# Oryseal file workflows

## Encrypt

Choose a local file on `/seal`, select the available protection profile, start encryption, then download both outputs. Keep the `.oryseal` capsule separate from the `.oryseal-key` decryption key.

## Decrypt

Choose the capsule on `/open`, enter its matching key, and start decryption. The recovered download appears only after the format and authentication checks finish successfully.

## Verify

Choose a capsule on `/verify` to inspect its public structure and profile without supplying a key. This workflow does not reveal plaintext.

## Agent-assisted preparation

In a WebMCP-capable browser, `oryseal_prepare_workflow` opens one of these pages and focuses the next step. `oryseal_get_workflow_state` reports only the route, workflow stage, available profile, and next action. `oryseal_apply_decryption_key` can use the clipboard or the last key held by this tab without returning its value. `oryseal_run_ready_workflow` starts a ready local operation, and `oryseal_download_result` triggers its visible result download.

File selection remains governed by the browser file chooser. A browser-control agent can complete it when the user has authorized a local path. WebMCP results do not include file metadata, file contents, keys, clipboard data, browser storage, result bytes, or blob URLs. Oryseal does not publish a remote cryptography or MCP endpoint.