The equipment it carries

The machine boots a fixed Ubuntu image. Nothing installed during a session survives it, so what is in the image is what the assistant can rely on:

Documents

LibreOffice Writer, Calc and Impress, headless — .docx, .xlsx and .pptx read, written and converted. pandoc.

PDF

poppler-utils, qpdf, and OCR through ocrmypdf and tesseract with English, French, German, Spanish, Italian, Portuguese and Dutch.

Data and text

python3 with pandas, openpyxl, python-docx, pypdf and Pillow; csvkit, ripgrep, ImageMagick, and the GNU text tools.

Typesetting

Carlito and Caladea, metric-compatible with Calibri and Cambria, with Liberation, DejaVu and Noto behind them; every locale pre-generated.

How it runs

Every conversation boots a real virtual machine — Virtualization.framework on macOS, Hyper-V on Windows, where a system service the installer registers creates it. The granted folder is the only part of your computer inside; the machine has no network adapter, and its only route out is a proxy on your own computer that admits an exact list of names. There is no software-only mode: a synod that cannot put hardware between the assistant and the rest of your computer refuses to start.

The folder is recorded before the job and again after it, and the difference is what you are told; nothing is put back. Close your documents first: the assistant works in the folder itself, and a file left open in Word while a job runs can be overwritten under you.

Download

Windows

64-bit x86, with the Virtual Machine Platform feature installed; no particular edition of Windows. The account must be an administrator or a member of the computer's local Hyper-V Administrators group, which is empty by default; synod checks that and names it before a folder is granted.

macOS

Apple silicon. The disk image is signed ad hoc, not notarized, so the first launch is opened from the Finder's context menu rather than by double-clicking.

Licence

MIT or Apache-2.0, at your option.