[silverstein]

Outcome

Private local PDF password entry replaces password-bearing assistant tool arguments. Credentials are memory-only, exact-source/session-bound, expire, and can be locked. Legacy arguments reject before work without reflection. Existing permissions and encrypted-output safeguards remain.

Verification

Independent source and exact-package review PASS. Darwin arm64 Node v22.23.2 results:

• Eight-file clean bank: 174/174.
• Guidance and discovery follow-up: 72/72.
• Final documentation/accessibility: 100/100.
• Phase 1 oracle/scoring suites: 20/20.
• Migrated positive controls: 7/7, with 553 explicitly filtered.
• Service tests include expiry, origin/host, capabilities, concurrency and lifecycle attacks.

Exact review package: b827a0144f88d5501c4e4a0284c9b022c196c0a8 in Open-Document-Alliance/pdf-tools-plugin#1. Built from 4b89180, version 0.14.0+127.g4b89180, with 1,595 files. All 39 packaged server blobs independently match source.

The actual packaged launcher passed 64-tool discovery, 12 password refusals, two download-secret refusals, form reading and rendering. Ten isolated-browser checks passed against identical packaged runtime bytes, including wrong/right entry, cleared input, Lock and post-lock refusal. Tool digest: 17e2067e2c014bfc77e234432af45f7711494104f2a14d5f652e42e917251128.

Full CI run 39506149017 passed all eight jobs. Attempt 2 reran only one stalled/cancelled Node 20 shard; the other seven successes were preserved. PR #231 merged as 48bf4c1 with an exact tree match to the reviewed head. The previous run found stale documentation inventories, legacy error expectations and oracle source identities. All affected tests now pass. Oracle regeneration changed only five source-binding metadata values, not cases or expected extraction truth. The final successor has no runtime delta.

Limitations

Browser qualification substitutes the platform opener. No native ChatGPT/Claude installation acceptance, allowlisting or manual release is inferred. Same-user/root compromise and guaranteed JavaScript memory erasure are outside scope. Encrypted geometry limitations remain qualified; signature detection describes its partial encrypted text support. No email sent.