Proof & Trust

The Proof group lets you record where a model's inputs come from, attest the formulas a reviewer has checked, seal the ledger state, and hand auditors signed artifacts they can verify offline.

What the Proof system does

As you build or review a model, ModelxcelPro can record two kinds of workbook evidence: a binding that pins a hardcoded input to an external source with a SHA-256 snapshot, and a signature in which a reviewer attests a formula or a block of formulas. Both are written to an append-only proof ledger. On save, the ledger is persisted inside the workbook itself in a hidden CustomXMLPart, so it travels with the file through rename or email, and mirrored to a .mxproof sidecar for fallback and command-line tooling. Because the ledger is a hash chain, any later edit, re-order, or tampering is detectable.

The end-to-end workflow

  1. Bind sources. Use Bind Source for a single input or Bind Vector for a contiguous row/column. A SHA-256 snapshot of the source is pinned so later drift is detectable.
  2. Sign reviewed formulas. Use Sign Cell for one cell or Sign Block for a contiguous run sharing one formula. The signature records the formula, who signed, and what they are attesting.
  3. Check a result. Why This Number shows the proof chain for the selected cell and a per-node trust verdict without changing anything.
  4. Verify. Verify Workbook re-reads every bound vector and signed block and records counter-entries for anything that drifted; Verify Ledger recomputes the hash chain and checks every evidence seal.
  5. Seal. Seal Ledger signs the current ledger head hash with your Ed25519 reviewer key, creating an evidence seal over the records so far.
  6. Certify or hand off. Certificate JSON export writes .mxcert.json plus a signed .mxcert.signed envelope. Evidence Pack exports the certificate, sealed ledger snapshot, and offline Node.js verifiers in one folder.

Separately, Replay Proof replays the material changed drivers of an output through Excel and issues a signed certificate explaining that specific output delta.

Where proof data is stored

  • The proof ledger - an append-only, hash-chained record stored authoritatively inside the workbook and mirrored to a .mxproof sidecar next to the workbook for fallback and CLI tooling.
  • Certificate exports - JSON produces .mxcert.json and a signed .mxcert.signed envelope; branded Excel and PDF certificate formats are self-hash only.
  • Evidence Pack - a folder containing the certificate JSON, signed envelope, .mxproof snapshot with evidence seals, verifiers, and a README.
  • .mxreplay / .mxreplay.signed - the certificate pair produced by Replay Proof for a specific output movement.

Which cryptography is used where

The proof ledger is a SHA-256 hash chain, and bindings pin a SHA-256 snapshot of the source. Seal Ledger signs the ledger head hash with Ed25519, covering records up to sealing time. Certificate JSON export writes a signed Ed25519 .mxcert.signed envelope beside the bare JSON; PDF and branded Excel certificate formats remain self-hash only. Replay Proof produces a signed .mxreplay.signed envelope for one output movement. License files are signed separately (ES256).

Trust boundary

Proof signing identities are self-asserted; recipients should confirm key fingerprints out of band. If a certificate envelope cannot be written, the bare JSON export still succeeds with a warning. A ledger seal covers only records up to sealing time; later records ride the hash chain until the next seal. Timestamping, organization identity binding, and revocation remain future work.

What proof proves - and what it doesn’t

Be precise with reviewers and auditors about what the Proof system establishes.

It proves:

  • that a named reviewer attested to a cell or block at the time they signed it;
  • that a signed block’s cells all shared one master formula when signed;
  • that an input was bound to a specific source with a pinned SHA-256 snapshot;
  • that the ledger has not been silently altered or re-ordered;
  • that sealed ledger prefixes were attested by the sealing key;
  • that a specific output movement can be reconciled by replaying its changed drivers.

It does not prove that formulas, assumptions, or outputs are correct; that source data is accurate; that a reviewer had authority or competence; or that the model is complete or well-designed. Signing also does not lock cells or prevent future edits - it makes later changes detectable, not impossible.

Feature pages