Verify & coverage

Check whether anything has changed since it was bound or signed, see how much of the model is covered, and confirm the ledger itself hasn’t been tampered with.

Verify Workbook

What it does

Re-checks every active binding, vector, and signed block on every sheet against the hashes recorded in the ledger, and appends a counter-record for anything that has changed:

  • Bindings — recomputes the cell hash; a mismatch records SourceDrifted (classified as value, formula, type-change, or unreadable).
  • Vectors — recomputes the range’s content hash; a mismatch records VectorBroken.
  • Blocks — re-checks the signature hash and that every cell still matches the master formula; a hardcode plug or R1C1 divergence records BlockBroken.

It then shows a summary (fresh/broken/drifted counts and the first findings).

What Verify Workbook does not do

It does not execute or recalculate formulas, and it does not re-fetch external source files or URLs — it compares the workbook’s current cells against the hashes already in the ledger. (External source bytes are hashed only at bind time.) It is a detector, not a preventer: it records that a change happened, after the fact, as tamper-evident history. It does not check who made a change or whether it was authorized.

Coverage

Reports, from the ledger, raw counts — how many inputs are bound and how many cells are actively signed — together with the ledger record count and the chain status.

Counts, not percentages

The Coverage dialog shows counts and chain status only — not percentages. Percentage coverage (relative to total inputs/formulas) is computed and shown in the Certificate export, not here. Coverage also counts single-cell bindings and signatures; revoked signatures are not counted.

Verify Ledger

What it does

Walks the proof ledger from the first record and recomputes the SHA-256 hash chain: each record links to the previous record’s hash, so editing any field or re-ordering/inserting/deleting a record breaks the chain from that point on. It reports the record count, the head hash, and an intact / tampered verdict (with the first broken record on failure).

Caveats

  • It checks ledger math only — not cell content or external source hashes, and not signature authority.
  • An empty ledger reports as intact (there is nothing to break).
  • It verifies the ledger already loaded from the workbook’s CustomXMLPart (or .mxproof fallback); it does not re-read from disk.