File types
ModelxcelPro produces a handful of file types. The important question is what job each one has: authoritative record, sidecar that must travel with the workbook, or point-in-time export.
Three kinds of artifact
Every file below is one of three things. Read the Class column with this key:
- Source of truth
- The authoritative record. Losing it loses the data - back it up and keep it with the model.
- Sidecar
- A companion file that holds real data and must travel with the workbook to reload.
- Export
- A point-in-time snapshot or report generated on demand. Regenerable from the source.
The complete list
| File | Produced by | Read by | Where it lives | Class |
|---|---|---|---|---|
license.lic | Licensing portal (admin) | Add-in activation / startup | %LocalAppData%\Modelxcel\ModelxcelPro\ | ★ Source of truth |
| Proof ledger | Bind / Sign / Verify | Proof commands, on load | Inside the workbook (hidden custom XML part) | ★ Source of truth |
.mxproof | Proof commands (mirror on save) | Proof, as a fallback for legacy files and offline verification | Beside the workbook or a per-user cache for cloud files | ↔ Sidecar (mirror) |
.mxchecks | Model Sentinel | Model Sentinel, on open; stores adopted checks, declared checks, baselines, and snapshots; Evidence Pack copies it when present | Beside the workbook (same base name) | ↔ Sidecar |
.mxbreaks | Circular Refs - Break Loop | Restore Broken | Beside the workbook (same base name) | ↔ Sidecar |
.mxreview | Review Issues (auto-save) | Review Issues, on open | Beside the workbook (same base name) | ↔ Sidecar |
.mxaudit | Audit Trail (auto-save) | Audit Trail, on open | Beside the workbook (same base name) | ↔ Sidecar |
.mxcmp (.mxcmp.json) | Compare - Save Results | Compare Saved Results | Wherever you save it | ⇩ Export |
.mxreplay | Replay Proof - Export | Viewers / tooling (JSON) | Wherever you save it | ⇩ Export |
.mxreplay.signed | Replay Proof (sibling of .mxreplay) | The standalone verifier (offline) | Beside the .mxreplay you exported | ⇩ Export (signed) |
.mxcert.json | Certificate JSON export | Auditors and tooling | Wherever you save it | ⇩ Export |
.mxcert.signed | Certificate JSON export (sibling of .mxcert.json) | The standalone verifier (offline) | Beside the .mxcert.json you exported | ⇩ Export (signed) |
| Evidence Pack folder | Evidence Pack | Auditors, reviewers, offline Node.js verifiers | Wherever you export the pack | ⇩ Export |
Certificate .xlsx / .pdf | Certificate | Auditors and reviewers | Wherever you save it | ⇩ Export |
Worksheet Maps - <timestamp>.xlsx | Worksheet Map - Export Map | Reviewers and the add-in, to navigate back | The source workbook folder | ⇩ Export |
Comparison_Results.xlsx | Compare - Export Results | Reviewers | Wherever you save it | ⇩ Export |
<workbook>_audit.csv · <workbook>_review.csv | Audit Trail / Review Issues - Export CSV | Spreadsheets / trackers | Wherever you save it | ⇩ Export |
Audit and Review can also export a standalone .xlsx dashboard plus data sheet and in-workbook report sheets. In-workbook report sheets like <source>_Map, MXP Compare, MXP Audit Status, and MXP Review Issues are written into a workbook, not saved as separate files.
Clipboard outputs (not files)
A few commands put results on the clipboard instead of writing a file. These are transient until you paste them:
- Sensitivity - Copy Data copies the full results table as tab-delimited text.
- Worksheet Map - Copy Cell Address / Copy Full Formula copies a single address or formula string.
- Machine code - Copy copies the License Status dialog machine code.
The license file
license.licThe signed entitlement, stored per user. The current format is a v3 ES256-signed JSON envelope; legacy v2 licenses are signed XML. Sibling files in the same folder hold tamper-resistant metadata.license.licSource of truthThe signed license text, verified offline against public keys built into the add-in.license.watermarkMetadataA monotonic last-seen timestamp used to detect a system clock set backwards.trial.datMetadataThe trial start instant, for developer-build local trials.pin.datMetadataThe legacy v2 machine-fingerprint pin used by the move counter. Not used by v3 licenses.
The proof ledger has two homes
Workbook custom XML partAuthoritativeA hidden part inside the .xlsx. Travels with the file automatically - this is the source of truth.<workbook>.mxproofMirror (local)A JSON mirror written beside a locally saved workbook for fallback and command-line tooling.CausalityCache\<guid>.mxproofMirror (cloud)For a workbook at an unresolvable cloud URL, the mirror falls back to a per-user cache under %AppData%\ModelxcelPro.
Because the authoritative ledger is inside the workbook, proof data travels with the file with no extra steps. The Audit & Review sidecars are different: .mxchecks, .mxbreaks, .mxreview, and .mxaudit are separate files and must be kept beside the workbook to reload.
.mxcert, .mxreplay, and signed envelopes
Replay Proof writes two files. The bare .mxreplay is the certificate JSON carrying only a SHA-256 self-hash. The sibling .mxreplay.signed is an Ed25519 signed envelope and is the externally verifiable artifact: a third party can verify it offline, without your workbooks, using the bundled verifier. The envelope embeds only the public key.
The Certificate command’s JSON export also writes a pair: .mxcert.json and a sibling .mxcert.signed envelope. The signed envelope is externally verifiable offline; the branded Excel and PDF certificate formats remain SHA-256 self-hashed only. If the envelope write fails, the bare JSON still exports with a warning. Signing identity is self-asserted, so recipients should confirm the key fingerprint out of band; timestamping, organization identity binding, and revocation remain future work.
Evidence Pack bundles the certificate JSON and signed envelope, a .mxproof ledger snapshot with evidence seals, standalone Node.js verifiers, byte-identical .js.txt fallback copies, and a README. A seal covers ledger records up to sealing time; later records ride the hash chain until the next seal. Replay Proof envelopes are not auto-collected into the pack - verify any .mxreplay.signed files separately with the included replay verifier.
What is safe to share
Share the sidecars with the model - and mind what exports contain
To hand off a model with its review state, share the relevant sidecars alongside the workbook: .mxreview and .mxaudit for issues and audit marks, .mxchecks when Sentinel state matters, and .mxbreaks when someone may need to restore a Break Loop action. Proof data already rides inside the workbook. Exports may contain more than you expect: comparison and certificate reports can include formulas, workbook paths, ledger hashes, and hidden raw JSON. Review an export before sending it outside your organization. The one artifact that is not shareable is license.lic - it is machine-bound and personal.
Where to go next