Proof & Trust · Ribbon group: Proof
Bind, sign, and prove every number.
The cryptographic moat. Bind inputs to their source with SHA-256, anchor reviewer attestations in an append-only hash-chain ledger, replay material change drivers live through Excel, and export tamper-evident certificates. Proof of derivation travels with the workbook.
Proof & Trust
Bind, sign, and prove every number.
Demo comingFlagship features
The 6 that matter most.
The features inside this capability that drive the most buyer interest.
Why This Number
Click any cell, see the full causal chain — sources, formulas, signatures, and timestamps.
Bind Source
Pin an input to a URL, file, prior workbook, or note — SHA-256 snapshot detects drift.
Sign Formula Block
Attest a contiguous range sharing the same R1C1 formula — the analyst signs once for the whole block. Each block carries a signature hash over scope + master R1C1 + variants; R1C1 divergence on any cell in the block surfaces as drift on next verify.
Proof Coverage
Workbook-wide score: percent inputs bound, percent formulas signed.
Export Proof Certificate
Snapshot the workbook's current Proof state into a portable certificate. JSON export writes both `{name}.mxcert.json` and a sibling Ed25519 `{name}.mxcert.signed` envelope that can be verified offline without Excel; PDF and branded Excel certificate formats remain self-hash only, and if envelope signing fails the bare JSON still exports with a warning. Signer identity is self-asserted, so recipients confirm the key fingerprint out of band; timestamping, identity binding, and revocation remain future work.
Evidence Pack
Export a one-folder audit handoff: certificate JSON plus `.mxcert.signed`, a `.mxproof` ledger snapshot with evidence seals, and standalone Node.js verifiers with byte-identical `.js.txt` fallback copies. Recipients need no Excel or add-in, but signing identities are self-asserted and must be matched to a key fingerprint out of band. Certificate-envelope limits still apply: JSON only, PDF/branded certificates stay self-hash only, envelope failures warn instead of blocking export, seals cover records up to sealing time, and timestamping, identity binding, and revocation remain future work. Replay Proof envelopes are verified separately, not auto-collected into the pack.
Also in this capability
6 more features.
- Bind VectorBind a contiguous input range as one atomic unit; one edit invalidates the whole vector.
- Sign CellAppend a reviewer attestation to one cell with claim text and notes. The attestation is anchored to the workbook's append-only hash-chain ledger — any subsequent edit to the formula's canonical R1C1 form breaks the chain on next verify.
- Replay ProofPick any output cell that has changed. Replay Proof saves a copy of the baseline workbook to temp, opens it in live Excel, applies each revised driver, and recalculates the output after each step — actual formulas, UDFs, and named ranges executing in Excel, not a simulator. Up to 8 ranked drivers; per-driver dependency path from input to output; per-driver trust status (vector fresh/broken, block signed/broken, bound, no record). Two layers of integrity: every export is a tamper-evident SHA-256 self-hash certificate, and `.mxreplay` exports also write a sibling `.mxreplay.signed` envelope — a real Ed25519 asymmetric signature (BouncyCastle Ed25519Signer) over the canonical certificate plus envelope metadata, with the public key embedded in the envelope. Per-user keypair generated on first launch, private key sealed with DPAPI at `%APPDATA%\ModelxcelPro\keys\`. The repo ships a zero-dependency Node verifier (`tools/verify-replay/verify-replay.js`) that any auditor can run against `.mxreplay.signed` without installing ModelxcelPro. Issuance writes a CertificateIssued record back into the workbook ledger so the audit trail captures every export.
- Verify All Vectors & BlocksBulk recompute every bound vector and signed block; flag drift in one pass.
- Verify LedgerRecompute the workbook's hash chain, check every Ed25519 evidence seal, and report whether proof records were tampered with or reordered.
- Seal LedgerSign the ledger's current head hash with your Ed25519 reviewer key, creating an evidence seal over every record so far. A seal proves ledger state at sealing time as attested by that key; signer names are self-asserted, records appended later ride the hash chain until the next seal, and timestamping, identity binding, and revocation remain future work.
Same product, more capabilities