infrastructure-steganography

name	infrastructure-steganography
description	Skill for the steganography infrastructure module providing QR code generation with dynamic mailto links, hash manifests, metadata payloads, and document-wide overlay processing. Use this module to insert opt-in cryptographic and steganographic provenance data onto PDFs.

Steganography Infrastructure Module

The steganography module applies cryptographic hash manifests, text overlays, and interactive metadata objects (like mailto QR barcodes) directly to PDF post-rendering.

Core Processor (core.py)

The primary orchestrator of steganography operations. It handles config extraction, hashing, alpha-text watermarking, and barcodes.

from infrastructure.steganography import SteganographyConfig, SteganographyProcessor
from pathlib import Path

processor = SteganographyProcessor(SteganographyConfig(enabled=True, overlay_mode="text"))
final_pdf = processor.process(
    Path("output.pdf"),
    author_emails=["[e-mail]"],
)

Barcodes (barcodes.py)

Responsible for generating dense Error-Correction Q-Level QR codes and Code128 barcode strips.

from infrastructure.steganography.barcodes import create_barcode_strip_overlay
overlay_pdf_bytes = create_barcode_strip_overlay(
    page_width=612, page_height=792,
    code128_data="paper-id-001",
)

Setup & Hashing (hashing.py)

Provides deterministic SHA-256 and SHA-512 manifest exports alongside standard PDF payloads.

from infrastructure.steganography.hashing import compute_file_hashes, write_hash_manifest
hashes = compute_file_hashes(Path("file.pdf"))
write_hash_manifest(Path("file.pdf"), hashes)

Overlays (overlays.py)

For applying visual steganographic traits like diagonally rendered strings across every page.

from infrastructure.steganography.overlays import create_watermark_overlay
overlay_bytes = create_watermark_overlay(page_width=612, page_height=792, text="CONFIDENTIAL", opacity=0.08)

Kmyth TPM Sealing (kmyth_adapter.py)

Optional TPM-backed sealing of hash manifests and steganography PDFs into .ski sidecar files using the Kmyth toolkit.

from infrastructure.steganography.kmyth_adapter import (
    KmythSealOptions, seal_file_with_kmyth, validate_kmyth_installation,
)

# Validate that kmyth-seal/kmyth-unseal are available
avail = validate_kmyth_installation(binary_dir="infrastructure/steganography/kmyth/bin")
print(avail.summary())

# Seal a file (requires running TPM backend on macOS)
ski_path = seal_file_with_kmyth(
    Path("output.pdf"),
    options=KmythSealOptions(
        binary_dir=Path("infrastructure/steganography/kmyth/bin"),
        tcti_config="mssim:host=127.0.0.1,port=2321",
        timeout_seconds=15,
    ),
)

TPM Backend (macOS)

macOS has no hardware TPM. Use the bundled swtpm + proxy:

# Start TPM backend
eval "$(uv run python infrastructure/steganography/start_tpm_backend.py start)"

# Run pipeline with Kmyth sealing
uv run python projects/templates/template_redacted_report/scripts/generate_dev_variants.py \
    --kmyth-binary-dir infrastructure/steganography/kmyth/bin

# Stop when done
uv run python infrastructure/steganography/start_tpm_backend.py stop

See AGENTS.md for full TPM setup details.

Documentation Signposting

Master Documentation: For comprehensive details regarding the framework structure, refer directly to the central docs hub:

• 📚 Core: docs/README.md, docs/AGENTS.md, docs/documentation-index.md
• 🏛️ Architecture: docs/architecture/, docs/core/, docs/modules/
• 🔒 Security & Provenance: docs/security/, docs/best-practices/
• 🛠️ Usage & Ops: docs/usage/, docs/operational/, docs/development/, docs/guides/, docs/prompts/, docs/reference/

Documentation Hub

For detailed documentation on the entire system, refer to the central documentation hub:

• Core: docs/README.md, docs/AGENTS.md, docs/documentation-index.md
• Architecture: docs/architecture/, docs/core/, docs/modules/
• Security & Provenance: docs/security/, docs/best-practices/
• Usage & Ops: docs/usage/, docs/operational/, docs/development/, docs/guides/, docs/prompts/, docs/reference/