Scanner

A scanned invoice and a born-digital report can ask the same question of Scanner: which text, regions, tables, and omissions can be attributed to these exact pages? The route begins with admitted source bytes and ends with a DocumentObservation@1 plus explicit derivatives. Markdown is one projection of that return, not the document's canonical replacement.

The semantic boundary remains stable while engines change. No OCR adapter ships; vision remains Partial in State. The implementation study below was reviewed on 2026-08-07. Its candidates require their own Assimilation and bake.

What the Scanner route actually owes

Uploading a PDF to a local HTTP endpoint may be one request. The trustworthy seam around that call is larger:

authorized ArtifactRef
→ bounded materialization and hostile-document inspection
→ exact Scanner task, engine, model, options, language and page range
→ local library, worker, CLI, REST job, MCP tool, or admitted Portal
→ validated page and region observations plus derivative artifacts
→ provenance, uncertainty, omissions, metrics and terminal receipt

DocumentObservation@1 retains the source and derivative digests, page identity and geometry, regions with boxes or polygons, semantic region class, extracted text, language, reading order, confidence where the provider exposes it, tables, formulae, images, warnings, omitted or failed pages, and the exact engine, model, configuration, and license profile. Markdown, HTML, searchable PDF, and a provider's JSON tree are useful projections or derivatives; none is canonical source truth.

Scanner defines what the returned page and region observations mean. Its immutable profile pins the engine, model, media, languages, limits, quality evidence, and license evidence needed to support that meaning. The dialect driver handles invocation and recovery; the runtime adapter handles service lifecycle. Capabilities and Connectors keep those shared contracts exact.

A Prism-owned Scanner reference adapter may assemble those pieces, but its name does not collapse their authority. A finite CLI/library path is a Spell-selected ToolProfile delivered into a trusted executor or TombSandboxSandbox. A resident, queued, or remote service is ana AnimatorModel RuntimeModel Runtime reached through a CallGrant or JobGrant. Asynchronous execution additionally uses Core's ServiceJobAttempt@1.

The host normally materializes authorized bytes and uploads them directly. A provider-visible file URL is allowed only through a separate egress decision and must never become an ambient fetch or SSRF path.

Choose the engine and model explicitly, even when one project bundles both. A service's Designed RuneService Config FileService Config File selects exact registered interface/profile/driver/dialect/evidence/resource definitions and pins the deployment instance. For a finite tool, the Resolution Lock pins the ToolProfile instead. In both cases, retain the pipeline or model, weights and digest, device/backend, languages, optional modules, concurrency, memory envelope, and the exact output fields that passed the bake. A project name alone cannot identify what was qualified.

Routing without a universal wrapper

The first routing study should compare explicit profiles rather than stack every project:

A low confidence value or parser failure is an outcome to inspect, not permission to select another extractor. If a PatternWorkflowWorkflow predeclares a comparison or escalation branch, its implementations must be pinned. Otherwise the failed attempt must settle before a new forward InvocationJob RequestJob Request admits another extractor. Attribute every result separately; agreement increases confidence only under an admitted comparison rule.

Three candidate routes

The projects overlap. The table names the office for which each is most interesting rather than claiming that it can perform only one task.

PaddleOCR remains a first-class, directly callable Scanner implementation even when Xberg or MinerU can use OCR internally. A bundled dependency does not hide engine and model identity, prove the direct profile, or prevent a PatternWorkflowWorkflow from selecting PaddleOCR without the surrounding pipeline.

Assimilation bake

The first corpus should include Slovak and English born-digital PDFs, clean and degraded scans, rotated and warped pages, handwriting, receipts and forms, multi-column articles, tables, equations, charts, footnotes, mixed-language pages, password-protected or malformed files, oversized images, embedded attachments, links, scripts, and metadata. Synthetic fixtures provide exact truth; operator-owned real documents test the distribution without entering a training corpus by accident.

Measure character and word error, page and region recall, coordinate error, reading-order edit, table structure, formula equivalence, language routing, omissions, hallucinated text, derivative fidelity, wall time, CPU/GPU memory, concurrency, cancellation, crash containment, restart, and license closure. Promote profiles, not project logos: PaddleOCR may qualify for simple Slovak scans while failing formulae; Xberg may qualify for native extraction but not difficult scans; MinerU may win a bounded complex-PDF route without becoming admissible to strict-FOSS Core.

The pragmatic first bake compares three candidate routes, each through its exact profiles: PaddleOCR direct plus PP-StructureV3, Xberg for broad native extraction and selective OCR, and MinerU for difficult documents behind its license gate. Later candidates can enter through Assimilation without changing PrismVision & MediaVision & Media's Scanner contract or silently enlarging the initial Core.