@pikaa-ai/pikaa 0.3.1 → 0.3.4

package/skills/pptx-posters/references/pptx_security.md

@@ -1,202 +0,0 @@
-# PPTX package security
-
-## Threat model
-
-A presentation can be more than visible slide XML. A package can contain VBA,
-ActiveX, OLE objects, embedded files, external relationships, linked images, malformed
-XML, duplicate/traversing ZIP names, or highly compressed payloads.
-
-Do not open an untrusted presentation or template to see whether it is safe. Opening
-is execution by a complex Office application and is outside these scripts.
-
-This skill:
-
-- generates from a built-in blank `python-pptx` presentation only;
-- accepts no external template;
-- accepts no `.pptm`, `.potx`, `.potm`, `.ppsx`, `.ppsm`, legacy `.ppt`, or
-  arbitrary office package;
-- inspects `.pptx` as a bounded one-slide generated-poster ZIP/XML profile without
-  extraction;
-- rejects every external relationship, even an ordinary hyperlink;
-- uses visible QR fallback text instead of creating external hyperlinks.
-
-## Package facts
-
-[ECMA-376](https://ecma-international.org/publications-and-standards/standards/ecma-376/)
-defines Office Open XML vocabularies, representation, and packaging.
-[ISO/IEC 29500-2:2021](https://www.iso.org/standard/77818.html) defines Open
-Packaging Conventions, which combine parts and relationships into one package.
-
-The inspector expects a standard macro-free PresentationML package with at least:
-
-- `[Content_Types].xml`
-- `_rels/.rels`
-- `ppt/presentation.xml`
-- `ppt/_rels/presentation.xml.rels`
-- exactly one slide part and one matching slide relationship.
-
-It requires the standard macro-free presentation main content type. It resolves
-internal relationship targets against package parts.
-
-[Microsoft's supported-format list](https://support.microsoft.com/en-us/office/file-formats-that-are-supported-in-powerpoint-252c6fa0-a4bc-41be-ac82-b77c9773f9dc)
-identifies `.pptm` as a macro-enabled presentation containing VBA code. A `.pptx`
-extension alone is not sufficient assurance, so the inspector also checks content
-types, relationships, and package part names.
-
-## Rejected active and embedded content
-
-The inspector rejects:
-
-- VBA/macro-enabled content types and `vbaProject` parts;
-- `.pptm` and every non-`.pptx` extension;
-- `ppt/activeX`, control properties, custom UI, and related relationships;
-- OLE object relationships and markup;
-- `ppt/embeddings` and package relationships;
-- external-link package areas;
-- audio, video, linked media, timing, transitions, embedded fonts, 3D models, and
-  other parts outside the static generated-poster profile;
-- notes, comments, custom properties, web extensions, and interactive hyperlink/action
-  markup outside the one-slide poster profile;
-- package signatures, because generation changes the package and never preserves an
-  unverified signature;
-- executable/script/binary suffixes.
-
-[Microsoft's Open XML OLE object documentation](https://learn.microsoft.com/en-us/dotnet/api/documentformat.openxml.presentation.oleobject?view=openxml-3.0.1)
-shows that PresentationML OLE objects can be embedded or linked. Neither is needed for
-a static poster and both are rejected.
-
-## External relationships
-
-An OPC relationship can target an internal package part or an external resource.
-Microsoft's
-[OPC target-mode documentation](https://learn.microsoft.com/en-us/windows/win32/api/msopc/nf-msopc-iopcrelationship-gettargetmode)
-distinguishes the two. The strict policy rejects any relationship with
-`TargetMode="External"`.
-
-This includes:
-
-- remote or linked images;
-- ordinary web hyperlinks;
-- linked OLE objects or workbooks;
-- external media or data.
-
-The policy is intentionally stricter than PowerPoint's feature set. The visible
-poster may contain an `https://` URL as plain text, and a local QR image may encode
-that URL, but the PPTX does not create a clickable external relationship.
-
-Internal targets are normalized relative to the source part, must remain inside the
-package, and must exist.
-
-## ZIP preflight
-
-The inspector reads the central directory before selected XML:
-
-- input file limit: 512 MiB;
-- central-directory limit: 64 MiB;
-- member limit: 4,096;
-- single uncompressed member limit: 128 MiB;
-- total uncompressed limit: 1 GiB;
-- compression-ratio limit: 100:1;
-- allowed methods: stored or deflated;
-- no encrypted members;
-- no symbolic-link members;
-- no absolute, traversing, backslash, duplicate, or case-colliding names.
-- no multi-disk or ZIP64 package in this strict bounded profile.
-- no package part outside the exact generated-poster path allowlist.
-- PNG/JPEG media suffixes must match their byte signatures and streams must pass ZIP
-  CRC validation.
-
-These are defensive local policy limits, not ECMA/ISO or PowerPoint product limits.
-Adjusting them is a security decision and requires new tests.
-
-The ZIP footer is read directly before Python's `ZipFile` constructs its member list.
-Declared member count and central-directory size are therefore bounded before the
-library materializes attacker-controlled entries.
-
-The code never calls `ZipFile.extract` or `extractall`. Python's
-[`zipfile` documentation](https://docs.python.org/3/library/zipfile.html) warns
-that callers must prevent archive members from escaping the destination; not
-extracting removes that path entirely.
-
-## XML handling
-
-Every bounded XML part and every relationship part is parsed. The strict generated
-profile requires UTF-8 XML; NUL, document-type, and entity declarations are rejected
-before parsing, including attempts to hide declarations in another encoding. Content types,
-relationship roots/IDs/target modes, the one-slide relationship, and internal target
-existence are checked explicitly.
-
-The inspector does not:
-
-- resolve external entities;
-- execute macros or scripts;
-- activate OLE/ActiveX;
-- follow links;
-- render slides;
-- invoke PowerPoint, LibreOffice, or a shell command;
-- deserialize arbitrary Python objects.
-
-## Alt text markup
-
-The generator writes each approved picture description to PresentationML nonvisual
-drawing properties (`p:cNvPr` `descr`). Microsoft's
-[NonVisualDrawingProperties documentation](https://learn.microsoft.com/en-us/dotnet/api/documentformat.openxml.presentation.nonvisualdrawingproperties?view=openxml-3.0.1)
-describes this element and its drawing description property.
-
-The inspector counts pictures with nonempty descriptions. Presence is not semantic
-quality; review alt text in PowerPoint.
-
-The generator also uses the visible poster title as the native slide-title placeholder
-and writes the manifest language on text runs. The inspector reports title count and
-missing run-language metadata. These structural fields still require PowerPoint,
-screen-reader, and exported-PDF review. Longer descriptions remain approved native
-text elements in reading order rather than hidden package attachments.
-
-## Safe generation sequence
-
-1. Validate strict local JSON, requirements, sources, approval hash, and asset hashes.
-2. Decode bounded local images with exact-pinned Pillow and reject EXIF/XMP/comments
-   or embedded text/application metadata.
-3. Create a new presentation with exact-pinned `python-pptx` and its exact-pinned
-   `lxml` dependency; never load a user template.
-4. Remove the built-in template's inert binary printer-settings part and normalize
-   ZIP timestamps.
-5. Inspect the cleaned generated package.
-6. Copy the package while adding approved picture descriptions and text language.
-7. Inspect the patched package again.
-8. Run layout/font/image/palette audits.
-9. Publish to a new destination without replacement.
-
-The temporary files are private and in the destination directory. Final publication
-uses a same-filesystem hard link that fails if the destination already exists.
-
-## Untrusted inputs
-
-For a third-party PPTX:
-
-```bash
-python -B scripts/inspect_pptx.py untrusted.pptx
-```
-
-If it reports a finding, quarantine or discard the file. Do not open it to remediate.
-
-Even a clean report is not an antivirus verdict. The checker recognizes a deliberately
-small package profile; it cannot prove that every Office parser vulnerability or
-malicious payload is absent. Apply organizational malware scanning, sandboxing,
-Office Protected View, patching, and provenance controls as required.
-
-Do not use an inspected third-party file as a generator template. This skill has no
-template-input feature.
-
-## Residual technical limits
-
-- Standard ZIP/XML validation is not full ECMA-376 schema validation.
-- Standalone package inspection checks image signatures/CRC, not image decoder
-  safety. Generation separately performs bounded, exact-pinned Pillow decoding.
-- It does not render text, equations, fonts, transparency, or color.
-- It cannot certify accessibility, scientific accuracy, or print readiness.
-- It intentionally rejects safe but unnecessary features such as hyperlinks and
-  embedded files.
-- Password-protected/encrypted packages are rejected rather than decrypted.
-
-These limits are design boundaries, not invitations to bypass the checks.

package/skills/pptx-posters/references/security_validation.md

@@ -1,90 +0,0 @@
-# Security validation record
-
-Validation date: **2026-07-24**.
-
-## Baseline
-
-The repository `SECURITY.md` snapshot records **10 findings** for the former v1.2
-skill, with maximum severity **CRITICAL**:
-
-- three CRITICAL cross-file/environment/network transmission findings;
-- four MEDIUM credential, prompt, and environment-harvesting findings;
-- three LOW dependency, environment-file, and broken-reference findings.
-
-The affected implementation used two external schematic-generation scripts plus
-network, credential, environment-file, subprocess, and model behavior.
-
-## Remediation
-
-- Deleted both external schematic scripts and the unused HTML template.
-- Removed network/model calls, credentials, environment access, subprocesses, external
-  templates, mandatory figures, and cross-skill behavior.
-- Replaced the workflow with strict local JSON, exact source IDs, author approval
-  binding, optional hashed PNG/JPEG assets, and deterministic one-slide generation.
-- Added bounded ZIP central-directory, part-path, content-type, relationship, XML,
-  image-signature, macro, OLE, ActiveX, embedded-file, and external-link checks.
-- Added safe no-overwrite publication, lazy optional imports, exact dependency pins,
-  and AST policy tests that prohibit network, process, environment, executable
-  deserialization, and dynamic-code behavior.
-
-## Validation results
-
-- Agent Skills reference validator: **PASS**
-- Dependency-free CLI help checks: **PASS**
-- Synthetic tests with standard library only: **47 passed, 2 exact-pin tests skipped**
-- Exact-pinned round trip (`python-pptx==1.0.2`, `Pillow==12.3.0`,
-  `lxml==6.1.1`): **49 passed**
-- Generated PPTX reopen, deterministic hash, package reinspection, alt text, title,
-  language, layout, image inventory, and no-overwrite checks: **PASS**
-- Explicit AST parse with bytecode disabled: **14 Python files parsed**
-- Bytecode artifacts: **0**
-- IDE lints: **0**
-- Diff whitespace check: **PASS**
-- Documented local-path check: **PASS**
-- External Markdown links checked: **39, no failures**
-- Direct behavioral security scan: **SAFE, 0 findings**
-- Pull-request gate with `--fail-on HIGH`: **PASS**
-  - CRITICAL: 0
-  - HIGH: 0
-  - LOW: 2
-
-## Residual LOW findings
-
-The LLM-assisted pull-request scan reported:
-
-1. **Bounded resource use.** Full image decoding is capped at 100 million pixels;
-   archives are capped at 512 MiB compressed, 1 GiB expanded, 4,096 members, 128 MiB
-   per member, and 100:1 expansion. Repeated maximum-size local inputs can still use
-   material CPU/memory. These documented limits are accepted; callers should apply
-   an execution timeout appropriate to their environment.
-2. **Invented broken-path variants.** The scan claimed `templates/` paths and swapped
-   `assets/`/`references/` variants that do not occur in the skill. The deterministic
-   local-path test resolves every actual documented path and passes.
-
-Neither finding permits network access, credential access, code execution, macro
-activation, or overwrite. No CRITICAL or HIGH issue remains. The repository-level
-`SECURITY.md` is intentionally unchanged; its generated snapshot can update through
-the repository's normal scan process.
-
-## Reproduction
-
-```bash
-PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover \
-  -s tests/pptx-posters -p "test_*.py" -v
-
-PYTHONDONTWRITEBYTECODE=1 uv run --no-project \
-  --with "python-pptx==1.0.2" \
-  --with "Pillow==12.3.0" \
-  --with "lxml==6.1.1" \
-  python -B -m unittest discover \
-  -s tests/pptx-posters -p "test_*.py" -v
-
-uv run skills-ref validate skills/pptx-posters
-
-uv run skill-scanner scan skills/pptx-posters --use-behavioral
-
-uv run python scan_pr_skills.py \
-  --fail-on HIGH \
-  --output /tmp/pptx-posters-pr-scan.md \
-  skills/pptx-posters
-```

package/skills/pptx-posters/references/source_ledger.md

@@ -1,256 +0,0 @@
-# Source ledger
-
-Research cutoff: **2026-07-24**. Recheck live organizer, printer, package, and
-application guidance before production use.
-
-This ledger records the upstream basis for skill behavior. It is not a poster's
-scientific bibliography.
-
-Method: targeted `parallel-cli search` and `parallel-cli extract` queries restricted
-to the official domains cited below, followed by cross-checking canonical pages.
-Retrieval dates are stated where a page exposed no publication/update date.
-
-## Microsoft PowerPoint
-
-### Poster-specific product guidance
-
-- [Microsoft Create poster templates for PowerPoint](https://create.microsoft.com/en-us/templates/posters)
-  (official Microsoft Create).
-  - Describes editable PowerPoint poster/flyer templates and saving, printing, or
-    sending the result as PDF.
-
-Skill impact: confirms PowerPoint as a supported poster authoring format, but does
-not establish research-poster dimensions or printer requirements. This strict
-generator does not ingest downloaded templates or use the page's AI design features.
-
-### Slide dimensions and scaling
-
-- [Change the size of your PowerPoint slides](https://support.microsoft.com/en-us/office/change-the-size-of-your-powerpoint-slides-040a811c-be43-40b9-8d04-0de5ed79987e)
-  (Microsoft Support; checked 2026-07-24; no publication date exposed).
-  - Custom width/height each range from 1 to 56 inches.
-  - Units can be inches, centimeters, or pixels; PowerPoint converts them.
-  - All slides in a presentation have the same size.
-  - Maximize can cause content not to fit; Ensure Fit can make content smaller.
-
-Skill impact: enforce 1–56 inches, one slide, exact aspect ratio, explicit physical
-scale, and no reuse/resizing of existing content.
-
-### Export
-
-- [Export a presentation](https://support.microsoft.com/en-us/powerpoint/export-a-presentation)
-  (Microsoft Support; checked 2026-07-24).
-  - Standard is the option for publishing online and printing; Minimum size
-    prioritizes a smaller file.
-
-Skill impact: provide a manual export plan and require independent PDF/print checks.
-The scripts do not invoke Office or an alternative converter.
-
-### Accessibility
-
-- [Make your PowerPoint presentations accessible to people with disabilities](https://support.microsoft.com/en-us/office/make-your-powerpoint-presentations-accessible-to-people-with-disabilities-6f7772b2-2f33-4bd2-8ca7-dae3b2b3ef25)
-  (Microsoft Support; checked 2026-07-24).
-  - Use Accessibility Checker and Reading Order pane.
-  - Add alt text to visuals.
-  - Do not use color alone.
-  - Use sufficient text/background contrast.
-  - Use meaningful hyperlink text.
-  - Test with a screen reader.
-  - Recommends 18 pt or larger for ordinary slides.
-
-- [Rules for the Accessibility Checker](https://support.microsoft.com/en-us/accessibility/office-accessibility/rules-for-the-accessibility-checker)
-  (Microsoft Support).
-  - Includes missing alt text and logical reading order checks.
-
-- [PowerPoint PDF Accessibility](https://learn.microsoft.com/en-us/office/pdf/powerpoint/powerpointpdfaccessibility)
-  (Microsoft Learn; last updated 2026-05-12).
-  - Documents tagged-PDF behavior and applicable PowerPoint versions/channels.
-
-Skill impact: automate only structural checks; require final Accessibility Checker,
-reading-order, screen-reader, and exported-PDF review. The 18 pt recommendation is
-identified as slide-specific, not a universal poster minimum.
-
-### Fonts, pictures, and media
-
-- [Benefits of embedding custom fonts](https://support.microsoft.com/en-us/office/benefits-of-embedding-custom-fonts-cb3982aa-ea76-4323-b008-86670f222dbc)
-  (Microsoft Support; published 2026-05-04 in the extracted result).
-  - Embedding can preserve layout, styling, and characters when a recipient lacks a
-    font, but not all fonts permit embedding.
-  - Embedding only used characters limits later editing; embedding all characters is
-    the PowerPoint option intended for editing by others.
-
-- [Change the default resolution for inserting pictures in Office](https://support.microsoft.com/en-us/office/change-the-default-resolution-for-inserting-pictures-in-office-f4aca5b4-6332-48c6-9488-bf5e0094a7d2)
-  and [Turn off picture compression](https://support.microsoft.com/en-us/office/turn-off-picture-compression-81a6b603-0266-4451-b08e-fc1bf58da658)
-  (Microsoft Support; checked 2026-07-24).
-  - Microsoft documents High fidelity/minimal compression and a per-document option
-    not to compress images.
-
-- [Video and audio file formats supported in PowerPoint](https://support.microsoft.com/en-us/office/video-and-audio-file-formats-supported-in-powerpoint-d8b12450-26db-4c7b-a5c1-593d3418fb59)
-  (Microsoft Support; checked 2026-07-24).
-  - PowerPoint supports several audio/video formats and notes deprecations beginning
-    in version 2505 for older formats.
-
-Skill impact: the generator records font names but does not install or embed fonts;
-availability, embedding rights, substitution, and the exported PDF are checked
-manually. It accepts only fully decoded local PNG/JPEG still images, reports effective
-DPI, and excludes every audio/video or linked-media feature from its package profile.
-
-### Color API
-
-- [PowerPoint ColorFormat.RGB property](https://learn.microsoft.com/en-us/office/vba/api/powerpoint.colorformat.rgb)
-  (Microsoft Learn).
-
-Skill impact: author opaque sRGB colors, label PowerPoint as an RGB workflow, and
-block claims of CMYK readiness until printer-approved conversion/proof.
-
-### File formats and macros
-
-- [File formats supported in PowerPoint](https://support.microsoft.com/en-us/office/file-formats-that-are-supported-in-powerpoint-252c6fa0-a4bc-41be-ac82-b77c9773f9dc)
-  (Microsoft Support).
-  - Identifies `.pptm` as a VBA-containing macro-enabled presentation.
-
-- [Save a presentation that contains VBA macros](https://support.microsoft.com/en-us/office/save-a-presentation-that-contains-vba-macros-e6010530-f899-49a9-9fa5-78338a1c2580)
-  (Microsoft Support).
-  - Macro-bearing presentations require macro-enabled extensions such as `.pptm`.
-
-Skill impact: accept/generate only `.pptx`, then inspect content types and package
-parts rather than trusting the extension alone.
-
-## Office Open XML and packaging
-
-- [ECMA-376](https://ecma-international.org/publications-and-standards/standards/ecma-376/)
-  (Ecma International).
-  - Defines Office Open XML vocabularies, document representation, and packaging.
-
-- [ISO/IEC 29500-2:2021](https://www.iso.org/standard/77818.html)
-  (ISO).
-  - Defines Open Packaging Conventions for combining parts and relationships.
-
-- [Open XML SDK overview](https://learn.microsoft.com/en-us/office/open-xml/open-xml-sdk)
-  (Microsoft Learn).
-  - Connects the SDK and file formats to ECMA-376 and ISO/IEC 29500.
-
-- [IOpcRelationship::GetTargetMode](https://learn.microsoft.com/en-us/windows/win32/api/msopc/nf-msopc-iopcrelationship-gettargetmode)
-  (Microsoft Learn).
-  - Distinguishes internal package-part targets from external targets.
-
-- [PowerPoint `.pptx` extensions to Office Open XML](https://learn.microsoft.com/en-us/openspecs/office_standards/ms-pptx/efd8bb2d-d888-4e2e-af25-cad476730c9f)
-  (Microsoft Open Specifications; published protocol revision shown as 2024-08-20
-  during research).
-
-- [PresentationML OLE Object](https://learn.microsoft.com/en-us/dotnet/api/documentformat.openxml.presentation.oleobject?view=openxml-3.0.1)
-  (Microsoft Learn / ISO schema remarks).
-  - OLE objects can contain embedded or linked objects/controls.
-
-- [Presentation NonVisualDrawingProperties](https://learn.microsoft.com/en-us/dotnet/api/documentformat.openxml.presentation.nonvisualdrawingproperties?view=openxml-3.0.1)
-  (Microsoft Learn / ISO schema remarks).
-  - `p:cNvPr` stores nonvisual properties including the drawing description used
-    for picture alt text.
-
-Skill impact: bounded ZIP/XML inspection, relationship target/mode checks, rejection
-of embedded/active/external content, and standard alt-description markup.
-
-## Python package APIs and versions
-
-### python-pptx
-
-- [python-pptx on PyPI](https://pypi.org/project/python-pptx/)
-  - Current stable at cutoff: **1.0.2**, released 2024-08-07.
-  - Requires Python 3.8 or later.
-  - Described as creating, reading, and updating PowerPoint 2007+ `.pptx` files.
-
-- [python-pptx v1.0.2 repository tag](https://github.com/scanny/python-pptx/tree/v1.0.2)
-  (official GitHub repository).
-  - GitHub had tags through v1.0.2; the GitHub Releases list returned no published
-    releases during the 2026-07-23 check. PyPI release history is therefore the
-    version authority used here.
-
-- [Presentation API](https://python-pptx.readthedocs.io/en/latest/api/presentation.html)
-  - `Presentation()`, `save`, `slide_width`, and `slide_height`; dimensions are EMU.
-
-- [Shapes API](https://python-pptx.readthedocs.io/en/latest/api/shapes.html)
-  - `add_textbox`, `add_picture`, and explicit shape position/size.
-
-- [Text API](https://python-pptx.readthedocs.io/en/latest/api/text.html)
-  - Font sizes and text-frame behavior.
-
-Skill impact: exact pin `python-pptx==1.0.2`; use only documented creation, slide,
-shape, text, color, and core-property APIs. Alt descriptions are added afterward
-using standard PresentationML because the public python-pptx API does not expose a
-complete poster accessibility workflow.
-
-### Pillow
-
-- [Pillow on PyPI](https://pypi.org/project/pillow/)
-  - Current stable at cutoff: **12.3.0**, released 2026-07-01.
-  - Requires Python 3.10 or later.
-
-- [Pillow documentation](https://pillow.readthedocs.io/)
-  (documentation identified itself as 12.3.0 at cutoff).
-
-Skill impact: exact pin `Pillow==12.3.0`; bounded verification of local PNG/JPEG
-dimensions, mode, frames, and effective DPI. Heavy imports remain lazy so every
-CLI's help works without optional packages.
-
-### lxml
-
-- [lxml on PyPI](https://pypi.org/project/lxml/)
-  - Current stable at cutoff: **6.1.1**, released 2026-05-18.
-  - Requires Python 3.8 or later.
-  - The 6.1.1 release includes security-related fixes in bundled XML/XSLT libraries.
-
-Skill impact: exact transitive pin `lxml==6.1.1` for `python-pptx` generation.
-The dependency-free inspector still uses bounded standard-library XML parsing and
-rejects DTD/entity declarations before parsing.
-
-## Accessibility standards
-
-- [Web Content Accessibility Guidelines (WCAG) 2.2](https://www.w3.org/TR/WCAG22/)
-  (W3C Recommendation, 2024-12-12).
-  - SC 1.4.1: do not use color as the only visual means of conveying information.
-  - SC 1.4.3: 4.5:1 for normal text; 3:1 for large text.
-  - Large text: at least 18 pt, or at least 14 pt and bold.
-  - SC 1.4.11: 3:1 for graphical parts required to understand content.
-
-Skill impact: exact sRGB contrast calculations with usage-specific thresholds and
-mandatory redundant encoding. WCAG is used as a declared design target; no claim is
-made that a physical poster or PPTX is a conforming web page.
-
-## Palette authorities
-
-- [ColorBrewer 2](https://colorbrewer2.org/)
-  (Penn State/Cynthia Brewer project).
-  - Distinguishes qualitative, sequential, and diverging schemes.
-  - Offers colorblind-safe, print-friendly, and photocopy-safe filters.
-
-- [Paul Tol, Colour Schemes, issue 3.2](https://sronpersonalpages.nl/~pault/data/colourschemes.pdf)
-  (SRON/EPS/TN/09-002, 2021-08-18).
-  - Documents clear colour schemes intended to work for colour-blind readers and
-    gives scheme-specific values/order.
-
-Skill impact: explain scheme selection and caveats. No bundled palette is represented
-as universally accessible; rendered contrast and redundant encoding remain required.
-
-## Conference examples — not universal rules
-
-- [CSCW 2026 posters](https://cscw.acm.org/2026/posters.html)
-  (official event page checked 2026-07-24; its explicit 2026 important dates include
-  a 2026-07-10 camera-ready deadline).
-  - Allocated 48 × 48 inches; recommended no side over 45 inches, allowed up to
-    47 inches; stated A0 or A1 could be acceptable.
-
-- [IEEE DSC 2025 poster instructions](https://attend.ieee.org/dsc-2025/call-for-posters/)
-  (official organizer page).
-  - Required the physical poster to fit A1 space: 84.1 × 59.4 cm.
-
-Skill impact: use these only to demonstrate variation. The validator requires the
-actual event's confirmed rule and exact source ID.
-
-## Secure standard-library APIs
-
-- [Python `zipfile`](https://docs.python.org/3/library/zipfile.html)
-- [Python `xml.etree.ElementTree`](https://docs.python.org/3/library/xml.etree.elementtree.html)
-- [Python `json`](https://docs.python.org/3/library/json.html)
-
-Skill impact: no archive extraction; strict duplicate/non-finite JSON handling;
-bounded XML parts; DTD/entity rejection; no network, shell invocation, dynamic code
-execution, or arbitrary object deserialization.