Steganography Infrastructure Module

The steganography module applies cryptographic hash manifests, text overlays, and interactive metadata objects (like mailto QR barcodes) directly to PDF post-rendering.

Core Processor (core.py)

The primary orchestrator of steganography operations. It handles config extraction, hashing, alpha-text watermarking, and barcodes.

python
from infrastructure.steganography import SteganographyConfig, SteganographyProcessor
from pathlib import Path

processor = SteganographyProcessor(SteganographyConfig(enabled=True, overlay_mode="text"))
final_pdf = processor.process(
    Path("output.pdf"),
    author_emails=["test@example.com"],
)

Barcodes (barcodes.py)

Responsible for generating dense Error-Correction Q-Level QR codes and Code128 barcode strips.

python
from infrastructure.steganography.barcodes import create_barcode_strip_overlay
overlay_pdf_bytes = create_barcode_strip_overlay(
    page_width=612, page_height=792,
    code128_data="paper-id-001",
)

Setup & Hashing (hashing.py)

Provides deterministic SHA-256 and SHA-512 manifest exports alongside standard PDF payloads.

python
from infrastructure.steganography.hashing import compute_file_hashes, write_hash_manifest
hashes = compute_file_hashes(Path("file.pdf"))
write_hash_manifest(Path("file.pdf"), hashes)

Overlays (overlays.py)

For applying visual steganographic traits like diagonally rendered strings across every page.

python
from infrastructure.steganography.overlays import create_watermark_overlay
overlay_bytes = create_watermark_overlay(page_width=612, page_height=792, text="CONFIDENTIAL", opacity=0.08)

Kmyth TPM Sealing (kmyth_adapter.py)

Optional TPM-backed sealing of hash manifests and steganography PDFs into .ski sidecar files using the Kmyth toolkit.

python
from infrastructure.steganography.kmyth_adapter import (
    KmythSealOptions, seal_file_with_kmyth, validate_kmyth_installation,
)

# Validate that kmyth-seal/kmyth-unseal are available
avail = validate_kmyth_installation(binary_dir="infrastructure/steganography/kmyth/bin")
print(avail.summary())

# Seal a file (requires running TPM backend on macOS)
ski_path = seal_file_with_kmyth(
    Path("output.pdf"),
    options=KmythSealOptions(
        binary_dir=Path("infrastructure/steganography/kmyth/bin"),
        tcti_config="mssim:host=127.0.0.1,port=2321",
        timeout_seconds=15,
    ),
)

TPM Backend (macOS)

macOS has no hardware TPM. Use the bundled swtpm + proxy:

bash
# Start TPM backend
eval "$(uv run python infrastructure/steganography/start_tpm_backend.py start)"

# Run pipeline with Kmyth sealing
uv run python projects/templates/template_redacted_report/scripts/generate_dev_variants.py \
    --kmyth-binary-dir infrastructure/steganography/kmyth/bin

# Stop when done
uv run python infrastructure/steganography/start_tpm_backend.py stop

See AGENTS.md for full TPM setup details.

Documentation Signposting

> > Master Documentation: For comprehensive details regarding the framework structure, refer directly to the central docs hub: > > - 📚 Core: docs/README.md, docs/AGENTS.md, docs/documentation-index.md > - 🏛️ Architecture: docs/architecture/, docs/core/, docs/modules/ > - 🔒 Security & Provenance: docs/security/, docs/best-practices/ > - 🛠️ Usage & Ops: docs/usage/, docs/operational/, docs/development/, docs/guides/, docs/prompts/, docs/reference/

Documentation Hub

For detailed documentation on the entire system, refer to the central documentation hub:

• Core: docs/README.md, docs/AGENTS.md, docs/documentation-index.md
• Architecture: docs/architecture/, docs/core/, docs/modules/
• Security & Provenance: docs/security/, docs/best-practices/
• Usage & Ops: docs/usage/, docs/operational/, docs/development/, docs/guides/, docs/prompts/, docs/reference/