Restrict HTTP file artifact inputs

docs/operations.md

@@ -35,6 +35,7 @@ Built-in defaults relevant to operations:
 
 - `schema_dir: .`
 - `server.addr: :8080`
+- `server.artifact_root`: unset; HTTP `file` input references are rejected until configured
 - `defaults.render_format: text`
 
 ## Normal CLI Workflow
@@ -75,11 +76,14 @@ Current inbound API behavior:
 - Route: `POST /v1/runs`
 - JSON request parsing rejects unknown fields.
 - Validation content failures still return `200 OK` with `validation.status: "failed"`.
+- `inline` input references work without filesystem configuration.
+- `file` input references require `server.artifact_root` or `serve --artifact-root`; relative paths resolve inside that root and paths outside it are rejected.
 
 Security caveat:
 
 - `serve` has no built-in authentication or authorization.
 - Deploy only behind trusted controls (private network boundary, authenticated reverse proxy, API gateway, or equivalent).
+- Keep the HTTP artifact root as narrow as practical and do not make it writable by untrusted users.
 
 ## Output, Logs, And Exit Codes