaction` | Reject interaction-only event and cursor behavior. | `https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode` |
+| `svg2.secure_static.external_reference` | Permit same-document fragment references and supported self-contained data URLs; reject references that require another document, local file, or network resource. | `https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode` |
+
+The first three rows configure Card 03's
+`ProcessingFeaturesRequirement`; do not fork the class or its YAML shape for
+SVG 2.
+
+## Reference boundary
+
+Add `ExternalReferencesRequirement` at
+`lib/svg_conform/requirements/external_references_requirement.rb`. It calls the
+existing public API unchanged:
+
+```ruby
+SvgConform::References::ReferenceClassifier.classify(
+  href_value,
+  element_name:,
+  attribute_name:,
+  line_number: nil,
+  column_number: nil
+)
+```
+
+Keep `InternalFragmentReference`, `DataUriReference`, `UrnReference`,
+`ExternalUrlReference`, and `RelativePathReference` as the returned types, and
+keep `LinkValidationRequirement` on the same classifier. Add behavior to
+`DataUriReference` rather than introducing a second data-URL parser.
+
+The requirement inspects:
+
+- `href`, `xlink:href`, and SVG URI/IRI-bearing presentation attributes;
+- CSS `url(...)` and `@import` tokens in style attributes and style elements;
+- `xml-stylesheet` processing instructions via Card 03's source hook.
+
+Classification is explicit:
+
+- `#fragment` in the current document is allowed; the existing link requirement
+  still reports a missing fragment target.
+- HTTP(S), protocol-relative URLs, URNs, and relative paths with a resource
+  component (including `other.svg#id`) are rejected.
+- A data URL is allowed only when it decodes without external access and its
+  media type is `image/png`, `image/jpeg`, or `image/svg+xml`. Raster payloads
+  must be non-empty and syntactically decodable; an SVG payload must decode to
+  one complete well-formed SVG document. Both base64 and percent-encoded forms
+  are covered. Malformed encodings, unsupported media types, and nested external
+  references in SVG data URLs are rejected.
+- Empty references and non-resource lexical values retain their existing
+  classifier behavior and are not reclassified merely to satisfy this profile.
+
+Nested `image/svg+xml` validation applies the external-reference rule with a
+depth limit and cycle guard, but does not recursively run the entire parent
+profile. It reports the outer source location and a JSON-safe nested failure
+reason.
+
+## Corpus, tests, and documentation
+
+Create `spec/fixtures/profiles/svg_2_secure_static/` with a small, enumerated
+corpus:
+
+- valid same-document fragments;
+- valid base64 and percent-encoded PNG/JPEG data URLs;
+- valid base64 and percent-encoded self-contained SVG data URLs;
+- invalid HTTP(S), protocol-relative, relative-file, file-like fragment, URN,
+  CSS `url`, CSS `@import`, and XML-stylesheet references;
+- invalid malformed/unsupported data URLs and SVG data URLs with malformed XML,
+  nested external content, or excessive nesting;
+- one invalid fixture per script, animation, and interaction row.
+
+Extend the existing `spec/svg_conform/references/reference_classifier_spec.rb`,
+`spec/svg_conform/references/integration_spec.rb`, and
+`spec/svg_conform/requirements/link_validation_requirement_spec.rb`. Add
+`spec/svg_conform/references/data_uri_reference_spec.rb`,
+`spec/svg_conform/requirements/external_references_requirement_spec.rb`, and
+`spec/svg_conform/profiles/svg_2_secure_static_profile_spec.rb`. Run the corpus
+through DOM and SAX paths and compare validity, stable IDs, and citations. Update
+the existing `docs/profiles.adoc` and `docs/cli_guide.adoc` with the exact
+accepted-reference table,
+dated citation, profile non-goals, and example command.
+
+## Done when
+
+- `svg_2_secure_static` is discoverable and opt-in; no existing profile or
+  default selection changes.
+- All four matrix rows have stable IDs, the dated secure-static citation,
+  isolated invalid fixtures, and matching DOM/SAX reports.
+- Same-document fragments and all six supported data-URL form/media
+  combinations pass, while every enumerated external or malformed case fails
+  with `svg2.secure_static.external_reference`.
+- `ReferenceClassifier.classify` retains its signature and typed returns;
+  existing `LinkValidationRequirement` integration specs continue to pass.
+- Processing-feature behavior comes from the unchanged serialized requirement
+  introduced by Card 03.
+- Documentation describes secure-static resource behavior without claiming
+  complete SVG 2 document, rendering, or CSS conformance.
+- All changed Ruby passes the repository linter and the gem builds.
+
+```sh
+bundle exec rspec spec/svg_conform/references/reference_classifier_spec.rb spec/svg_conform/references/data_uri_reference_spec.rb spec/svg_conform/references/integration_spec.rb spec/svg_conform/requirements/link_validation_requirement_spec.rb spec/svg_conform/requirements/external_references_requirement_spec.rb spec/svg_conform/requirements/processing_features_requirement_spec.rb spec/svg_conform/profiles/svg_2_secure_static_profile_spec.rb spec/svg_conform/commands/profiles_command_spec.rb
+bundle exec svg_conform check spec/fixtures/profiles/svg_2_secure_static/valid/same-document-fragment.svg --profile svg_2_secure_static --format json
+bundle exec rubocop
+bundle exec rake build
+```
+
+## Status
+
+State: done
+PR: https://github.com/claricle/svg_conform/pull/107

data/TODO.issue-100/05-freeze-candidate-and-handoff.md

@@ -0,0 +1,108 @@
+# 05 — Freeze the candidate and adoption handoff
+
+Effort: **2–4 person-days**
+
+Repositories: `claricle/lens_core`, then `claricle/svg_conform`
+
+Depends on: Cards 01–04
+
+## Purpose
+
+Freeze the v1 candidate against real svg_conform output, pin the round-trip
+corpus, and leave enough format-neutral evidence for another lens to adopt
+LensCore without loading SVG code. The endpoint is ready to tag; gem publication
+and adopter migrations are outside this issue.
+
+## Golden corpus
+
+In LensCore, add:
+
+- `spec/fixtures/v1/golden/svg_conform/svg-1.1-invalid-grammar.json`, exported
+  from the Card 03 invalid grammar fixture;
+- `spec/fixtures/v1/golden/svg_conform/svg-2-external-reference.json`, exported
+  from the Card 04 external-reference fixture;
+- `spec/fixtures/v1/golden/svg_conform/svg-four-channel-library.json`, exported
+  through the public adapter from a focused result containing an error, validity
+  error, warning, and info;
+- `spec/fixtures/v1/golden/examples/xml-location.json` and
+  `binary-location.json`, format-neutral examples that exercise the two location
+  forms without claiming adoption by another lens;
+- `spec/fixtures/v1/golden/manifest.yml`, recording each file's SHA-256,
+  producer/version, source fixture, schema version, exact svg_conform commit for
+  SVG exports, and the exact pre-freeze LensCore contract commit used to render
+  them.
+
+All goldens omit timestamps. Add `script/refresh_svg_goldens`, which takes an
+svg_conform checkout path, refuses a checkout whose HEAD does not match the
+manifest's expected commit, invokes the public adapter/renderers, canonicalizes
+through LensCore, and updates only the three SVG JSON files and their hashes.
+The script must not clone, fetch, publish, or write outside LensCore.
+
+## Freeze and host-only evidence
+
+- Add `spec/lens_core/round_trip_spec.rb` for canonical value and formatting
+  round trips, and add `spec/lens_core/golden_corpus_spec.rb` to validate every
+  manifest entry against the v1 schema, parse it, render it, and compare bytes
+  with the input. Also prove that summary counts equal the diagnostics and that
+  profile, citation, context, remediation, and present location fields survive.
+- Add a minimal fixture app at `spec/fixtures/host_app/` whose bundle contains
+  only LensCore and Ruby standard libraries. Its check reads the complete golden
+  directory, reports profile/count/location information, and never requires
+  svg_conform; exercise it from `spec/lens_core/host_only_spec.rb`.
+- Commit the LensCore corpus, checks, and documentation as the immutable freeze
+  candidate. Do not try to write that commit's own SHA into a file in the same
+  commit.
+- In svg_conform, update the `Gemfile` Git ref and generated `Gemfile.lock` to
+  that final LensCore freeze commit. Add `docs/lens_core_handoff.adoc` with the
+  exact LensCore freeze commit, schema path and SHA-256, golden manifest path,
+  canonical parse/render calls, compatibility/error rules, and the exact
+  earlier svg_conform producer commit named by the manifest. Explicitly label
+  the binary report as a contract example, not PNG/EMF/PostScript implementation
+  evidence.
+- Re-run the Card 02 adapter specs and the two profile specs against that exact
+  freeze commit; no API/schema shim may remain only in an uncommitted LensCore
+  checkout.
+
+If the SVG exports reveal a contract defect, fix schema/model/docs together and
+commit the corrected LensCore contract first. Update svg_conform's temporary pin
+and record a new producer commit, then regenerate all corpus hashes and repeat
+both repositories' focused checks before declaring the later LensCore freeze
+commit immutable.
+
+## Done when
+
+- The manifest names exact immutable generation commits and SHA-256 values for
+  the schema and every golden; the svg_conform lockfile and handoff name the
+  later immutable LensCore freeze commit, so no branch-only or working-tree
+  dependency remains.
+- Every canonical JSON golden validates and parse/renders byte-for-byte, and the
+  four-channel report proves infos and validity errors are retained.
+- The host-only fixture reads XML and binary location examples using LensCore
+  alone and has no SVG or other-lens dependency.
+- svg_conform's lockfile resolves the same frozen LensCore commit named by the
+  handoff, and focused adapter/SVG 1.1/SVG 2 specs pass at that pin.
+- The handoff clearly separates completed contract/SVG evidence from future
+  EMF, PNG, PostScript, release, and publication work.
+- LensCore and svg_conform each pass their changed-Ruby lint and gem build.
+
+In `claricle/lens_core`:
+
+```sh
+bundle exec rspec spec/lens_core/golden_corpus_spec.rb spec/lens_core/round_trip_spec.rb spec/lens_core/host_only_spec.rb
+bundle exec ruby -Ilib spec/fixtures/host_app/read_reports.rb spec/fixtures/v1/golden
+bundle exec rubocop
+bundle exec rake build
+```
+
+In `claricle/svg_conform`:
+
+```sh
+bundle exec rspec spec/svg_conform/diagnostics/lens_core_adapter_spec.rb spec/svg_conform/profiles/svg_1_1_full_static_profile_spec.rb spec/svg_conform/profiles/svg_2_secure_static_profile_spec.rb
+bundle exec rubocop
+bundle exec rake build
+```
+
+## Status
+
+State: done
+PR: https://github.com/claricle/svg_conform/pull/110

data/TODO.issue-100/90-progress.md

@@ -0,0 +1,65 @@
+# Issue 100 — Progress and handoff
+
+## Current state
+
+Planning is complete. Implementation has not started, and every work card is
+`todo` with no PR. The execution order is:
+
+| Card | State | Effort | Next dependency |
+| --- | --- | --- | --- |
+| 01 — Build LensCore diagnostics v1 | todo | 4–7 person-days | none |
+| 02 — Adopt LensCore in svg_conform | todo | 3–5 person-days | Card 01 candidate commit |
+| 03 — Ship SVG 1.1 Full/static | todo | 8–12 person-days | Card 02 adapter/citations |
+| 04 — Ship SVG 2 secure-static | todo | 4–6 person-days | Card 02 diagnostics and Card 03 shared plumbing |
+| 05 — Freeze the candidate and adoption handoff | todo | 2–4 person-days | Cards 01–04 complete |
+
+Overall: **21–34 person-days**.
+
+The next action is Card 01. Card 02 must pin a real candidate commit before SVG
+integration starts; Card 05 replaces that temporary pin with the final frozen
+candidate commit.
+
+## Known implementation questions
+
+- Card 03 must establish whether the existing Moxml/Leptris stack can perform
+  validating, offline SVG 1.1 DTD checks. Its four-probe spike has explicit
+  selection criteria and owns any dependency decision; no parser library is
+  assumed in advance.
+- SVG 1.1 source-sensitive rules require original declarations, doctypes, and
+  processing instructions. Card 03 owns the source hook for both DOM and SAX so
+  the implementation does not infer these from an already-normalized tree.
+- The dated SVG 2 source is remote normative material. Card 04 pins citations
+  and fixture behavior; it does not copy an untracked local snapshot into the
+  profile.
+
+## Scope deliberately left out
+
+This plan's scope is LensCore, svg_conform adoption, and the two SVG profiles.
+The following are outside it:
+
+- **Actual EMF, PNG, and PostScript migrations, dependencies, and report
+  goldens.** Those belong to their separate tracker issues. Card 05 supplies the
+  exact LensCore commit, schema digest, SVG exports, host-only proof, and generic
+  binary-location example they need, without claiming those repositories have
+  adopted the contract.
+- **PNG-specific full-report migration, inaccessible-field work, and a
+  PNG-only RuboCop command.** No PNG files are in scope, so inventing PNG API or
+  fixture requirements here would be unverified cross-repository design.
+- **EMF spec paths that do not exist in the target repository.** The plan does
+  not cite or require nonexistent tests; the format-neutral binary example is
+  the only evidence needed for this contract issue.
+- **PostScript implementation.** The final scope excludes it entirely, so there
+  is no placeholder adapter or speculative field map.
+- **Lens-family release and dependency audit commands.** Publishing LensCore,
+  replacing temporary Git pins with a released gem constraint, changing every
+  lens gemspec/lockfile, and running their release checks happen after this
+  issue. Card 05 ends at an immutable, ready-to-tag candidate and observable
+  handoff.
+
+## Verification handoff
+
+The commands on Cards 01–05 are prospective implementation checks. They are
+focused by design: targeted specs and fixtures, changed-repository RuboCop, and
+gem builds only. No full suite, corpus sweep, or fuzzer is required. Card 05 is
+the final integration gate and must record immutable commits and digests rather
+than branch names.

data/config/profiles/metanorma.yml

@@ -21,7 +21,7 @@ requirements:
     element_configs:
       # Direct encoding from svgcheck word_properties.py elements dictionary
       - tag: "svg"
-        attributes: ["version", "baseProfile", "width", "viewBox", "preserveAspectRatio", "snapshotTime", "height", "id", "role", "break", "color-rendering", "fill-rule", "overflow", "data-name", "clip-path", "mask"]
+        attributes: ["version", "baseProfile", "width", "viewBox", "preserveAspectRatio", "snapshotTime", "height", "id", "role", "break", "color-rendering", "fill-rule", "overflow", "data-name", "clip-path", "mask", "contentStyleType", "zoomAndPan"]
         required_attributes: ["version", "baseProfile"]
         attribute_values:
           version: ["1.2"]
@@ -61,13 +61,13 @@ requirements:
         attributes: ["x", "y", "width", "height", "auto", "id", "role", "fill", "transform", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "clip-path", "mask"]
         allowed_children: ["desc", "title", "tspan", "text", "a"]
       - tag: "text"
-        attributes: ["x", "y", "rotate", "id", "role", "fill", "style", "transform", "font-size", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "font-stretch", "writing-mode", "text-decoration", "clip-path", "mask"]
+        attributes: ["x", "y", "rotate", "id", "role", "fill", "style", "transform", "font-size", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "font-stretch", "writing-mode", "text-decoration", "clip-path", "mask", "textLength", "lengthAdjust"]
         allowed_children: ["desc", "title", "tspan", "text", "a"]
       - tag: "g"
         attributes: ["label", "class", "id", "role", "fill", "style", "transform", "fill-rule", "visibility", "base", "lang", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "data-name", "clip-path", "mask"]
         allowed_children: ["title", "path", "rect", "circle", "line", "ellipse", "polyline", "polygon", "solidColor", "textArea", "text", "g", "defs", "use", "a", "tspan", "desc", "image"]
       - tag: "defs"
-        attributes: ["id", "role", "fill", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space"]
+        attributes: ["id", "role", "fill", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "clip-path", "mask"]
         allowed_children: ["title", "path", "rect", "circle", "line", "ellipse", "polyline", "polygon", "solidColor", "textArea", "text", "g", "defs", "use", "a", "tspan", "desc", "style", "clipPath", "linearGradient", "radialGradient", "pattern", "marker", "mask", "filter", "image"]
       - tag: "clipPath"
         attributes: ["id", "clipPathUnits", "class", "style"]
@@ -100,7 +100,7 @@ requirements:
         attributes: ["x", "y", "href", "xlink:href", "id", "role", "fill", "transform", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "clip-path", "mask"]
         allowed_children: ["title", "desc"]
       - tag: "a"
-        attributes: ["id", "role", "fill", "transform", "fill-rule", "target", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space"]
+        attributes: ["id", "role", "fill", "transform", "fill-rule", "target", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "title", "clip-path", "mask"]
         allowed_children: ["title", "path", "rect", "circle", "line", "ellipse", "polyline", "polygon", "solidColor", "textArea", "text", "g", "defs", "use", "a", "tspan", "desc"]
       - tag: "tspan"
         attributes: ["x", "y", "id", "role", "fill", "fill-rule", "base", "lang", "class", "rel", "rev", "typeof", "content", "datatype", "resource", "about", "property", "space", "letter-spacing"]

data/config/profiles/svg_1_1_full_static.yml

@@ -0,0 +1,69 @@
+name: "svg_1_1_full_static"
+description: "SVG 1.1 Full (Second Edition) document grammar under static processing"
+specification_uri: "https://www.w3.org/TR/2011/REC-SVG11-20110816/"
+specification_label: "Scalable Vector Graphics (SVG) 1.1 (Second Edition)"
+
+requirements:
+  - id: "svg11.document.xml"
+    type: "Svg11DocumentRequirement"
+    rule: "xml"
+    description: "The source is well-formed XML and exposes its original declaration, doctype, and processing instructions"
+    citation_uri: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments"
+    citation_label: "Conforming SVG Documents"
+  - id: "svg11.document.root"
+    type: "Svg11DocumentRequirement"
+    rule: "root"
+    description: "The document element is svg in the SVG namespace"
+    citation_uri: "https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElement"
+    citation_label: "The svg element"
+  - id: "svg11.document.version"
+    type: "Svg11DocumentRequirement"
+    rule: "version"
+    description: "The root declares SVG version 1.1"
+    citation_uri: "https://www.w3.org/TR/2011/REC-SVG11-20110816/struct.html#SVGElementVersionAttribute"
+    citation_label: "The version attribute"
+  - id: "svg11.document.grammar"
+    type: "Svg11DocumentRequirement"
+    rule: "grammar"
+    description: "Elements, attributes and content models validate against the pinned SVG 1.1 Full flat DTD after the Appendix G.2 foreign-namespace transform"
+    citation_uri: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments"
+    citation_label: "Conforming SVG Documents"
+  - id: "svg11.document.css2"
+    type: "Svg11DocumentRequirement"
+    rule: "css2"
+    description: "Style attributes and style sheets conform to the CSS 2 core grammar (syntax only)"
+    citation_uri: "https://www.w3.org/TR/2008/REC-CSS2-20080411/grammar.html"
+    citation_label: "CSS 2 grammar"
+  - id: "svg11.document.xml_stylesheet"
+    type: "Svg11DocumentRequirement"
+    rule: "xml_stylesheet"
+    description: "xml-stylesheet processing instructions obey their pseudo-attribute syntax and SVG applicability"
+    citation_uri: "https://www.w3.org/TR/1999/REC-xml-stylesheet-19990629/"
+    citation_label: "Associating Style Sheets with XML documents"
+  - id: "svg11.processing"
+    type: "ProcessingFeaturesRequirement"
+    description: "Static processing rejects script, animation and interaction"
+    categories:
+      - name: "script"
+        id: "svg11.processing.script"
+        citation: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers"
+        description: "Static mode rejects script elements and event-handler attributes"
+        elements: ["script"]
+        attributes:
+          [onabort, onerror, onload, onresize, onscroll, onunload, onzoom]
+      - name: "animation"
+        id: "svg11.processing.animation"
+        citation: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers"
+        description: "Static mode rejects animation elements and animation-timing attributes"
+        elements: [animate, animateColor, animateMotion, animateTransform, set, mpath]
+        attributes:
+          [begin, end, dur, min, max, restart, repeatCount, repeatDur, calcMode,
+           keyTimes, keySplines, onbegin, onend, onrepeat]
+      - name: "interaction"
+        id: "svg11.processing.interaction"
+        citation: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers"
+        description: "Static mode rejects interaction-only event attributes and cursor behavior"
+        elements: ["cursor"]
+        attributes:
+          [onactivate, onclick, onfocusin, onfocusout, onmousedown, onmousemove,
+           onmouseout, onmouseover, onmouseup, cursor]

data/config/profiles/svg_2_secure_static.yml

@@ -0,0 +1,55 @@
+name: "svg_2_secure_static"
+description: "Opt-in SVG 2 secure-static processing mode: no script, animation, interaction or external resources"
+specification_uri: "https://www.w3.org/TR/2026/CR-SVG2-20261006/"
+specification_label: "Scalable Vector Graphics (SVG) 2, Candidate Recommendation 6 October 2026"
+
+# Scope: secure-static resource behavior only. This is not a complete SVG 2
+# document, rendering or CSS conformance check.
+requirements:
+  # Same shape as config/requirements/processing_features_static.yml;
+  # only ids, citations and the feature lists differ.
+  - id: "svg2.secure_static.processing"
+    type: "ProcessingFeaturesRequirement"
+    description: "Secure-static mode rejects script, animation and interaction"
+    categories:
+      - name: "script"
+        id: "svg2.secure_static.script"
+        citation: "https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode"
+        description: "Secure-static mode rejects script elements and event-handler attributes"
+        elements: ["script"]
+        attributes:
+          [onabort, onerror, onload, onresize, onscroll, onunload, onzoom]
+      - name: "animation"
+        id: "svg2.secure_static.animation"
+        citation: "https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode"
+        description: "Secure-static mode rejects SVG/CSS animation and animation-timing features"
+        elements: [animate, animateColor, animateMotion, animateTransform, set, mpath, discard]
+        attributes:
+          [begin, end, dur, min, max, restart, repeatCount, repeatDur, calcMode,
+           keyTimes, keySplines, onbegin, onend, onrepeat]
+        attribute_patterns:
+          - "\\Aanimation(-.+)?\\z"
+          - "\\Atransition(-.+)?\\z"
+      - name: "interaction"
+        id: "svg2.secure_static.interaction"
+        citation: "https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode"
+        description: "Secure-static mode rejects interaction-only event attributes and cursor behavior"
+        elements: ["cursor"]
+        attributes:
+          [onactivate, onauxclick, onblur, onclick, ondblclick, onfocus,
+           onfocusin, onfocusout, onkeydown, onkeypress, onkeyup, onmousedown,
+           onmouseenter, onmouseleave, onmousemove, onmouseout, onmouseover,
+           onmouseup, onwheel, ontouchstart, ontouchend, ontouchmove,
+           ontouchcancel, cursor]
+        # Every other event-handler attribute (onpointerdown, ondragstart, ...).
+        # An attribute is reported by the first category that lists it, so the
+        # named script and animation handlers above keep their own ids.
+        attribute_patterns:
+          - "\\Aon.+\\z"
+
+  - id: "svg2.secure_static.external_reference"
+    type: "ExternalReferencesRequirement"
+    description: "Permits same-document fragments and self-contained image data URLs; rejects references to another document, local file or network resource"
+    citation_uri: "https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode"
+    citation_label: "SVG 2 CR, secure static mode"
+    max_data_uri_depth: 3

data/config/requirements/processing_features_static.yml

@@ -0,0 +1,29 @@
+# Static-processing categories for ProcessingFeaturesRequirement.
+# Profiles copy this requirement entry into their `requirements` list.
+id: "svg11.processing"
+type: "ProcessingFeaturesRequirement"
+description: "Static processing rejects script, animation and interaction"
+categories:
+  - name: "script"
+    id: "svg11.processing.script"
+    citation: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers"
+    description: "Static mode rejects script elements and event-handler attributes"
+    elements: ["script"]
+    attributes:
+      [onabort, onerror, onload, onresize, onscroll, onunload, onzoom]
+  - name: "animation"
+    id: "svg11.processing.animation"
+    citation: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers"
+    description: "Static mode rejects animation elements and animation-timing attributes"
+    elements: [animate, animateColor, animateMotion, animateTransform, set, mpath]
+    attributes:
+      [begin, end, dur, min, max, restart, repeatCount, repeatDur, calcMode,
+       keyTimes, keySplines, onbegin, onend, onrepeat]
+  - name: "interaction"
+    id: "svg11.processing.interaction"
+    citation: "https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGViewers"
+    description: "Static mode rejects interaction-only event attributes and cursor behavior"
+    elements: ["cursor"]
+    attributes:
+      [onactivate, onclick, onfocusin, onfocusout, onmousedown, onmousemove,
+       onmouseout, onmouseover, onmouseup, cursor]

data/data/svg_1_1/manifest.yml

@@ -0,0 +1,7 @@
+# Vendored SVG 1.1 (Second Edition, 16 August 2011) flat DTD.
+# Validation resolves this file locally; no network or external entity access.
+files:
+  - path: svg11-flat-20110816.dtd
+    source_url: https://www.w3.org/Graphics/SVG/1.1/DTD/svg11-flat-20110816.dtd
+    retrieved: 2026-10-23
+    sha256: 7c22266d65655a7d359e9e79a107d156e64b29a87491313be2092bd66cab3b9b