Patch release completing the security follow-ups from the v6.3.1 report. Upgrading is recommended for anyone who runs the live preview or Confirm UI, or converts web pages with web_to_md.py.

Security

All five items were reported by Zick Sun as follow-ups to the v6.3.1 fixes and verified before shipping.

• Preview sanitizer hardening (2784f7a). sanitizeSvg() now keeps only an explicit allowlist of SVG element names in the SVG namespace, closing two residual gaps: null-namespace elements slipped through a short-circuit, and SVG-namespaced elements named like HTML breakout tags (div, iframe) became live HTML after innerHTML. Tab, CR, LF, and leading control characters are stripped from href values before the javascript: / vbscript: / data: check, matching what the browser URL parser does. Both gaps were already blocked by the Content-Security-Policy shipped in v6.3.1; that header remains a load-bearing control.
• DNS rebinding guard on both local servers (2784f7a). The live preview and Confirm UI servers bind 127.0.0.1 but accepted any Host or Origin. Requests now get 403 unless Host is a loopback name and, when present, Origin is too.
• web_to_md.py verifies TLS by default (31a20f2). Certificate verification was disabled at every call site. It is now on; --insecure turns it off with a warning for self-signed development hosts.
• web_to_md.py refuses non-public fetch targets (31a20f2). Redirects were followed with no validation, so a page that 302s to a link-local metadata endpoint or private address was fetched and saved. Every requested and final URL, for pages and images, must be http(s) and resolve only to public addresses. --allow-private-hosts opts back in for intranet or localhost pages you chose deliberately.

Other changes since v6.3.1

• Scripts: text width headroom applied per script segment with bounded CJK clause breaks (64b6583); slice_images names edge-wide key noise (ac93240).
• Workflow: Step 6 checkpoint aligned with the P05 early gate (3ad8052).
• Docs: PyMuPDF AGPL-3.0 license and PDF-only scope disclosed (b41ec1d); prompt audit manifest brought to zero findings.

Install

The ppt-master-skill-v6.3.2.zip asset contains only skills/ppt-master/ for agents that load the skill directory directly.

Patch release. Upgrading is recommended for anyone who opens the live preview (svg_editor/server.py) on projects that contain SVG from third-party sources.

Security

Two issues were reported privately by Zick Sun and fixed in 514596e. Thanks for the clear, verified report. Both require a malicious SVG to already be inside a project directory (for example from a third-party template pack, or a poisoned source document converted by the pipeline). Neither allows reading files outside the project; both servers keep binding to 127.0.0.1 only.

• Live preview sanitizer bypass (mXSS). sanitizeSvg() in the preview page compared element and attribute names case-sensitively on an XML parse, then inserted the result through innerHTML, which lowercases names. Uppercase ONERROR=, <SCRIPT>, and XLINK:HREF="javascript:" therefore survived the filter. Comparisons are now case-insensitive, elements outside the SVG/XLink namespaces are dropped, vbscript: is rejected alongside javascript: and data:, and a malformed SVG now shows an error instead of injecting the parser error document. The preview page also gains a Content-Security-Policy restricting scripts to same-origin files.
• Icon placeholder attribute injection. embed_icons.py interpolated fill, stroke, stroke-width, and transform from <use data-icon> placeholders into generated markup without escaping. A single-quoted value containing a bare " could inject a sibling attribute that the CLI then wrote to disk. The four attributes are now validated against strict grammars and every interpolated value is escaped. Legal values, including the matrix() transforms written back by the live editor, are unchanged; a regression run over an existing 50-page project produced byte-identical output.

Other changes since v6.3.0

• Templates: Z-CARE Rescue brand and duty-manual style.
• Video: keep the space between merged subtitle clauses (#283, thanks @MaxFreedomPollard).
• Scripts: slice_images.py keeps opaque key-hue foreground intact during pure-key despill.
• README: star history chart restored, trending badge added.

Install

The ppt-master-skill-v6.3.1.zip asset contains only skills/ppt-master/ for agents that load the skill directory directly.

Converter

• Native charts mirror the fallback drawing. Bar order, point markers and per-point colours, area fills without strokes, clustered gaps and overlap, and where a line starts inside the plot are all read from the authored SVG; sparse cell caches import as gaps; companion text is grouped with its chart so one animation moves the whole unit and sits on the fallback baseline. The chart frame grows past the plot so PowerPoint keeps the manual vertical layout instead of collapsing it.
• Native tables export unfilled cells as noFill, carry defaults.run colour into plain-text cells, let paragraphs cells inherit run defaults, and honour authored row heights over padding.
• Text width from real glyphs. Arial, Times New Roman, Georgia, Verdana, and Calibri (regular, bold, italic, bold-italic) are measured from a bundled per-glyph advance table (font_advances.json); monospaced faces measure as characters × fixed advance; wide faces (Arial Black) keep their factor. A mixed-case Arial line can now fill about 94% of its text frame before the wrap headroom applies, up from 85%, and the checker and the exporter agree on the same number on every machine.
• Export correctness fixes: hidden SVG elements and hidden clip shapes stay hidden, hidden groups keep their animation target, single-child group rotation is preserved, inline tspan dx is carried, root and native-gradient opacity apply, out-of-range shape frames and incomplete pattern fills are rejected instead of producing a file PowerPoint repairs, zero-width strokes export as no line, camera MPO JPEGs keep their primary frame, and image tools honour EXIF orientation.

Source conversion

• Excel values keep full precision, source encodings are detected, inline spacing and absolute links survive web pages, HTML comments are dropped, raw Markdown and plain-text URLs are saved verbatim, pdf_to_md keeps line-leading decimals, --no-images works for web pages, an extension-less -o becomes <name>.md, batch conversion never overwrites an input, and import-sources copies another project's files instead of moving them.
• The source converter's --help no longer needs optional dependencies installed (#282).

Templates

• apply_template.py installs selected Brand / Style / Layout / Deck workspaces into a project per the apply-template-workspace runbook: validation, library/explicit provenance, Layout over Deck, roster and asset copy, idempotent re-runs, and a §5.3 receipt.
• mbb-consulting, a new Style for strategy documents at document density — numbered exhibits with unit lines, a key-message column closing in an implication panel, five to seven modules per page, fixed page chrome, size anchors, fallback colours and typography — distilled from the EV market-priorities example. consulting-decision keeps its restrained method-first defaults.

Checker and authoring tools

• Chart/table parity findings that would break --native-charts-and-tables are tagged as export-blocking; parity honours number_format, exact ticks, style.body_text for first columns, the centred header default, and names the multi-column rect behind a whole-column fill.
• text_measure.py calibrate prints CAPS and DIGITS rates, an outline column, and merges --role; the width check reads inline hyperlink runs; validate resolves the real project directory; init resolves the projects root from the skill and checks the page count against the roster.
• Animation order: unlisted groups follow the nearest listed order instead of their SVG index; static-role chrome animates when the sidecar names it, only structural layers and the slide background stay fixed; list-groups names chrome ids.
• Slice diagnostics tell drift from overflow, keep the pure key, and flag backing panels; image search pages through a saved candidate pool; rotate_images reports failures.
• A Tencent Cloud TokenHub image backend (tencent, aliases tokenhub / hunyuan) joins the image generators (#279).

Prompts and rules

• Animation guidance: chrome is static by default and animates per page when named; Morph endpoints are groups fixed at first draw, continuity carriers are the default Morph; entrance order follows the reading path; illustration roles decide what moves.
• Text and layout guidance: bounds top and bottom edges are spelled out, role groups still declare bounds, the all-tspan first line carries inline emphasis, digits use the DIGITS rate, calibration rates are sample averages with a 5% margin, and repeated writing forms are treated as method-level at the early gate.
• Native data: data_labels type support, native objects never Morph-pair, row_heights includes the header row, borders.style form, defaults.cell, and the full chrome token list are documented where the exporter reads them.
• docs/rules/code-style.md §11 now allows unit tests under skills/ppt-master/scripts/tests/ on stated conditions (stdlib unittest, scripts only, in-test fixtures, no CI); the suite has 212 tests.

Examples

The examples site now holds 33 decks (471 pages), with the first decks driven by a spreadsheet source (Apple FY2025 operating review from XLSX + CSV), by a PDF source (the ResearchStudio-Reel paper reading, English, academic-research Style), and by bundled Style templates (Cloudflare outage postmortem, uv product launch, EV market priorities on mbb-consulting), alongside new photo-, data-, and illustration-led decks (Apollo photo essay, China 2025 economy briefing, pixel-art breakfast atlas, solar-terms long-form and story, tea A4 handout, heritage-goods moments grid, brutalist field guide, WebGPU Quick, banner and header sets). Six May-era examples were migrated to the current checker without regenerating them.

Community

• #278 (@WodenJay): wrapped Python daemon processes are verified on startup.
• #282 (@QiuLsG): source converter help stays dependency-free.
• #279: Tencent Cloud TokenHub backend.

Assets: ppt-master-skill-v6.3.0.zip is the skill-only tree for loading skills/ppt-master/ into any agent tool; the source archive carries the full repository.

Prompts

• One owner per rule. docs/rules/ownership.md states how ownership is decided and docs/rules/rule-owners.md registers every cross-file rule with its single owner; other files keep a one-line pointer. The same rule used to be restated in five to ten places (slot contract, Chart/Table reference, sounds, template discovery, size band, icons, reading mode), each drifting on its own.
• Shared planning core. references/plan-core.md holds the page-planning rules both routes read; strategist.md keeps only the confirmation surface, the three directions, and its artifacts; quick-generate.md §2 keeps only commands and contracts.
• Readable core files. executor-base.md, strategist.md, generate-pptx.md, quick-generate.md, image-generator.md, animations.md, create-template.md, and template-designer.md are rewritten in the catalog format the well-read files already used: fixed skeleton, short labeled paragraphs, one decision per example, exceptions as their own sentence. Every code span, number, and link was verified present before and after.
• One ordered per-page chain. Executor §2.2 lists the roughly ten decisions a page goes through, in order, from module line to coordinates, instead of scattering them across sections.
• Four overloaded terms renamed. §IX Layout → Composition; §VIII Layout pattern → Image pattern; "Structure decision" → "topology decision" (topology=yes|no); carrier now has one meaning. The checker reads the new column names and falls back to the old ones, so existing projects still validate.
• Vocabulary in SKILL.md, read by every route, defines the terms the corpus uses (Structure, Layout, mode, template, style, Reference, carrier).
• Fonts: each script names one concrete face, at most one Latin plus one CJK per role, no fallback list; the "at most four families" ceiling is back after being lost in the ownership pass.
• Dogfood follow-ups: data-pptx-bounds is defined as the union of child geometry plus margin, recomputed whenever a size or line count changes; roles without a <role>_family fall to body_family (title-family roles to title_family); the role scan names chapter numerals and hero figures as display roles that recur per anchor page; downscaling to the planned size is an allowed image derivative; a single character-only look is allowed for CJK lettering; preset shapes with repeated vertices are registry output and are not to be "cleaned"; Quick's closing checklist gains the motion gate.

Scripts and checker

• P05 early gate replaces the first-page gate on both routes (svg_quality_checker.py --stage early); rosters of six or fewer pages skip it. Checker runs follow a gate point or the end of one consolidated repair pass.
• Presets gain a carrier-and-field family in the receipt, the routing trigger, and §3.0.
• project_manager.py init is idempotent on names that already carry a _YYYYMMDD suffix (no more _2 directories).
• svg_quality_checker.py --json semantics are stated everywhere the command appears: it writes the report the exporter reads; stdout stays the human summary. The exporter's repair hint now includes --canonical-authoring; the checker flag set is aligned across the quick reference, Quick §4, and the exporter message.
• source_to_md.py -o <dir> with a single input writes into that directory instead of treating it as a file path.
• image_gen.py --manifest validates each request's aspect ratio against the selected backend before spending a generation.
• image_treat.py --fit WxH downscales an image to fit inside a box (new).
• import-sources log wording matches what the tool does (no false "namespace" claim).
• Tool behavior that lived in prompts moved to scripts/docs/ (Chart/Table payload grammar in native-data.md, exporter flags, image tools, import semantics); the prompts point there.
• svg_to_pptx.py completes a preset's avLst when a placeholder or roundtrip source leaves it partial, so PowerPoint no longer offers to repair the deck.

Docs

• docs/rules/prompt-style.md now covers every runtime file and is prescriptive: recall before craft before boundary, sentence and paragraph limits, one meaning per term, catalog exemplars.
• docs/rules/prompt-layers.md adds Procedure as a fourth content layer.
• conversion.md sidecar naming corrected to <stem>.

What's next

Maintenance continues as report-driven fixes from real generation runs. No prompt or workflow restructuring is planned.

Prompts

• Three ownership tiers (docs/rules/prompt-style.md §4.1). Plan-only: anything that needs a prepared file, holds across the whole roster, needs user confirmation, or comes from source semantics. Execution-only: anything judged with the objects on the canvas — carrier mix, geometry, presets, composition, treatment. Reference: a starting sketch the Executor adjusts freely, binding only when labeled (binding). Depth test: one plan given to two Executors yields the same content with different looks.
• Relationships joins every §IX Slide block — the page's semantic units and their order / link / parent / membership / contrast / overlap, written by the plan and consumed by the Executor's Structure decision. project_manager.py validate reports a missing line like a missing Audience move.
• The Executor core is re-cut: the Page Expression Core (typographic features, native contour families, the everyday device menu, layout structures, page recipes, image composition families, the visual job router, everyday effects) comes first; then Blueprint Intake; then per-page composition, the technical contract, and checkpoints. Default-pipeline mechanics moved to generate-pptx.md Step 6 as their single owner.
• Planning reads less: the image-layout catalog and placement geometry leave the planning batch (they are the Executor's and load on any image page); Strategist sheds execution vocabulary and internal duplicates. Planning set 82.4K → 73.6K tokens, Quick 78.6K → 70.4K.
• Absence needs a reason. The final carrier-receipt review asks, per family or page, what carries the job when the receipt shows no presets, no inline emphasis, no gradients, or no filters — or fewer preset/connector pages than pages declaring a relationship. Style, speed, restraint, "text was enough", or "it is editable anyway" are not answers; a missing answer is repaired. Choosing not to use a device stays valid — only an unstated reason is not. Four premium devices (gradient or glow display text, accent gradient rule, elevated primary object, duotone / brand-wash image) join the everyday menu as capability recall.
• Content fidelity clarified: quotation marks and first person only for wording the source gives as a quote; an organizing framework the source does not state is labeled as the deck's reading; when text does not fit, switch texture before dropping a qualifier.
• Lock prohibitions are the user's: spec_lock.md forbidden holds the technical baseline plus prohibitions the user stated in their own words, quoted verbatim and tagged (user); a confirmed visual_style_behavior binds as identity prose and is never projected into a prohibition.

Workflow

• Uninterrupted page loop. Routing triggers are evaluated once over the whole roster before P01 and every triggered module is read in that batch; a page reaching an unforeseen capability reads its module then. The first-exercise page gate is gone — P01 gate, then pages, then the final gate.
• Text width calibrated once, before P01: text_measure.py calibrate <project> [--outline] [--role NAME:FAMILY:SIZE] reports ≈ chars per 100 px per role (CJK and Latin, the checker's own estimator) and each role's longest planned §IX line, written to validation/text_calibration.json. Later pages estimate by arithmetic and measure nothing.

Scripts and checker

• The carrier receipt gains an Effects: line — inline emphasis runs, gradient uses, filter uses, text effects — informational, never a quota.
• validate checks the per-slide Relationships line and, on versioned locks, the (user) tag on non-baseline forbidden rows (legacy marker-less locks are untouched).
• The image upscale advisory fires only above 2.0× source scale (about 3× on a 1080p projector) and says so; smaller upscales are no longer reported.
• Preset exit clauses ("no preset quota", "zero preset use proves nothing", "a neutral primitive when neutrality is useful") are removed; a directional or step relationship drawn as a hand path where §3.0 names a preset is a receipt contradiction to repair.

What's next

Continuous generation testing against these prompts; report-driven fixes only. Early runs show stronger cross-page consistency with the uninterrupted page loop and pre-P01 calibration.

Prompts

• Every prompt file rewritten contract-first, then craft. Each file states the minimal form the model must write, then the design judgment; anything the SVG standard already enforces is no longer restated. Section numbers are stable, so cross-references from earlier notes still resolve.
• Three content kinds, one owner each (docs/rules/prompt-layers.md). Craft and the minimal contract stay in references/; enforced grammar, importer behavior, and tool procedure moved to scripts/docs/ — svg-contract.md, svg_editor.md, narration.md, template-tools.md, and a sidecar field reference in pptx-animations.md.
• Aesthetic defaults and everyday effects are back in the Executor core. The 60-30-10 proportion, 4.5:1 contrast, hue count by encoding, single light source, felt-not-seen alpha, one weight tool per container, dash presets, and the XML for softShadow, titleGlow, field, and scrim now live in executor-base.md and are usable without loading svg-effects.md. The Strategist keeps contrast/concord font pairings, PPT-safe faces, and industry color anchors.
• Sizes (tiktoken o200k_base, audited by prompt_audit.py): corpus 345K → 233K; Default planning bundle 117K → 82K; Quick 129K → 78K; resident Executor core 70K → 33K; Create Deck 76K → 43K.

Workflow

• Planning reads everything; execution loads on triggers. The Executor's resident core is executor-base.md, shared-standards-core.md, semantic-svg.md, the complete preset vocabulary, and the confirmed mode / visual-style catalog file (a custom direction without references reads none). executor-structure.md + topology-assembly.md, native-shape-authoring.md, and svg-effects.md load the first time a page needs them, on the triggers named in the routing table, and each page reports a P<NN> modules: line.
• Text width is calibrated once, then estimated. One representative line per role is measured before P01; every later page sizes its zones by that per-font arithmetic, writes the sentence first and fits the zone to it, and never trims wording to satisfy an estimate.
• Font delivery target is stated where the Strategist reads it. Faces default to Windows Microsoft PowerPoint unless the user or template names another target; the authoring host's installed fonts never select a face, and PingFang SC / Heiti SC / Songti SC are preview aliases, not named faces.

Contracts and docs

• native-data-interface.md, spec_lock_reference.md, beautify-pptx.md, and create-template.md state their exact field grammar (finite x/y vs ≥1 EMU sizes, zero-based idx, camelCase read aliases, P + at least two digits page keys, Hans/Hant/Jpan/Hang script tags, display-name provenance).
• docs/technical-design.md and the compatibility router describe the trigger-loaded modules.

What's next

Repeated deck generation on the slimmed prompts, and prompt changes driven by what those decks show. Template creation and native-editable PPTX editing stay in maintenance until then.

No CLI flag, file format, or export behavior changed in this release.

v5.0.0 replaced heuristic recall with vocabulary-led selection. This release fixes what that exposed in practice: decks that came out visibly plainer than the vocabulary allowed, text that overflowed its boxes, native charts and tables that drifted from their SVG previews, and an existing-deck path that patched OOXML instead of round-tripping it.

Generated decks stopped getting plainer

Six consecutive Default decks used zero native presets, zero Boolean geometry, zero filters, and almost only rectangles and lines. The causes were in the prompts, not the capability, and are removed:

• Plainness exit clauses are gone from the always-loaded Executor core and effects reference ("plain construction remains valid", "keep peer grids flat", "add no effect family", "lightest sufficient boundary"). Export mechanics are untouched and no quota or minimum shape count is added.
• The style index no longer maps topics to restrained styles. Its "Typical context" column is dropped; a topic never selects a row.
• Zero-image exit clauses are removed across Strategist → Step 4 → Executor. Text-only sources now acquire web mood/scene images and use icons when the page benefits, instead of defaulting to omission; none remains legal and exclusive.
• Stage 2 directions are catalog-informed again. A fresh-session control deck showed that authoring directions before opening any catalog produced restraint-only directions with explicit decoration bans, and every page collapsed to photo + text + two rules; the revert restores the only channel that put carrier vocabulary in front of the Strategist at direction time.
• Directions are written as what a page uses, not as a look. Cards, icons, colour chips, and soft shadows are legitimate carriers rather than "web look" markers; an everyday device menu returns as reference vocabulary.
• Capabilities are announced, not taught. Icon library and lettering guidance state what exists; page fit decides use. Strategist deliberation mandates are demoted to defaults and references, and docs/rules/prompt-style.md now states the admission criterion for a prohibition: only what affects SVG validity or PPTX export may be a hard rule.

Text fits its box

• text_measure.py exposes the checker's width estimator at authoring time (measure, wrap, box), so authors calibrate one representative line per text role before writing coordinates instead of bouncing off the bounds gate.
• The checker's text-bounds blind spots are closed. The canonical "first line + positioned tspans" paragraph form is estimated instead of reported as unverifiable; DrawingML wrapping headroom applies to module bounds; overlapping direct-root modules (>1 px on both axes) now fail.
• Overflow diagnostics carry arithmetic: per-character width at that size and how many characters fit the container.
• wrap matches the checker's headroom, so a wrapped paragraph passes the gate it was wrapped for.
• Font stacks export correctly. A named CJK face now serves Latin glyphs when no named Latin face precedes it; "Microsoft YaHei, sans-serif" no longer sends digits to Segoe UI. How a font-family stack maps to PPTX faces is documented.

Native charts and tables match their previews

• Parity is projected, not assumed. Twelve objective checks compare the marker JSON with the SVG fallback (header bands, column fills, first-column emphasis, border topology, legend coverage, explicit text/axis/grid colours, exception point colours, plot area, treemap tile sequence). They are advisory in the normal gate and fail closed in --native-charts-and-tables export preflight.
• Exporter defects fixed: uniform table borders no longer draw diagonals in every cell; ChartEx charts no longer emit an empty title (rendered by PowerPoint as an automatic title) or a hardcoded "Series 1".
• Round-trip regressions: the original table payload survives marker validation; update_spec.py re-stamps native fallback baselines after a deck-wide colour or font substitution, so the final gate no longer reports stale markers; merged-cell blanks are judged on the authored rows; run-level table styles participate in parity.
• Bundled chart/table prototypes carry stamped baselines.

Edit Native PPTX

• One route for existing decks. Import with pptx_to_svg.py --roundtrip, plan with an optional page_plan.json (select, reorder, repeat, or omit source slides), edit only planned pages, overlay notes/narration/timings/transitions, export with svg_to_pptx.py --roundtrip. The export receipt reports passthrough, cloned_passthrough, patched, and rebuilt counts.
• Compact semantic authoring workspaces: imported decks and mirror templates share one new-only workspace contract; native tables normalize to semantic-table v2; complex vector decorations extract on demand; source-backed objects compact to a source-proxy contract.
• svg_authoring_view.py --adopt-object copies an object across pages with effective inherited style and composed transforms; svg_quality_checker.py --roundtrip gates edited-text capacity on the resolved roster.
• Adversarial review and three real-deck dogfood rounds closed defects around changed resources, inherited root attributes on rebuilt pages, notes-master discovery, externally linked pictures, shapes without ids, duplicate relationship ids, slide-jump remapping, and page plans that drop slides owning media.

Planning and Quick

• design_spec_depth (Stage 2, default brief): writing the full Design Spec cost about a quarter of output tokens, most of it page copy the same context rewrites minutes later as SVG. brief keeps the outline style; complete is forced under split or refine modes. Spacing anchors and neutral colour roles that had been lost across refactors are restored.
• Quick preserves explicit template structure: lockless Quick infers flat vs structured packaging from the complete SVG roster and validates all-or-none Master/Layout metadata.
• Stage 1 recommends a page range; Stage-2 candidate text is authored once in the confirmed UI language.
• Canonical compact SVG authoring is the source form for direct generation and PPTX-derived templates; the --canonical-authoring gate is advisory for authored pages (the normalizer is named) and blocking only for template workspaces. --stage page checks one authored SVG. A missing pptx_structure.mode defaults to flat.
• spec_lock image rows no longer require pattern=; a confirmed icon library is materialized as a synced project pool; pptx_to_svg restores blank placeholders on re-import; slice failures sample the real key colour.

Repository

• Prompt audit manifest registers Quick load sets and 22 authority edges; cross-runtime drift found by a full prompt audit is repaired in 24 files.
• render-batch JSON fields and table align/valign values are documented; the FAQ and README (en/zh) follow the route change.

Full changelog: v5.0.0...v5.1.0

git log origin/main..HEAD --oneline   # check for unpushed commits first
git fetch origin
git reset --hard origin/main
rm -rf examples                       # no longer tracked; remove the leftover directory
git reflog expire --expire=now --expire-unreachable=now --all
git gc --prune=now                    # without this the old objects stay and the size never drops

v4.8.0 built out the image path. This release changes how the system chooses — across native shapes, charts, tables, sounds, layouts, and imagery. The old pattern was a mandatory recall step followed by heuristic matching: read the catalog, then guess which entry fits. That produced two failure modes at once — pages that reached for a preset because recall demanded it, and pages that settled for a neutral box because the heuristic found nothing. Both are gone. Every catalog is now a complete vocabulary the author reads as a map of what is expressible, and selection is decided by semantic fit at page scale. Nothing is selected because a step required it, and nothing falls back to neutral before fit has actually been tested.

Vocabulary-led selection replaces heuristic recall

• The chart, preset, table, and sound catalogs are now complete maps. Each one documents the full expressible set rather than a keyword-searchable subset, so the author decides from what the system can actually express instead of from what a lookup happened to surface.
• Mandatory recall was removed as a gate. Recall used to be an obligatory step that a page had to pass through, which pushed pages toward using a preset whether or not one fit. It is now a reference the author consults when the page has a shape question to answer.
• The Visual Job Router became recall, not a gate. Same correction, applied to effects: the router informs the decision rather than standing in front of it.
• Semantic fit is required before a neutral layout. A neutral container is a legitimate answer, but only after fit has been tested — not as the default landing spot when nothing obvious matched.
• Preset discovery is semantic and page-local. Discovery runs against the page's own content and geometry rather than deck-level heuristics, and the inspection path is execution-safe and shell-safe (previously it could break on shell metacharacters in page content).
• Lettering and illustration planning follow the same rule. Image carriers are selected by what the page needs, not by page role or by which capability happens to be available.
• Style guidance no longer narrows capability. A resolved visual style expresses preference; it does not remove carriers from consideration. A restrained style still reaches for a photographic or lettering carrier when the page calls for one.

Page geometry as an authoring decision

• Compound page geometry is authored, not assembled. Pages that combine multiple shape systems are designed at page scale, with the geometry decision made before the parts are chosen.
• Page geometry is separated from relationship topology. How elements sit on the page and how they relate to each other are two decisions; conflating them produced layouts where the diagram's logic dictated the composition.
• Preset selection moved into authoring. It belongs where the page is designed rather than in a preparation step that runs ahead of it.
• Compact preset atoms are exempt from root-bounds checks, with the bounds contract documented — the checker previously flagged legitimately small native atoms.
• Inline math reserves structural height, so a formula set inline no longer collides with the line box around it.
• Carrier use and batch native presets are exposed to the author, so a page can commit to a carrier and generate its native parts together.

Image generation

• ChatGPT image API models are supported as a backend.
• Gemini reference-image editing is supported — an existing image can be passed as a reference rather than described from scratch.
• Illustrated icon slices can be generated as a family and sliced to individual transparent elements.
• Backend failures stop being retried when they are permanent, and a global backend failure halts the manifest batch instead of grinding through every remaining prompt against a backend that is down.
• The MiniMax backend handles the documented image_urls response shape it actually returns.

Templates and workflow

• Template kinds compose within one project workspace — a project can hold more than one kind, with the multi-kind workspace contract documented.
• Create Template loads the shape vocabulary before contours are chosen, so template geometry is decided against the full expressible set.
• Page carriers are resolved before resource preparation, so preparation serves decisions already made rather than guessing what will be needed.
• Role-owned capability knowledge is preloaded, and the boundary between Strategist advice and Executor authority is stated explicitly.
• The page-count recommendation defaults to a range rather than a single number, since the right length is usually an interval.
• The three recommended directions are free of catalog framing — they are design directions, not catalog entries dressed up as choices.
• PyYAML is declared as a dependency for template registration.

Failures that used to pass silently

• Four swallowed conversion failures now surface. Source conversion could fail and report success, leaving an empty or partial document downstream.
• The SVG editor stops reporting silent failures as success.
• An empty icon search says so instead of returning nothing that reads as a valid empty result.
• SVG documents that start with an XML declaration are detected during finalization rather than falling through the format check.
• Text width no longer overestimates halfwidth forms and CJK bold, and module bounds are judged against real glyph width — both produced spurious overflow reports.
• Quick reads the signals the scripts already emit, instead of re-deriving state that was already reported.
• Supported native objects default to dormant markers, so a deck carries the markers without activating behavior nobody asked for.
• Runtime paths are anchored to the installed skill root, which matters for the ZIP and plugin installs that have no repository around them.

Repository

• Example decks moved to their own repository and the history was rewritten to remove them — see the note at the top of these release notes for what that means for an existing clone.
• Four selection-level authoring defaults were restored in svg-effects.
• Documentation was reconciled against the code: broken procedures repaired, contract drift settled, missing authority edges added, icon confirmation and brand resource policy aligned, and the FAQ answering the questions users actually asked.
• Parameter refresh from PR #268.

Full changelog: v4.8.0...v5.0.0

v4.7.0 went deep into PowerPoint's own object model. This release turns to the image path — where a deck's pictures come from, what they are allowed to be, and how they get composed into a page. AI imagery stops being a per-page spot illustration and becomes a composition system: coherent element families, transparent cut assets, and hand-rendered lettering that the page can build around. Alongside it, the formula profile grows from a hand-picked LaTeX subset to the documented Microsoft 365 one, and the PPTX → SVG direction learns to bring back motion and math instead of silently dropping them.

AI imagery as a composition system

• Illustration assets are now composable across the deck. Both runtimes can plan a coherent family of elements — chrome, anchors, figures, accents — batch-generate them on one sheet, and reuse them across any suitable slide, instead of treating each page's picture as an isolated spot.
• Decorative lettering is a first-class carrier. Artistic lettering is prepared as an image asset, batched by artistic treatment into sheets, and sliced to transparent elements. Native WordArt stays out of scope and ordinary editable text remains the fallback. A page that needs a real heading keeps its native title, with the lettering acting as its display layer — the two coexist rather than compete.
• Eligibility is decided by criterion, not page role. The trigger used to scan only cover and divider wording. A dish name, exhibit name, year, hero number, or pull quote on a content page is often the more stable string, and set over photography it is exactly where native type reads pasted-on. The rule is now the two questions that actually decide it — is the wording stable, and would an artistic treatment communicate better — with length, line count, and page role no longer filtering candidates. Use stays selective: one small coherent set per deck, never a coverage quota.
• Transparent slicing recovers clean alpha. Sheet slicing keys off an explicit pure-RGB chroma key, removing spill while preserving antialiased edges and translucent effects. --strict-alpha validates the complete cell boundary and fails closed; without it the legacy warning-only behavior is unchanged. When keying visibly did not take — corners still opaque after --alpha, or --trim removing nothing on either axis — the run names the sampled color and points at --bg / --tolerance rather than quietly shipping a visible box onto the slide.
• Three new composition patterns and four recipes. A curved panoramic photo wall built from precomputed 2D contours (never shear or skew), a glyph-shaped picture defaulting to the editable text picture fill, and a registered device/frame mockup — plus ceremonial fan and arc strips, folded/louvered same-source strips, the bento field combination, and a staggered photo strip. Every form stays natively editable.

Image sourcing follows the task, not the tooling

• The resolved visual style no longer decides the image source. In a dogfood run every image on the deck resolved to AI illustration because the style had already answered the source question — including externally verifiable heritage architecture. Per-image source is now a mandatory decision in both runtimes, never inherited, and a deliberate non-documentary choice for a verifiable subject has to be stated.
• Availability no longer decides fit either. Zero-config web acquisition stays active when AI or keyed providers are unavailable, and a callable generator is used proactively when it serves a planned visual job — the recommendation follows the communication need rather than which credentials happen to be present.
• Web image search reviews candidates on thumbnails, in isolation. Explicit query variants are aggregated and deduplicated across providers, eight preview thumbnails are saved per page, and originals are downloaded only after selection. The multimodal inspection runs as its own bounded stage so candidate images stay out of the main generation context, with a strict metadata-ranked path for agents without vision.
• AI capability is resolved at execution, with per-runtime recovery. Planning no longer runs backend or host-tool preflight checks. When automation fails, Default asks for retry, manual fulfillment, or cancellation of the affected images; Quick replans without AI and discloses every fallback. Needs-Manual is reserved for explicit manual selection and blocks export until the required files exist.
• Twelve image backends were realigned to current provider contracts — retired defaults replaced, provider-specific size, ratio, endpoint, and payload handling corrected, and incompatible model overrides rejected instead of silently applying the wrong schema. --list-backends now reports the effective configuration and whether it came from the process environment or a file, with credentials still hidden.

Native formulas: the documented Microsoft 365 profile

• The LaTeX profile now covers what Microsoft documents, not a hand-picked subset — the documented commands, environments, macros, colors, and normalizations, plus mhchem. Out-of-profile input still fails closed rather than degrading silently.
• The compiler was split into focused modules — parser, AST, profile tables, OMML emitter, and run-property merger — with marker styling preserved on math runs and structural controls, and final OMML resource limits enforced.
• Superscript and subscript export as native text runs. Direct super / sub baseline shift on a tspan lowers to real DrawingML baseline offsets without changing font size, with tspan ownership preserved through finalization and inline-formula conflicts rejected.

Native shapes and the reverse loop

• A project-authored preset shape can carry one registered shadow or glow through the canonical --filter-id authoring surface, while remaining one editable native shape. Connectors, ordinary group filters, child filters, and multi-effect graphs stay closed.
• PPTX → SVG reconstructs supported slide transitions — effects, options, and timings recovered against the current registry, with internal WAV transition sounds extracted and published collision-safe. Unsupported carriers are diagnosed in tolerant mode and rejected in strict mode.
• Finite object animations come back too. Registry rows map to unique top-level SVG group targets, restoring effect options, pane order, Start mode, duration, relative delay, and trigger shapes. Duration-less, advanced, build/media, and unmapped timing stays diagnosed and direct-preserved rather than normalized into something it isn't.
• Formulas survive the import. Validator-clean block and inline OMML rebuilds as canonical formula markers; unsupported formula content is retained through diagnosed fallback and fails in strict mode. Unreconstructed transitions and object timing are reported per source slide.

Source intake

• Topic Research can retain a webpage as a source package. Each adopted URL or preconverted package is imported exactly once, its companion images counted as source-extracted inventory rather than web acquisition, with expected / imported / failed research sources reconciled.
• Fact URLs are provenance, not an import queue. Research URLs are no longer expanded during import; adopted page packages are fetched on demand, and retained-page images are a reviewed one-at-a-time fallback rather than a pool.
• Fonts resolve against the delivery target. Unspecified delivery now defaults to Windows PowerPoint using the deck locale, authoring-host fonts are limited to SVG preview and measurement, and Noto Serif CJK SC maps to SimSun.

Repository

• Agent-facing Markdown is single-language per file, including the rules themselves. A few instructions were written in Chinese inside otherwise English files, which biases output language and quietly overrides the "match the user's language" discipline. Those are translated, and docs/rules/language.md states the rule.
• The skill description covers a wider set of intents and states skill-root provenance, from @Fro2en12's PR #267.
• Roadmap corrections: the accessibility row's alt-text premise, the logo row against shipped brand assets, the reading-path row's actual carriers, missing coverage-map rows, and slide-number / footer fields settled as a boundary.

Full changelog: v4.7.0...v4.8.0

v4.6.0 opened a new input with page-image reconstruction. This release goes the other way — deeper into PowerPoint's own object model. Two things a deck could previously only fake are now real native objects: formulas are editable PowerPoint math instead of pictures, and hyperlinks are real click relationships instead of styled text. Both round-trip.

Native formulas

• LaTeX compiles to editable PowerPoint math. A strict LaTeX subset is validated and compiled straight to OMML — no Pandoc, no image rendering, no external service. Formulas export as Office 2010+ TextMath in both flat and structured packages, and invalid input fails closed rather than degrading silently.
• Inline math lives in the paragraph it belongs to. Same-paragraph formulas compile to inline m:oMath and are emitted as styled math runs inside the surrounding DrawingML paragraph, so a sentence with a symbol in the middle stays one sentence. Standalone block formulas remain available; the Executor chooses ordinary text, inline math, or a block depending on the content.
• This is now the default path, not an option. Formula policy choices and image-rendering resources are gone from both Default and Quick generation. Exact mathematical content stays owned upstream, and one shared marker contract covers both forms. latex_render.py remains only as a standalone legacy raster utility for anyone who still wants a picture.
• The SVG preview is authoring-only. No formula image fallback is emitted. PowerPoint 2010+ is the supported target; non-PowerPoint clients are outside the contract.

Native hyperlinks

• Links are authored with ordinary SVG <a href>. Whole objects, inline text runs, and formulas can all carry a link, and each lowers to a real PowerPoint click relationship rather than blue underlined text.
• Same-deck navigation works, not just external URLs. A link can target another slide in the same deck, and those targets are remapped when slides, layouts, and masters are cloned — failing closed when a target is ambiguous rather than guessing.
• Links survive the round trip. Supported click links are reconstructed on PPTX import, linked images and table cells are preserved through Markdown extraction, and Fill Native PPTX retargets same-deck links unambiguously.
• Validation is fail-closed on URI safety, action ownership, relationship mode, and final slide-roster membership. An actionButton* preset still contributes visual geometry only: appearance alone never implies an action, which keeps the rule that generated decks do not invent behavior nobody asked for.

Native charts

• Opt-in native charts keep the layout they were drawn with. Plot-area geometry is emitted as manual layout from the authored slide coordinates instead of collapsing to PowerPoint's automatic placement, and bounded titles are preserved as editable companion text boxes.
• Horizontal bar axes and doughnut hole sizing are supported, and the authoring contract now documents absolute plot-area bounds, the automatic-layout fallback, and bounded title/subtitle constraints.

Roadmap

• The roadmap is now a coverage map organized by the four layers of a presentation — visible objects, composition, behavior, and document structure — with a status on every row. It is written as a map rather than a backlog: a settled boundary reads as a decision, not a debt, and the statuses that describe a decision are separated from the ones that describe an open question.
• Several rows were understating what already exists. Connectors, SmartArt, and hyperlinks each recorded only the authoring side of a capability that was already working on the read or preserve side. Those are corrected.
• Scope decisions are on the record with their reasoning. Arbitrary video, background music, OLE objects, and 3D models are Not planned, each stating that media and objects already present in a source deck are preserved unchanged. Endpoint binding for newly authored connectors was evaluated and declined, because identifying which lines are real edges is an intent judgment that no geometric tolerance settles.

Full changelog: v4.6.0...v4.7.0