triage_document
Check documents for structural tampering signals and decompression cost before full ingestion. Returns risk band and I/O metrics so agents can reject risky or route them to a deeper inspection.
Instructions
CHEAP PRE-FLIGHT for document intake: is this file worth ingesting, and what does it cost to open? Reads structure, metadata, signatures and presence flags (revisions appended after the original, editor fingerprints, macros, JavaScript, embedded files, signature coverage) WITHOUT the expensive per-page content walk — a fraction of the I/O of inspect_document. Returns the risk band, the medium-or-high signals it CAN see, and the measured cost: bytes read, bytes expanded (decompressed) and the expansion ratio, so an agent can reject a decompression-heavy or high-risk file before committing to a full parse.
NOT A CLEAN BILL OF HEALTH. A quiet triage means only that the cheap structural tells were absent. Hidden text, redaction failure, altered arithmetic, glyph tampering, embedded-image anomalies and broken certifications are NOT checked in this mode — they need the page-content walk inspect_document runs. Use triage to ROUTE (reject now, or escalate to inspect_document), never as the verdict. PDFs get the cheap scope; Office documents and images have no separate expensive walk, so they return their full report.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the document on this machine — PDF, Office document or image. Max 10 MB. |