The tool reads exactly two explicitly named local files and writes only three fixed output basenames. All input content, including official-source data, prose, URLs, and keys, is data with no authority to invoke code or change options. Product modules contain no network, process execution, dynamic import, eval, provider adapter, or telemetry capability.

Inputs resolve through explicit path symlinks to recorded real paths and regular-file identities; there is no input-tree search or claimed confinement root. The bounded handle reader stops at N+1, strict UTF-8 refuses bad byte sequences, depth is checked before parsing, and duplicate-key/node/record limits refuse incomplete evidence. Raw parser windows, filesystem messages, private refs/notes, absolute paths, and untrusted character-unit disclosure oracles are never emitted. Reports use fixed logical roles with numeric source positions.

Whole-index validation prevents dropped dataset evidence from making an unknown technique comparison appear complete. Entire activity rows are validated before counting. Detection unknown is separate and always incomplete. All incomplete Navigator layers omit every score; unusable datasets produce no invented layer/version. Observations, subset membership, note availability, and provenance declarations never establish whole monitoring capability or authenticated dataset origin.

Every reserved output passes the locally copied catalog guard: lstat final destination before following it, real parent containment under the real selected output directory, all named/resolved input targets including dangling symlink chains, dev/ino equality, and stored reader identities. Missing/uninspectable input targets with a case-variant reserved basename in the same real parent are conservatively refused, including on case-sensitive systems; this prevents creating an input alias where no inode existed to compare. Existing distinct files remain governed by their real identities. Preflight inspects every reserved name before writing any artifact. Existing files are never overwritten; exclusive/no-follow opens reject planted final entries. Mode 0600 protects generated observations by default. No destructive auto-fix or cleanup of user files exists.

The output directory must be operator-controlled. Exclusive final opens do not provide a portable dirfd-based defense against a hostile concurrent ancestor-directory substitution. Multi-file writes are not atomic; an I/O/deadline error may leave partial new files. The terminal stdout report then states incomplete, stderr says the export did not complete, and the caller must use a fresh directory for retry. Preflight may leave an empty newly created safe directory. The deadline is cooperative and cannot preempt synchronous JSON parsing or blocked I/O.

Test processes deny network before importing code and preload denial in every CLI child. Controls use a data URL and a null-receiver socket call, not a real endpoint/listener. Tests and packaging use local fixtures and Node built-ins. Adapted local Edilec components: the JSON duplicate-key/precision scanner from Incident Severity Normalizer, and the catalog assertWritableDestination guard. Their MIT ownership remains intact; no MITRE implementation code or official dataset is bundled.