Certificate

Export a shareable snapshot of the workbook's proof state - what was bound, what was signed, the coverage, and the ledger's integrity verdict - as JSON, a branded Excel workbook, or PDF.

What it does

Builds a certificate from the current proof ledger and exports it. The certificate captures identity metadata, the ledger anchor (head hash, record count, first/last timestamps), the chain verdict (intact / tampered), coverage including percentages, and the lists of bound inputs, bound vectors, signed cells, and signed blocks. Issuing a certificate also appends a CertificateIssued record to the ledger, which is the tamper-evident audit trail (the exported file is a copy).

If a Model Sentinel snapshot is present, the certificate summary separates checks adopted from the model's own check system from checks declared by the user. The pass/fail/error/not-evaluable and new-failure counts still describe the watched set at issuance.

Export formats

  • JSON - writes the bare {name}.mxcert.json certificate and a sibling Ed25519 {name}.mxcert.signed envelope for independent offline verification.
  • Excel workbook - a branded multi-sheet summary (dashboard, bindings, vectors, signatures, signed blocks).
  • PDF - a printable bundle of those sheets.

JSON export is externally verifiable

The .mxcert.signed envelope signs the certificate content with the same local Ed25519 reviewer key family used by Replay Proof. It embeds the public key and signature, so a third party can verify the envelope without Excel, the workbook, or the add-in. The companion Evidence Pack includes the certificate, the signed envelope, the sealed ledger snapshot, and standalone Node.js verifiers.

Steps

  1. With proof records present in the workbook, ModelXcel Pro > Proof > Certificate.
  2. Optionally enter who it’s issued to and a purpose.
  3. Choose a format and save location.
  4. If you choose JSON, keep the .mxcert.json and .mxcert.signed files together.

Scope and failure modes

The signed envelope is written for JSON certificate exports only; branded Excel and PDF certificate formats remain SHA-256 self-hash only. If the envelope cannot be written, the bare JSON still exports and the add-in surfaces a warning. Signing identity is self-asserted, so recipients should confirm the key fingerprint out of band. Timestamping, organization identity binding, and revocation remain future work.

What it proves

It attests the ledger state at a point in time: which inputs were bound (with SHA-256 snapshots), which cells were signed, the coverage, and that the chain was intact. If the ledger has been sealed, that seal covers records up to its sealing time; later records ride the hash chain until the next seal. It does not prove that formulas, assumptions, or outputs are correct, that source data is accurate, or anything about model design. See What proof proves - and what it doesn’t.