Private input safety
Nothing is parsed until the exact bytes pass.
A clean malware scan is only the first gate. Extraction also requires the promoted file hash, current parser evidence, an ephemeral non-root sandbox, no network, bounded output, and untrusted-content handling.
Safe demo mode. External production and publishing calls are disabled.
Ready1Isolated extraction only
Human review1No extraction yet
Blocked1Exact reasons retained
Provider calls0Local fixture evidence
Safe extraction gate
Scan, bind, isolate, and distrust.
| Fixture | Exact hash | Parser | Network | Primary evidence | Decision |
|---|---|---|---|---|---|
| Fictional clean PDFapplication/pdf | MatchedContent remains untrusted | ephemeral non rootCurrent evidence | disabled | Every extraction control passedInstructions are data, never commands | ready_for_isolated_extraction |
| Fictional review PDFapplication/pdf | MatchedContent remains untrusted | ephemeral non rootCurrent evidence | disabled | External references will not be fetched and require human reviewInstructions are data, never commands | manual_review_required |
| Fictional unsafe PDFapplication/pdf | ChangedContent remains untrusted | shared hostCurrent evidence | enabled | The extraction candidate does not match the promoted file hashInstructions are data, never commands | blocked |
Agent boundary
Extracted instructions never control the system.
Files, embedded text, links, metadata, and prompt-like language remain untrusted project data. External references are never fetched during extraction. PII/secret scanning and exact-file provenance are required before content can reach a later human-reviewed agent context. This demonstration performs no extraction, provider call, release, or spend.