- SHFormat boundary
- Certificate JSON and Replay Proof exports have signed envelopes; Certificate PDF and branded Excel formats remain SHA-256 self-hash only.
- EDEd25519 envelope
- Certificate JSON writes .mxcert.signed and Replay Proof writes .mxreplay.signed. Verification confirms the envelope bytes and embedded public key signature, not the business correctness of the workbook.
- FPFingerprint check
- Proof signer identity is self-asserted. Recipients should confirm the key fingerprint out of band; timestamping, identity binding, and revocation remain future work.
- HXHeuristic lens
- Risk Heatmap and Model Health identify review priorities. They do not prove formulas or assumptions are right.
- SCScope caveat
- Worksheet Map analyzes an active worksheet and exports selected map sheets; Trace surfaces external references but does not turn closed workbooks into dependency graphs.
What you seeA red Risk Heatmap cluster or a low health score.
What it meansThe model has a concentration of formulas, errors, hardcodes, external links, or other review flags.
What to do nextOpen TrustLens, Worksheet Map, Cell Search, or Review Issues. Do not treat the color as a correctness verdict.
What you seeCoverage shows a percentage of inputs bound or formulas signed.
What it meansSome parts of the workbook have proof records and can be verified for drift.
What to do nextUse Verify Workbook and Verify Ledger, then review the unsigned or unbound areas deliberately.
What you seeCertificate and Replay Proof are both available.
What it meansCertificate JSON exports can include a signed .mxcert.signed proof-state envelope; Replay Proof signs a specific output-delta replay.
What to do nextUse Certificate for workbook-state handoff, .mxreplay.signed for output movement, or the Evidence Pack when reviewers need the certificate, sealed ledger, and offline verifiers together.