Developer reference
Build around local document facts.
Use the account-free source-checkout commands for local document facts. They create no hosted file and perform no signing act.
Input
Start with exact bytes
Local review reads the exact PDF once through the shared bounded-file contract. It rejects a file that changes while it is being read.
Bound the input
The command reads one stable local file under fixed byte, page, field, and object ceilings.
Read one result
Stdout carries one TOON document by default, or one JSON document when requested.
Branch on the verdict
Exit status and structured fields distinguish success, refusal, negative verification, and usage error.
bun run octodoc <file.pdf> review [--json]Output
Choose the output your caller needs
The output is one stable machine-readable document. TOON is the terminal default, and --json is the pipeline escape hatch.
Exit 0
The requested local operation finished successfully.
Exit 1
An operational error or negative verification verdict occurred.
Exit 2
The invocation was invalid before a document dependency ran.
Structured success and error documents use stdout. Human-readable progress and the model disclosure use stderr. Unknown flags are usage errors rather than ignored input.
Model work
Keep model work separate
Review is deterministic and offline. Summarize is a separate network command with a required party perspective and labeled model output.
Summary contract
bun run octodoc <file.pdf> summarize --party <role> [--json]
Every overview, clause, risk flag, and citation carries its model source. A cited span must match the canonical local representation exactly.
Verification
Treat verification as a bounded verdict
Verification consumes local evidence and returns a bounded verdict. A digest mismatch exits non-zero so automation cannot mistake it for success.
Sealed bytes
bun run octodoc verify --sealed <file.pdf> --sha256 <hex>
Ledger evidence
bun run octodoc verify --ledger <bundle.json>
Boundary
Local commands grant no transaction authority
These local commands create no account state and grant no transaction authority. Machine identity alone never authorizes a send or signature.