Release note · August 1, 2026

A Word document can carry a task graph—and an add-in

A clean paragraph count and a clean comment count do not necessarily mean a Word file is free of workflow state. A modern comment can become an assigned task; a document can retain task history, users, titles, dates, progress, and comment anchors in a separate OOXML part. It can also retain configuration for an embedded Office task pane and the content controls associated with it.

DocFence 0.10 makes both surfaces review-visible as bounded, private evidence. It reports aggregate counts useful to a CI gate, while the task and add-in material itself remains inside local SHA-256 comparison signatures.

Two kinds of state outside the document text

Microsoft’s modern-comments guidance describes assigning a comment as a task. The corresponding document-task OOXML contract stores tasks, histories, attribution, assignments, schedules, progress, priority, deletion, and undo events. That is useful workflow data, but it is a separate handoff surface from comment text.

Office add-ins have a separate package representation. Microsoft’s web-extension OOXML contract defines stored extension references, properties, bindings, and task panes. Word’s own removable-document-information model lists both document tasks and task-pane web extensions. A file can therefore carry a review/workflow boundary that is neither visible prose nor an external link.

Counts for a gate, private signatures for the actual comparison

DocFence profiles a document-task part as aggregate task, history-event, user-reference, comment-anchor, and event-category counts. It never prints task IDs, event IDs, user IDs or names, titles, schedule dates, priority, progress, or comment IDs. A same-count rewrite still changes the private inventory, so a baseline gate can notice it without turning CI output into a copy of task data.

The task-pane inventory reports only aggregate task-pane, visible/locked-pane, web-extension-part, store-reference, property, binding, enabled auto-show-property, and Word content-control marker counts. Extension IDs, stores, property names and values, binding references, pane layout values, marker values, relationship IDs, and package paths are withheld. Relationship-ID renumbering alone remains quiet because DocFence compares the normalized relationship semantics instead of the transient ID.

Two precise policy choices

For a publishing or clean-handoff boundary, reject either class of retained state outright:

rules:
  require_no_document_tasks: true
  require_no_taskpane_web_extensions: true

These produce DFP031 and DFP033. For a controlled template that intentionally contains approved workflow or add-in configuration, freeze the baseline instead:

rules:
  no_document_task_changes: true
  no_taskpane_web_extension_changes: true

DFP032 and DFP034 then block a later private-inventory mutation, even when public counts match. The normal content, comments, external relationships, and other DocFence inventories remain independent, so a team can choose the narrow rule it actually means.

Strict package evidence, not Office automation

DocFence finds recognized parts through standard content types, relationship types, and conventional Word paths. It validates document-task, task-pane, and web-extension roots; a direct task-pane reference must resolve through the expected internal relationship or parsing fails closed. It accepts both the established webextension task-pane spelling and webextensionref. For a Word content control, an enabled w15:webExtensionCreated marker takes precedence over w15:webExtensionLinked.

This is intentionally stored-state evidence, not an add-in sandbox or a task client. DocFence does not install, load, execute, authenticate to, fetch, validate, or judge an add-in. It does not assign, complete, synchronize, or notify on a task. An enabled Office.AutoShowTaskpaneWithDocument property is counted as stored configuration only; it is not a claim that a particular Word client will open a pane. Microsoft’s auto-open guidance is useful context for why that distinction matters.

Release evidence

The 0.10 regression suite covers semantic same-count mutations, JSON/Markdown/SARIF redaction, policy findings, noncanonical and unlinked conventional discovery, extensionless paths, both task-pane reference spellings, marker precedence, malformed roots and references, external recognized relationships, and relationship-ID churn. The final wheel was installed outside its source tree and profiled against a package carrying both inventories. The wheel and source archive were rebuilt from the release commit and matched byte-for-byte.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.10.0/docfence-0.10.0-py3-none-any.whl

docfence profile candidate.docx --format markdown
docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The public release includes the wheel, source archive, and SHA-256 manifest. The precise rule semantics and limits are in the policy reference and threat model. For the preceding review-metadata boundary, read A Word comment can retain a hidden review graph.