9. Security & privacy considerations

Importers MUST treat all content as untrusted text: no code execution, no active Markdown/HTML content, size limits on documents and media.
data: URIs and bundle members MUST be validated against declared mimeTypes.
Exporters SHOULD default to including provenance but make it visible: Tier 3 raw responses can contain the entire prompt, and agent configurations can contain private system prompts. Both MUST be excludable at export time.
Hash verification failures on import are informational, not fatal — the tree still loads, flagged as unverified.