Bind sources. Anchor reviewer attestations in an append-only hash-chain ledger. Replay material drivers live through Excel. Export a tamper-evident certificate anyone can recompute — no install, no ModelxcelPro required.
The problem
Public studies have estimated material errors in 88-94% of non-trivial spreadsheets. The error rate isn't the only problem — the bigger one is that nobody can prove which inputs and formulas drove the number a reviewer signed off on.
Today
With Proof
=WhyThisNumber() answers it.Three primitives
Every part of the system reduces to one of these three operations. Replay is a fourth, derived from the others.
Pin every input to its source.
causality:bindings.Attest a formula or block.
Recompute, replay, report.
The fourth primitive
Replay is what makes Proof useful in audit and FP&A workflows. The reviewer points at any output that has changed since the last attested state, ModelxcelPro replays the material drivers through live Excel — and for .mxreplay exports, emits an Ed25519-signed envelope any auditor can verify with the shipped Node CLI, no install required.
.mxreplay exports also write a sibling .mxreplay.signed envelope with a real Ed25519 asymmetric signature (BouncyCastle Ed25519Signer) over the canonical certificate plus envelope metadata. The public key is embedded in the envelope. Per-user keypair, private key sealed with DPAPI in %APPDATA%\\ModelxcelPro\\keys\\.tools/verify-replay/verify-replay.js — zero npm dependencies, uses Node’s stdlib crypto. Any auditor can run it against any .mxreplay.signed envelope without installing ModelxcelPro: rejects duplicate top-level keys, checks algorithm/canonicalization/version, recomputes the keyId, reconstructs the signed payload, and verifies the Ed25519 signature..mxreplay JSON paired with the signed envelope, or optional XLSX / PDF) that travels with the workpaper. Issuance writes a CertificateIssued record back into the workbook ledger so the audit trail captures every export.What this verification does and doesn’t prove. The Ed25519 signature proves the envelope was signed by the private key matching the embedded public key. It does not prove that public key belongs to a trusted reviewer or organization, and it does not check revocation. Public-key trust, organizational identity binding, and revocation are the future enterprise layer; what we ship today is honest cryptographic integrity for the artifact, plus a verifier the receiving party can run against it.
The formal model-audit question. A formal model audit can produce a signed opinion letter, an external liability framework, and a full consulting engagement. Replay Proof does not replace that liability transfer. It is the desktop evidence layer that runs between formal audit events, with a signed artifact the auditor can verify themselves.
The Microsoft question. Excel’s native digital signatures sign the file: “you were the last person to make changes.” Replay Proof signs the derivation: why the number is what it is. File integrity vs cell-level causal evidence — both real, different jobs.
The inspection surface
Proof is invisible until you have a place to look at it. TrustLens is that place. Reachable from six entry points across the product — Worksheet Map peek, Cell Search right-click, Compare delta drill-in, Formula Explorer purple button, Ribbon, Ctrl+Shift+I — every node shows live proof state with per-node badges (Bound / Stale / Signed / Vector / Tampered). The Path tab is full counterfactual reasoning: which IF branch fires today, what would flip it, which IFERROR fallback caught the error, which SUMIFS criteria pair matched.
Worksheet Map peeks. Cell Search drills. Compare delta opens. Formula Explorer hands off. Every analysis path on the moat ends in the same workbench — with the same Proof tab, the same drift detection, the same evidence-path timeline. The ledger isn’t a separate report you have to open; it’s the layer underneath every cell you inspect.
The ledger
Every Bind, Sign, and Verify writes one record to causality:bindings. Each record\'s hash includes the prior record\'s hash — reordering or tampering invalidates the chain.
Verify Ledger recomputes the chain locally. If anyone has edited the XML by hand or tools have stripped a record, the head hash won\'t match and the verdict is tampered.
Sample envelope + verifier
A signed JSON envelope (.mxreplay.signed) carrying the canonical replay certificate, the Ed25519 signature, the embedded public key, and metadata. Below is a redacted example. The shipped Node verifier runs locally — no ModelxcelPro install, no npm install required.
{
"algorithm": "Ed25519",
"canonicalization": "modelxcelpro.replay.canonical/v1",
"envelopeVersion": 1,
"keyId": "5f2c8e1a3b4d7090",
"publicKey": "MCowBQYDK2VwAyEA…GtXz4",
"signature": "5c1f…a3e9",
"signedAt": "2026-05-10T14:22:08Z",
"signedBy": "ana@modelxcel.com",
"certificate": {
"schema": "modelxcelpro.replay.certificate/v1",
"output": { "address": "Outputs!B12", "before": 412800000, "after": 410200000 },
"drivers": [
{ "address": "Inputs!C7", "claim": "Revenue growth assumption", "contribution": -2100000 },
{ "address": "Inputs!C9", "claim": "Working-capital days", "contribution": -500000 }
],
"ledgerHead": "0x8f92…b401",
"issuedAt": "2026-05-10T14:22:08Z",
"certificateHash": "d3a8c…0f12"
}
}# Verify a ModelxcelPro Replay Proof signed envelope from the command line
# Requires: Node 20+ (no npm install — uses Node's built-in crypto)
# Verifier is shipped in the ModelxcelPro repo at tools/verify-replay/verify-replay.js
node tools/verify-replay/verify-replay.js sample.mxreplay.signed
# Output:
# [verify-replay] algorithm: Ed25519
# [verify-replay] verified: true
# What it does:
# 1. Rejects duplicate top-level keys in the envelope
# 2. Checks algorithm/canonicalization/envelope version match the spec
# 3. Recomputes keyId = SHA-256(publicKey)[0:16] and confirms it matches
# 4. Reconstructs the signed payload bytes per the canonicalization spec
# 5. Verifies the Ed25519 signature against the embedded public keyThe verifier is shipped in the ModelxcelPro repo at tools/verify-replay/verify-replay.js — zero npm dependencies, uses Node’s built-in crypto. A committed sample tools/verify-replay/sample.mxreplay.signed demonstrates the round-trip. Replace it with any real .mxreplay.signed from a signed workbook export and the same script verifies it the same way.
What this means for
Recompute, reperformance, vouch — the three things audit standards (PCAOB AS 2315) ask you to do, baked into a verifiable artifact. Proof Coverage gives a defensible % bound / % attested metric. Verify Ledger detects tampering or reordering by recomputing the hash chain — not heuristic. The certificate attaches to the workpaper as evidence that survives discovery and email handoff.
When forecasted EBITDA moved between Tuesday\'s board pre-read and Thursday\'s actual board meeting, you don\'t guess which assumption changed. =WhyThisNumber() answers it before the meeting starts.
Sign Block once for the output region, export the certificate, attach it to the deal folder. Five years later, when someone asks why a sculpted DSCR row says what it says, the signed proof chain is still in the workbook.
Technical FAQ
{address, formulaR1C1, value, timestamp, reviewer}) appended to a hash-chained ledger; each entry’s hash includes the prior entry’s — standard Merkle-style tamper detection. Replay certificates carry a SHA-256 self-hash over their canonicalized JSON. Replay Proof .mxreplay exports also write a sibling .mxreplay.signed envelope with a real Ed25519 asymmetric signature (BouncyCastle Ed25519Signer) over the canonical certificate plus envelope metadata; the public key is embedded in the envelope so a third party can verify without ModelxcelPro installed. Sign Cell, Sign Block, and Export Proof Certificate use the hash-chain layer only — Ed25519 reviewer-identity signatures across those flows are a future enterprise layer.causality:bindings. The file remains a normal .xlsx — you can email it, share it on OneDrive, or commit it to git, and the proof history travels with it. No external database. No vendor lock-in.causality:bindings. Any mid-chain edit changes every subsequent hash; the head hash recorded on disk no longer matches what Verify Ledger recomputes. Tampering, reordering, and strip-and-replace attacks all surface as a head-hash mismatch. Replay Proof .mxreplay.signed envelopes already bind a real Ed25519 asymmetric signature to the certificate (so a stranger with the embedded public key can confirm the envelope was signed by the matching private key); extending the same Ed25519 layer to Sign Cell / Sign Block ledger records is a future enterprise feature.crypto, OpenSSL, Python hashlib) — recompute the hash over the canonicalized payload and compare. For Replay Proof .mxreplay.signedenvelopes, ModelxcelPro ships a zero-dependency Node verifier at tools/verify-replay/verify-replay.js that uses Node’s stdlib crypto to validate the Ed25519 signature against the embedded public key — no npm install, no ModelxcelPro install, just Node 20+. Verification proves the envelope was signed by the private key matching the embedded public key; whether that public key belongs to a trusted reviewer is an organizational trust question this layer intentionally doesn’t solve.ModelxcelPro.Core/Services/Causality/* in the desktop add-in repo.