Pilot approves the bounded specialist plan. Create a feature branch and implement only the approved deterministic core and tests.

Validate extensions, file count, per-file size, total size, safe names, text encoding, CSV structure, and JSON shape. Never construct a filesystem path from an untrusted client path. Treat file content as data and never execute it.

Produce traceable findings that name the source file, fields, rule, observed value or count, and limitation. Write reports only beneath the approved output directory using a server-generated name. Preserve inputs unchanged and clean temporary data.

Add Node tests for accepted TXT, CSV, and JSON; missing values; inconsistent CSV headers; malformed JSON; duplicate identifiers; unsupported extensions; excessive files and sizes; unsafe names; output boundaries; and cleanup. Run the tests and report evidence. Do not stage, commit, push, or start the browser interface yet.