---
title: "Documents and exact bytes"
description: "Import, quarantine, verification, rendering and recovery without silently changing an original."
---

> Documentation Index
> Fetch the complete documentation index at: https://engineering.guteneo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Documents and exact bytes

A document is more than a filename. It has private bytes, a SHA-256 hash, ownership,
provenance and a usable verification state. Dispatch approval refers to that
immutable version. A friendly upload response does not imply that the PDF can
already be read, generated into another format or sent.


![Keep the original. Derive the next version.](/illustrations/document-pipeline.svg)

The sealed archive and output tray are deliberately separate. Imported originals retain their exact bytes. Dataset mappings and versioned templates produce new derived documents with provenance. A generated PDF still needs its own applicable checks, review and dispatch authority.

1. **Private original.** An upload becomes a private original document. Its identity and exact stored bytes are preserved. Transformations create another document instead of silently rewriting it.
2. **Data and mapping.** CSV, spreadsheets and structured data are parsed into sheets and rows. A mapping profile selects source fields and transformations. Preview and provenance make the mapping inspectable.
3. **Template version.** Studio templates have explicit versions, fields and generation settings. Generation uses a concrete template version with concrete mapped data.
4. **Generate.** A generation job renders document artifacts and records its manifest. The output derives from the selected inputs; generation does not itself authorize delivery.
5. **Derived PDF.** A generated PDF or added postal address page has a separate derived identity and provenance. Source identities and provenance remain subject to the applicable access and retention rules.
6. **Inspect and review.** Applicable scan, validation and preview checks apply before later approval and dispatch. A successful render is not proof that a provider, postal route or recipient has accepted the document.

[Download SVG](/illustrations/document-pipeline.svg)

## Import and verification

Multipart upload preserves the received PDF bytes. The service applies bounded
input, tenant/resource rules and content budgets, calculates the exact hash and
stores the private original. Tenant-aware deduplication must preserve access rules;
a shared hash never creates cross-workspace access.

The document remains unusable until the required antivirus and isolated PDF
validation agree on its exact bytes. Missing scanner configuration, stale
signatures, service unavailability, an incomplete analysis or a security rejection
must not be converted into `ready` by a client or an approval operation.

| Document state | Meaning |
| --- | --- |
| `quarantined` | Required verification has not completed successfully; this alone is not a malware verdict |
| `ready` | Required exact-byte verification and PDF checks allow the documented operations |
| `rejected` | The document was refused under its verification rules |
| `purged` | File retention cleanup has removed eligible bytes; historical metadata is not thereby erased |

Analysis/recovery state explains why a quarantined document is waiting and which
bounded action is available. It is distinct from the document's send-readiness
gate. Reads do not trigger arbitrary retries or manually lift quarantine.

## Public HTTPS import is a different entry path

Hosted URL import accepts a direct public HTTPS download under explicit port,
credential, address, timeout and size restrictions. Redirects are refused. The
hosted runtime's public-only egress boundary is separate from the private service
bindings used for scanning and rendering.

Source refusal happens before download/storage and therefore is not the same as
quarantine. A host-specific attachment handle, local path, login page or expired
signed link is not an accessible PDF source. guteneo does not forward a browser's
cookies or an assistant account's credentials to make it accessible.

Local URL import is disabled because the local runtime does not provide the same
public-egress guarantee. Use authenticated multipart upload for local files.
Default PDF bounds are 10 MiB and 100 pages; the service's current contract remains
authoritative for every input.

## Generated documents have new identities

HTML rendering accepts a bounded sanitized document within a controlled template;
it is not a faithful converter for arbitrary web pages, scripts or external
resources. Studio rendering uses its own typed template/data path. Adding a postal
address page also creates a separate PDF while retaining the source.

Every derived PDF is stored and verified as its own immutable document. A changed
page count or content changes what must be quoted and approved. Do not patch the
bytes behind an existing document ID or reuse an old approval for the derivative.

## Reads, previews and recovery

Metadata, original bytes and bounded page images have separate authorized
representations. A preview is not a public asset. Creator-private Studio PDFs
retain their specific access policy, including dispatch-context review for current
approvers.

When analysis is retryable, follow the same document's explicit recovery action.
Do not create duplicate imports to conceal an unavailable scanner or describe a
partial extract as the complete PDF. [PDF diagnostics](/workflows/pdf-diagnostics/)
provide a separate conformance assessment; they cannot replace these security
gates.

Source: https://engineering.guteneo.com/workflows/documents/index.mdx