The last mile of a matter is almost always paper: a stack of exhibits that has to become one ordered, paginated bundle; a government form that has to be filled exactly; an agreement that has to be signed by named people and proven to have been signed. Opbox treats all three as governed kernel operations over the same File primitive, so a compiled bundle, a filled form, and a signed envelope are each a real, encrypted, workspace-isolated file with its own audit trail. Nothing here is visa-specific or litigation-specific: the bundle order, the form field-map, and the annotation labels are all tenant configuration passed into the verb, not behaviour baked into the product.
What it does
Compile ordered exhibits into one paginated bundle. Hand bundle.compile an ordered list of PDF files and it merges them, in that exact order, into a single new bundle file. The merge is object-level, so source pages are copied verbatim and never re-rendered or rasterised: there is no fidelity loss. Each member can carry a divider caption that inserts a generated divider page before its content, and the verb computes the table of contents for you - the 1-based start page of every member in the merged document. The pagination is computed at compile time, never a stored field someone hand-edits and forgets to update.
Block a silently-incomplete bundle. A bundle of evidence is only as good as its completeness, so the compose step carries a coverage gate. Pass the set of file ids that must be present, and if any required exhibit is missing from the manifest the call fails closed with a coverage report naming exactly what is absent. You never get a regulated bundle that looks finished but quietly dropped a required document.
Carry sensitivity through the merge. The compiled bundle inherits the highest sensitivity of its members: merge a restricted or sensitive exhibit and the resulting bundle is itself marked sensitive. The bundle’s bytes are sealed with the same encryption-at-rest as every other file, and it records the ordered source file ids it was built from, so the composed document carries its own provenance.
Mark up evidence before it is bundled. Before exhibits are composed, you can annotate a PDF with typed, geometry-anchored marks: a box, an arrow, a note, each placed at a normalised position on a page and tagged with a label and a criterion. The annotations are stored against the file and read back in page order with their author, so the markup that explains why a page matters travels with the evidence.
Fill a PDF form from a field-map. Give acroform.fill a template PDF and a plain map of field names to values and it sets each named widget and turns on the viewer’s appearance flag so the values render. The field-map is tenant config (a per-form mapping), so no government form is hardcoded. The same coverage gate applies: name the fields that must be filled and a required field left empty blocks the call rather than producing a half-complete official form. The filled document is written as a new file that inherits the template’s sensitivity, because a filled form carries personal data.
Send a document out to be signed. An envelope is a document or set of documents sent to named recipients to sign. You open an envelope in draft over a document or file, set the recipient roster and routing (sequential or parallel), place signature, initial, date, text, and checkbox fields at exact page positions, then send it. The envelope runs a forward-only state machine: draft, sent, then completed, and a completed envelope is required to carry a signed artefact. You can remind outstanding recipients, void an envelope you sent, and the machine handles a recipient declining and an envelope reaching its expiry.
Work with a native signer or DocuSign through one seam. Envelopes default to the native signer, but the same verbs render identically whether the provider is native or DocuSign. The provider’s callback is idempotent, keyed on the provider and its external id, so a re-delivered callback is a safe no-op and never double-counts a signature.
Prove the signatures are intact. Every step in a signing - sent, signed, declined, reminded, voided, expired - is appended to a hash-chain of signing events. signing.chain.verify derives a chain integrity report over that anchored chain (hash-chain plus a timestamp anchor), so you can prove to a third party that the recorded signatures have not been tampered with. The report is computed from the event log, not a stored verdict that could drift.
How you use it
Build a bundle. Gather the exhibits as files, decide the order, and call the compile with the ordered member list, an optional divider caption per member, and the set of file ids that must be present. You get back one bundle file with its page count, the computed table of contents, and its inherited sensitivity. If a required exhibit is missing, the call tells you which one before anything is produced.
Annotate an exhibit. Open a PDF file, place a box or note at the page and position it belongs on, and tag it with a label and a criterion. Read the annotations back to see every mark on the file in page order with who made it.
Fill an official form. Take the template PDF, supply the field-map of names to values, name any fields that are mandatory, and the filled form lands as a new file. A missing mandatory field stops the fill rather than letting a blank slip through.
Send for signature. Create the envelope over the document, set the recipients and whether they sign in sequence or in parallel, place the signature and date fields where they go, and send. Track progress through the envelope’s status and per-recipient counts, remind anyone outstanding, and void it if the deal changes.
Prove it later. When someone needs assurance the signatures are genuine, run the chain verification and hand over the integrity report.
The kernel verbs behind it
Everything above runs through the kernel’s one front door: each call is permission-checked, scope-checked, and audited before it executes.
Composing and filling:
bundle.compile- merge ordered PDF exhibits into one paginated bundle, with dividers, a computed table of contents, and a coverage gate that blocks a missing required exhibit.acroform.fill- fill a PDF form from a tenant field-map, blocking on any required field left empty.doc.annotate- place a typed, geometry-anchored mark (box, arrow, note) on a PDF, tagged with a label and criterion.file.put- store the source bytes (the exhibits and templates) as encrypted, workspace-isolated files.file.get- read a file’s metadata and bytes back.
Signing:
envelope.create- open a draft signing envelope over a document or file.envelope.recipient.set- set the recipient roster and sequential or parallel routing.envelope.field.place- place a signature, initial, date, text, or checkbox field at an exact page position.envelope.send- transition the envelope from draft to sent and dispatch it to recipients.envelope.sign- record a recipient’s signature.envelope.remind- re-ping the recipients who have not yet acted.envelope.void- cleanly void an envelope you sent.envelope.get/envelope.list- read an envelope and list a matter’s envelopes with per-recipient progress.envelope.callback- the idempotent provider callback (native or DocuSign).signing.chain.verify- derive a chain integrity report over the anchored signing-event chain to prove the signatures are intact.
See the full set in the envelope verb reference.