L03-13e — Run encrypt, optimize, sanitize, and remove-external-links as governed Fix operations #236

Outcome

Document-level operations that PdfTool already runs are available in the Fix workspace through the L04 governed gateway.

Parent and boundary

Parent: #231. Owner: LoopEditor. This issue owns one bounded slice of Quick Workspace; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Grounding

• No handler: actionEncryption, actionOptimize, actionOptimizeImages, actionSanitize, actionRemoveExternalLinks (ABSORB, target Fix).
• PdfTool has encrypt and optimize commands; docs/QUICK_PDF_PARITY.md excludes sanitization and optimization from Quick.
• L13-05c — Remove JavaScript and forbidden PDF actions safely #173 (L13-05c) owns removal of JavaScript and forbidden actions; sanitize must not duplicate it.

Acceptance

• Each command opens a plan in Fix and publishes only through Core's approved execution path (L04-05 — Centralize approved Core execution #37).
• Editor and PdfTool produce the same plan digest and output bytes for the same input and parameters.
• Encryption parameters never appear in logs, receipts, or plan text.
• Failure case: cancelling before commit leaves the input byte-identical (see Add per-command cancellation regression tests for PdfTool decrypt, encrypt and optimize #229).

Required proof

Cross-surface parity fixtures per operation; cancellation test; quick lane. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap · Gap review of docs/loop-shell-actions.json against Quick command handlers, 2026-10-06.