Release note · August 1, 2026
A Word comment can retain a hidden review graph
A visible comment count is not the whole review surface in a current Word file. Modern comments can retain people records, thread and resolution state, durable comment identifiers, and reactions in separate OOXML package parts. That is useful product behavior, but it leaves a serious handoff question: does a document carry review metadata that an ordinary comment scan does not describe?
DocFence 0.9.0 adds a bounded answer. It inventories the modern-comment people, commentsExtended, commentsIds, and commentsExtensible parts and reports aggregate counts only. Names, contact providers, user IDs, paragraph and durable IDs, dates, thread associations, reaction details, paths, XML, and fingerprints stay private inside the local comparison.
Separate package parts, separate review evidence
Microsoft’s modern-comments overview describes an active conversation model with replies and resolved comments. The corresponding OOXML contracts define a people part, a thread/extension part, a comment-ID part, and an extensible-comment part. Microsoft’s reaction extension example shows why this is not just a count of comment text: review metadata can include user and time information.
DocFence finds those parts through their standard content types, relationship types, or conventional Word paths. It validates each recognized root and rejects a recognized metadata relationship that is external or does not resolve to a stored part. It supports both the established Office 15 2010/11 people/thread vocabulary and the current 2012 vocabulary, because real template packages still contain the former.
Counts in reports, identities in the private signature
A profile can say that a candidate has two person records, six thread-extension records, one resolved comment, or three reaction users. It cannot say who they are, which comment they belong to, or where they live in the ZIP package. The private comparison signature deliberately retains the sensitive material so that changing an identifier or reaction with the same public counts still produces a review-visible change. Renumbering an OOXML relationship ID alone stays quiet.
This is a narrow stored-state inventory, not a cloud client or a Word emulator. DocFence does not render a comment, resolve a person, synchronize an account, decide whether a notification will fire, interpret an unknown extension payload, or alter comment state. A nonzero count is evidence that metadata is stored in the package—not proof that it is visible or live in a particular Word client.
Choose a clean handoff or a protected baseline
For a release that must not retain modern-comment review state, add this policy:
rules:
require_no_modern_comment_metadata: trueDFP029 fails when any of the public modern-comment counts is nonzero. For a controlled template that intentionally retains approved review state, preserve a baseline and use:
rules:
no_modern_comment_metadata_changes: trueDFP030 then fails when the private inventory changes, even if aggregate counts happen to match. The ordinary comments-story count remains separate, so teams can express the precise review rule they mean.
Templates deserve the same boundary
The same release adds bounded scanning for .dotx and .dotm Word templates alongside .docx and .docm. Templates are often where a review workflow begins and where residual metadata survives longest; treating them as first-class inputs makes a handoff policy usable before a document is instantiated.
The release regression suite covers all four metadata parts, content-type, relationship, and unlinked conventional-path discovery, legacy and current vocabularies, malformed roots, rejected external relationships, templates, same-count metadata and identifier rewrites, policy findings, SARIF, and report redaction. The final wheel was installed outside its source tree and profiled against an Office 15 Open XML SDK template and an independent modern-comment template. The wheel and source archive were rebuilt twice from the release commit and matched byte-for-byte; the release contains both artifacts and a SHA-256 manifest.
Use the release
python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.9.0/docfence-0.9.0-py3-none-any.whl
docfence profile review-template.dotx --format markdown
docfence check approved.dotx candidate.dotx --policy docfence.yml --format sarif --output docfence.sarifThe complete scope is in the policy reference and threat model. DocFence is local, bounded evidence about stored OOXML state—not a rendering verdict or a telemetry product. It is MIT-licensed and available on GitHub. For the preceding field-instruction boundary, read A Word field can quietly consult the outside world.