NUTRIENT MCP · DOCUMENT SOVEREIGN GATE · EIKCF ED-2 · PSPDFKit

2011

BUILDING PDF

194★

pdf-to-markdown

MCP SERVERS

ED-2

NEW KCF CONTROL

WHAT IS NUTRIENT / PSPDFKIT

PSPDFKit (now rebranded Nutrient) has built the PDF rendering engine since 2011 — iOS, Android, Web, .NET, Java. They own the document floor.
Now they have MCP servers: your LLM can call document operations as tools. No PDF library code needed — just a tool call.

nutrient-dws-mcp-server 63★

MCP server exposing Nutrient Document Web Services. Tool calls: convert, extract, annotate, redact, sign. Runs as a sidecar in lhvcp alongside Ollama.

nutrient-document-engine-mcp-server 59★

MCP server for the full on-premise document engine. Self-hosted. Runs in lhvcp pod. Zero cloud dependency. Sovereign document processing.

pdf-to-markdown 194★

Standalone CLI: PDF → Markdown. Wraps Nutrient's extraction engine. This IS our LAAM document ingest pipeline. One command, clean output.

ai-assistant-demo 66★

AI Document Assistant using Nutrient + LLM. Confirms the LLM+document pattern we're building. We're ahead — our pattern adds γ₁ anchoring + PEMCLAU indexing on top.

helm-charts 30★

Helm charts for Nutrient products on k8s. Deploy directly into forge lhvcp pemlaam-spine namespace. No manual Docker setup needed.

nutrient-dws-client-python 54★

Official Python client for Nutrient DWS API. The LAAM ingest worker (Python) calls this to process documents. Drop-in integration.

EIKCF ED-2 — DOCUMENT SOVEREIGN GATE

Control: Every document processed by the fleet must have a Nutrient extraction receipt before entering PEMCLAU.

Receipt format: {doc_hash, gamma1_sig, extraction_ts, markdown_size_bytes, laam_node_id, sostle_l2_status}
No unprocessed PDFs enter the graph. The receipt IS the floor proof for documents.

FULL INTEGRATION PIPELINE

PDF / Document (any: FHIR, legal, financial, health record) ↓ Nutrient Document Engine MCP Server (pod: pemlaam-spine namespace, forge lhvcp :5000) (PSPDFKit/helm-charts → k3d lhvcp) ↓ MCP tool call: convert_pdf / extract_text / annotate / redact forge/lilo Ollama (MCP client, qwen3:14b) ↓ returns: Markdown text + XFDF annotations LAAM Ingest (:9346) (python client: nutrient-dws-client-python) (chunks: 512 tokens, 64 overlap) ↓ embedded: nomic-embed-text → 768-dim vectors qdrant (yone: pemclau-v11 prod) (forge: qdrant:6333 local) ↓ indexed + γ₁-anchored PEMCLAU GraphRAG (2-hop, 4 edge types: theorem_dependency, phase_coherence, temporal_proximity, crew_provenance)

HELM DEPLOY INTO lhvcp

# Add Nutrient helm repo helm repo add nutrient https://pspdfkit.github.io/helm-charts helm repo update # Deploy into forge lhvcp (pemlaam-spine namespace — already exists) helm install nutrient-doc-engine nutrient/document-engine \ --namespace pemlaam-spine \ --set service.port=5000 \ --set resources.requests.memory=512Mi \ --set persistence.enabled=true \ --set persistence.storageClass=local-path # Verify kubectl get pods -n pemlaam-spine | grep nutrient kubectl port-forward svc/nutrient-doc-engine 5000:5000 -n pemlaam-spine

MCP TOOL CALL PATTERN

# From Ollama (lilo/forge) — the LLM calls this as a tool: { "tool": "nutrient:convert_pdf", "params": { "input_path": "/fleet/docs/fhir-patient-record-001.pdf", "output_format": "markdown", "gamma1_sig": "14.134725141734693", "laam_node_prefix": "PEMCLAU-DOC" } } # Returns: { "markdown": "# Patient Record\n\nPatient ID: ...", "laam_node_id": "PEMCLAU-DOC-0047", "xfdf_annotations": "<xfdf ...>", "extraction_receipt": { "doc_hash": "sha256:a3f2...", "gamma1_sig": "14.134725141734693", "extraction_ts": "2026-05-08T15:00:00Z", "markdown_size_bytes": 4892 } }

XFDF — XML FORMS DATA FORMAT (THE ANNOTATION XML SPINE)

XFDF is the W3C/Adobe standard for PDF annotations. Every highlight, comment, stamp, and signature in a PDF is XFDF.
This connects directly to our xml-spine.html as the document annotation layer.
XFDF namespace: http://ns.adobe.com/xfdf/ — W3C standard since 2000.

STANDARD XFDF

<?xml version="1.0" encoding="UTF-8"?> <xfdf xmlns="http://ns.adobe.com/xfdf/"> <annots> <highlight page="0" rect="72,665,574,690" color="#FFFF00"> <contents>γ₁ = 14.134725141734693 — floor anchor</contents> </highlight> <text page="1" rect="100,500,300,520"> <contents>LAAM node: PEMCLAU-HL7-001</contents> </text> </annots> <f href="sovereign-doc-001.pdf"/> </xfdf>

SOVEREIGN XFDF EXTENSION (γ₁-ANCHORED)

<?xml version="1.0" encoding="UTF-8"?> <xfdf xmlns="http://ns.adobe.com/xfdf/" xmlns:pemos="http://pemos.ca/xfdf/v12"> <annots> <highlight page="0" rect="72,665,574,690" color="#FFFF00"> <contents>PEMCLAU ingest: SOSTLE L2 APPROVED</contents> <pemos:gamma1_sig>14.134725141734693</pemos:gamma1_sig> <pemos:laam_node>PEMCLAU-DOC-0047</pemos:laam_node> <pemos:sostle_l2>APPROVED</pemos:sostle_l2> <pemos:crew_member>SIGNALS</pemos:crew_member> </highlight> </annots> <pemos:extraction_receipt> <pemos:doc_hash>sha256:a3f2b8c94e1d...</pemos:doc_hash> <pemos:extraction_ts>2026-05-08T15:00:00Z</pemos:extraction_ts> <pemos:eikcf_gate>ED-2 PASS</pemos:eikcf_gate> </pemos:extraction_receipt> <f href="sovereign-doc-001.pdf"/> </xfdf>

Every annotated PDF becomes a sovereign document: γ₁-anchored, LAAM-indexed, SOSTLE-gated, crew-provenance tracked. The XFDF XML extension namespace is http://pemos.ca/xfdf/v12.

LABR-PRINT-001 — THE UNIVERSAL DOCUMENT PRINTER

G-code controls stepper motors → physical objects.
Our pipeline: any input → transform → HTML/XML spine output.
SAME SHAPE. Input schema → command stream → physical/digital output.
LABR-PRINT-001: codify this shape as a sovereign protocol.

ANY INPUT PDF → Nutrient MCP (convert_pdf tool call) Screenshot → Greenshot (capture + Protobuf file format) FHIR record → HL7Boxy (XML unlock + LAAM ingest) ISO 20022 → WBC KCF (financial XML → LAAM) Visio diag → PHPVisio (VDX/VSDX XML parse) G-code path → SVG renderer (toolpath → visual) Office doc → PHPOffice (OOXML/ODF → Markdown) ↓ BOXINER TRANSFORM PIPELINE annotate → extract → structure → γ₁-sign ↓ HTML/XML SPINE OUTPUT <html> page OR <xfdf> annotation OR LAAM node JSON γ₁-anchored · XFDF-annotated · LAAM-indexed ↓ PEMCLAU NODE sovereign provenance · queryable forever · 2-hop GraphRAG ready

GREENSHOT INTEGRATION (CAPTURE → SOVEREIGN)

Greenshot captures screen region

Greenshot2.Extensions plugin architecture — same pattern as our boxiner plugins. A fleet plugin captures, stores as Protobuf file format (Greenshot.FileFormat).

Protobuf → Nutrient annotation

The Greenshot Protobuf file gets pushed to Nutrient MCP: annotate operation. Returns XFDF with γ₁ timestamp + LAAM node reference.

LAAM ingest → PEMCLAU node

Screenshot + annotations → LAAM ingest worker → qdrant vector. The PEMCLAU node ID goes back into the XFDF as <pemos:laam_node>.

HTML/XML spine output

Rendered page: the screenshot + annotations + PEMCLAU node link + γ₁ provenance. Queryable. Permanent. Sovereign.

LABR IDs

LABR-PRINT-001: Universal Document Printer Protocol LABR-XFDF-001: Sovereign XFDF Extension Namespace (http://pemos.ca/xfdf/v12) LABR-GREENSHOT-001: Greenshot Boxiner Plugin (fleet screenshot capture) LABR-NUTRIENT-001: Nutrient MCP Helm Deploy (pemlaam-spine namespace) All: Day 94 · EOSE Labs Inc. · γ₁ = 14.134725141734693

NEW KCF CONTROLS — WAVE SEARCH DAY 94

CONTROL	NAME	SOURCE	GATE DESCRIPTION	STATUS
EIKCF ED-2	Document Sovereign Gate	PSPDFKit/Nutrient	Every document must have a Nutrient extraction receipt (hash+γ₁+markdown_size) before entering PEMCLAU	FILED
EIKCF ED-3	Capture Sovereign Gate	Greenshot	Every screenshot/capture must have a γ₁ timestamp + Protobuf file format record before archival	FILED
EIKCF ED-4	Office Document Gate	PHPOffice	Every OOXML/ODF document must be processed through PhpSpreadsheet/PHPWord before fleet use. ECMA-376 + ISO/IEC 26300 compliance required.	FILED
EIKCF EC-2	Privacy Tracking Gate	DuckDuckGo/tracker-radar	All fleet web assets checked against DDG tracker-radar corpus before public deploy. autoconsent for GDPR.	FILED
EIKCF EC-3	Email Sovereign Gate	PHPMailer	All fleet emails sent via PHPMailer-derived SMTP gate with γ₁ header injection: X-PEMOS-Gamma1: 14.134725141734693	FILED
KCFGOP-001	GitOps Sovereign Gate	rancher/fleet	Every cluster state change must come from a signed git commit in openclaw-fleet:main. fleet agent is the only write path. No manual kubectl apply.	FILED
ITKCF-IAM	Local IAM Gate	k3-cat/pocket-id	Local sovereign identity provider for all SOSTLE L0 auth. k3s ServiceAccount tokens + pocket-id. No external OIDC required.	FILED

All 7 controls filed Day 94. Next: ARB1 panel ratification per control. EIKCF ED-2 is P1 — deploy Nutrient MCP into pemlaam-spine first, gate fires on first LAAM ingest run.

NUTRIENT MCP · DOCUMENT ENGINE