Local folders

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the documents in a folder on the deployment’s own storage: manuals dropped into an inbox, meeting transcripts, an export from another system, a synced Drive or SharePoint library. Each file becomes one document. It is the common landing place for anything that arrives as files, and it uses no network at all.

At a glance

Collector	Local folders, version 1.0.0
Reads	Atlantic Agentic Labs: Drop folder (files on the deployment's disk) (the vendor's documentation)
Family	Storage
Kind	Files
Ways to connect	None (no credential)
Scopes	Read:
Read only	Yes
Vendor's API can move money	No
Personal data	Content
Hosts it may contact	localhost
Vendor API versions	none (local files)
Lowest engine version	0.45.0

What it reads

• Every file of an accepted type in the folder and its subfolders: .md, .txt and .vtt as text, and .pdf through pdftotext -layout.
• A file may begin with front matter that sets its own title and a class (doc_class, label or sensitivity); your label scheme still decides whether that class is readable.
• A file is read again only when its SHA-256 changes. A file that disappears becomes a tombstone, so the knowledge base stops citing a document that was withdrawn.
• Files whose names start with . are ignored.

How to connect

1. Put the folder where the deployment can read it (path is relative to the deployment’s working directory, or absolute).
2. Add a source card with kind: folder, the path, a label, and the requires block naming what is read and why.
3. The source is named folder-<directory name> unless you give it a name.

No credential is involved. Install pdftotext (poppler) in the image if the folder holds PDFs.

Permissions

Read access to the folder, and nothing else. The collector opens files for reading only; it never writes, renames or deletes in the folder, and it makes no network request. Its read-only test runs it against a folder the operating system will not let it write to and checks the folder is unchanged.

Limits

• A file of a type the collector cannot read fails the pull, and the error names the file (is not an accepted format here), because an unreadable document skipped silently is a gap nobody hears about. Narrow suffixes to accept fewer types.
• PDFs need pdftotext and take at most 300 seconds a file.
• There is no size limit per file; a very large folder is read in one pull.
• The change test is the content hash, so a file touched but not edited costs a read of its bytes and nothing more.

Data handling

• Everything stays in the deployment: the folder and the corpus written from it are on its own storage. Only the counts (written, unchanged, quarantined, removed) reach LightHouse.
• The document text may hold personal data of any kind; it is labelled by the source’s label (or the file’s own class) and handled under that label’s rules.

Troubleshooting

What you see	What it means	What to do
is not an accepted format here	A file in the folder has a suffix the source does not accept	Remove it, or move it out; or accept the suffix if the collector can read it
no reader for	The suffix is accepted by suffixes but the collector has no reader for it	Convert the file to text or PDF
pdftotext is not installed	A PDF was found and the tool is not in the image	Install poppler-utils in the deployment image
Read succeeded, 0 written	No file changed since the last read	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.45.0	none (local files)	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only