{
  "feature_id": "F-065",
  "agent": "security",
  "verdict": "APPROVED",
  "summary": "Attribute-only change. No new endpoints, no new input handling, no new dependencies. The id values are stable strings used purely for label association; the name attribute was already used by the GET forms to read the query parameter, so no information disclosure or injection vector changed.",
  "evidence": [
    "Only HTML attributes added; no event handlers changed",
    "Stable id strings (site-search, admin-products-search, …) do not leak information",
    "name='q' is already the public query parameter on /search; no new naming",
    "No new env vars, no new dependencies"
  ],
  "timestamp": "2026-08-19T15:30:00Z"
}