Authorize bounded non-PDF formats in document/mistral

[salmonumbrella]

Problem

Docbank's current public document/mistral contract can authorize only PDF because its page limit is the only provider-unit cap the client can enforce before upload. That keeps Msgvault's shared Docbank-backed extraction path PDF-only after kenn-io/msgvault#635.

kenn-io/msgvault#608 targets every safely supported non-visual document family. kenn-io/msgvault#664 adds document vectors and semantic/hybrid search for chunks that already exist; it does not broaden Mistral extraction authority.

Existing evidence

A synthetic authenticated probe against the pinned EU mistral-ocr-4-0 endpoint exercised 26 candidate formats.

Provider-accepted (18): PDF, DOC, ODT, RTF, PPT, XLSX, CSV, EPUB, TXT, Markdown, RST, JSON, JSONL, YAML, Go, Python, JavaScript, and MSG.

Provider-rejected (8): DOCX, PPTX, XLS, ODS, Numbers, LaTeX, XML, and EML.

That is discovery evidence, not upload authority. A provider accepting a file does not prove Docbank can enforce the declared page, slide, sheet, record, or other provider-unit bound before bytes leave the machine.

Ask

Extend the storage-neutral Docbank packages so each non-PDF format is authorized only when its limits can be enforced locally before upload:

• detect the real container and family rather than trusting caller metadata;
• enforce bytes plus a family-appropriate unit bound before staging or upload;
• record per-format probe evidence and policy identity in the capability manifest;
• keep formats that cannot be bounded explicitly blocked with a stable reason;
• ship deterministic synthetic fixtures and public contract tests for every enabled family;
• preserve the existing private staging, redirect refusal, bounded response, retry, and sanitized-error guarantees;
• remain stateless and inline-only—never fall back to Mistral Files or Libraries.

The consumer contract should let Msgvault pin Docbank and enable an authorized format without duplicating Docbank's detector, bounds, probe, or transport.

Acceptance

• Every provider-accepted format that can be bounded safely has explicit runtime authority and family-specific tests.
• Every remaining format fails closed before upload with a stable operator-visible reason.
• Capability and policy fingerprints change when any format, bound, endpoint, model, or request policy changes.
• No Docbank vault, daemon, database, queue, vector store, or search dependency enters the public document-processing packages.

Msgvault continues to own attachment/message provenance, consent records, orchestration, persistence, vectors, and search serving.

Refs kenn-io/msgvault#608, kenn-io/msgvault#617, kenn-io/msgvault#635, and kenn-io/msgvault#664.

[cfodes]

One additional invariant seems important: the preflight authorization must be bound to the exact bytes that are later uploaded.

After local type detection and inspection, compute an input hash and include it in the authorization result. Verify it again immediately before upload. If normalization or conversion creates a derived artifact, record both hashes and apply the limits again to the derived bytes.

For container formats, I would enforce at least:

• compressed and aggregate uncompressed bytes;
• entry count and per-entry size;
• nesting depth;
• encryption and external-reference policy;
• a family-specific semantic unit count.

The unit can remain format-specific:

• EPUB: spine items plus total resources;
• CSV/JSONL: records counted while streaming;
• XLSX: sheets and populated cells, after ZIP limits pass;
• presentation formats: slides;
• TXT/Markdown/RTF: decoded characters or lines when no natural page unit exists.

The capability record should contain the detector version, detected container/family, measured limits, input hash, policy fingerprint, and the reason for every rejected dimension.

This prevents a file from passing inspection under one identity and reaching the provider as another, while keeping unsupported or unbounded families explicitly fail-closed.

[rodboev]

The two document/mistral slices have landed in #261 and #293.