---
name: docxology/infrastructure-steganography
source: https://app.decimal.ai/s/docxology-infrastructure-steganography@1/SKILL.md
source_sha256: 7bb44cd92c77
---

# Steganography Infrastructure Module

The `steganography` module applies cryptographic hash manifests, text overlays, and interactive metadata objects (like `mailto` QR barcodes) directly to PDF post-rendering.

## Core Processor (`core.py`)

The primary orchestrator of steganography operations. It handles config extraction, hashing, alpha-text watermarking, and barcodes.

```python
from infrastructure.steganography import SteganographyConfig, SteganographyProcessor
from pathlib import Path

processor = SteganographyProcessor(SteganographyConfig(enabled=True, overlay_mode="text"))
final_pdf = processor.process(
    Path("output.pdf"),
    author_emails=["test@example.com"],
)
```

## Barcodes (`barcodes.py`)

Responsible for generating dense Error-Correction Q-Level QR codes and Code128 barcode strips.

```python
from infrastructure.steganography.barcodes import create_barcode_strip_overlay
overlay_pdf_bytes = create_barcode_strip_overlay(
    page_width=612, page_height=792,
    code128_data="paper-id-001",
)
```

## Setup & Hashing (`hashing.py`)

Provides deterministic SHA-256 and SHA-512 manifest exports alongside standard PDF payloads.

```python
from infrastructure.steganography.hashing import compute_file_hashes, write_hash_manifest
hashes = compute_file_hashes(Path("file.pdf"))
write_hash_manifest(Path("file.pdf"), hashes)
```

## Overlays (`overlays.py`)

For applying visual steganographic traits like diagonally rendered strings across every page.

```python
from infrastructure.steganography.overlays import create_watermark_overlay
overlay_bytes = create_watermark_overlay(page_width=612, page_height=792, text="CONFIDENTIAL", opacity=0.08)
```

## Kmyth TPM Sealing (`kmyth_adapter.py`)

Optional TPM-backed sealing of hash manifests and steganography PDFs
into `.ski` sidecar files using the Kmyth toolkit.

```python
from infrastructure.steganography.kmyth_adapter import (
    KmythSealOptions, seal_file_with_kmyth, validate_kmyth_installation,
)

# Validate that kmyth-seal/kmyth-unseal are available
avail = validate_kmyth_installation(binary_dir="infrastructure/steganography/kmyth/bin")
print(avail.summary())

# Seal a file (requires running TPM backend on macOS)
ski_path = seal_file_with_kmyth(
    Path("output.pdf"),
    options=KmythSealOptions(
        binary_dir=Path("infrastructure/steganography/kmyth/bin"),
        tcti_config="mssim:host=127.0.0.1,port=2321",
        timeout_seconds=15,
    ),
)
```

### TPM Backend (macOS)

macOS has no hardware TPM. Use the bundled swtpm + proxy:

```bash
# Start TPM backend
eval "$(uv run python infrastructure/steganography/start_tpm_backend.py start)"

# Run pipeline with Kmyth sealing
uv run python projects/templates/template_redacted_report/scripts/generate_dev_variants.py \
    --kmyth-binary-dir infrastructure/steganography/kmyth/bin

# Stop when done
uv run python infrastructure/steganography/start_tpm_backend.py stop
```

See [AGENTS.md](AGENTS.md#tpm-backend-setup-macos) for full TPM setup details.

## Documentation Signposting
>
> **Master Documentation**: For comprehensive details regarding the framework structure, refer directly to the central docs hub:
>
> - 📚 **Core**: [docs/README.md](../../docs/README.md), [docs/AGENTS.md](../../docs/AGENTS.md), [docs/documentation-index.md](../../docs/documentation-index.md)
> - 🏛️ **Architecture**: [docs/architecture/](../../docs/architecture/), [docs/core/](../../docs/core/), [docs/modules/](../../docs/modules/)
> - 🔒 **Security & Provenance**: [docs/security/](../../docs/security/), [docs/best-practices/](../../docs/best-practices/)
> - 🛠️ **Usage & Ops**: [docs/usage/](../../docs/usage/), [docs/operational/](../../docs/operational/), [docs/development/](../../docs/development/), [docs/guides/](../../docs/guides/), [docs/prompts/](../../docs/prompts/), [docs/reference/](../../docs/reference/)

## Documentation Hub
For detailed documentation on the entire system, refer to the central documentation hub:
- **Core**: [docs/README.md](../../docs/README.md), [docs/AGENTS.md](../../docs/AGENTS.md), [docs/documentation-index.md](../../docs/documentation-index.md)
- **Architecture**: [docs/architecture/](../../docs/architecture/), [docs/core/](../../docs/core/), [docs/modules/](../../docs/modules/)
- **Security & Provenance**: [docs/security/](../../docs/security/), [docs/best-practices/](../../docs/best-practices/)
- **Usage & Ops**: [docs/usage/](../../docs/usage/), [docs/operational/](../../docs/operational/), [docs/development/](../../docs/development/), [docs/guides/](../../docs/guides/), [docs/prompts/](../../docs/prompts/), [docs/reference/](../../docs/reference/)