ReviewSeal

Why I built it

Document approval can drift at the handoff: a reviewer reads one version, then a generated file moves downstream without a clear link back to what was approved. ReviewSeal makes that boundary visible and testable without using a real or sensitive document.

What it does

ReviewSeal accepts a bounded synthetic approval brief and freezes it before review. The reviewer sees the exact draft SHA-256, explicitly acknowledges that digest, and then triggers a single Nutrient Document Web Services build. Nutrient DWS creates the canonical PDF and applies the visible HUMAN APPROVED watermark. ReviewSeal validates the returned PDF, calculates its SHA-256, and produces a receipt that binds the approved draft digest to the generated file digest.

The demo deliberately fails closed. If the session, workflow, response size, PDF structure, or timing check is wrong, it does not produce a receipt.

How I built it

The app uses a small Node.js server and a plain HTML, CSS, and JavaScript interface. The server sends frozen HTML to Nutrient DWS POST /build; the browser never receives the DWS API key. A one-run bootstrap capability is exchanged for an HttpOnly, SameSite cookie. The server listens only on loopback, requires exact same-origin POSTs, permits one DWS build per process, and bounds both request and response sizes.

The returned PDF is treated as untrusted input. ReviewSeal parses its object structure and rejects active features, including escaped names and object streams, before the native PDF frame can display it. The workflow expires after 15 minutes, zeroes the in-memory synthetic PDF, revokes its blob URL, and prevents a late DWS response from reviving expired state.

Challenges

The hardest part was preserving continuity across three different moments: the text the reviewer saw, the bytes sent to DWS, and the PDF bytes used for the receipt. Freezing the draft and carrying both hashes through a narrow state machine kept those boundaries explicit. A second challenge was making timeout behavior safe; expiry has to win even if the external build returns late.

What I learned

A hash is useful only when the system is precise about which bytes it represents. It can bind an acknowledgment to a file, but it does not prove a person's identity. I also learned that a PDF returned by a trusted document service still deserves structural validation before display.

Accomplishments

The submission completed one live, zero-cash-cost Nutrient DWS build, produced a bounded in-memory PDF and hash receipt, and passed six local contract tests covering the approval and expiry boundaries. The demo uses synthetic, nonbinding content throughout.

What's next

ReviewSeal is intentionally a single-user demonstration. A production version would need authenticated reviewer identities, durable signed audit records, tenant isolation, configurable document policies, and an independent security review before handling real documents.

Built With

• css
• html
• javascript
• node.js
• nutrient-dws
• pdf
• sha-256