ADR: Document conversion (PDF and host-owned converters)

Status

Accepted (2026-07-15) — host-owned conversion seam and recorded conformance fixture proof satisfies the entry criteria; no default-composition converter ships in this repository.

Document-template workflows often require PDF or other rendered formats. Templiqx ships a measured DOCX V5 inspect/render slice and actor-neutral inspect_document, but does not own subprocess converters, font discovery, retry queues, or tenant quotas.

Decision

PDF conversion is a host-constructed optional adapter, not default composition. The portable core must not probe host installations or spawn converters.
Entry criteria before implementation:
- dedicated ADR acceptance (this record);
- converter identity and environment reporting in render receipts;
- controlled subprocess tests with synthetic fixtures;
- corpus-backed parity or explicit approximated/unsupported categories.
Queue, retry, quota, and process-isolation policy remain host-owned.

Consequences

CRM3 and repository conformance stay DOCX-grounded without PDF claims.
Hosts may wrap LibreOffice, Gotenberg, or opco-specific converters behind DocumentRenderer or a separate conversion port constructed explicitly.

Typst markup target

templiqx-typst is an optional, host-constructed DocumentRenderer that emits deterministic Typst markup as its portable artifact. It performs only bounded field interpolation, locale formatting, and deterministic native table/chart generation; it does not embed the Typst compiler. PDF compilation, fonts, converter identity, and environment policy remain host-owned behind the same document-conversion seam and are proven with recorded artifact manifests.

Alternatives considered

Default CLI/MCP PDF renderer. Rejected — pulls host policy and non-deterministic subprocess behavior into the product path.
Core-owned converter daemon. Rejected — violates boundary checks and couples portable core to host runtime.