Release note · August 3, 2026

A Word schema association is a review boundary

A Word document can retain a stored association between its custom XML markup and a schema target namespace. That association can change while ordinary document text and the rest of the package remain stable. It belongs in a package review—but it does not make a static reviewer a schema resolver, loader, or validator.

DocFence 0.29 adds a private-by-default inventory for direct w:attachedSchema elements in Word Settings parts. It provides a durable CI signal for a narrow stored-state boundary without disclosing namespace identifiers in public output.

A stored association, deliberately not a validation run

Microsoft’s Open XML SDK documentation identifies AttachedSchema as an attached custom XML schema. The Word object model exposes a corresponding AttachToDocument operation, and Word’s XML APIs have a separate validation operation. Those references establish why the stored element is worth reviewing; they do not establish that a given schema is available, valid, loaded, or applied in a particular environment.

word/settings.xml
  w:attachedSchema w:val="target namespace"   one or more direct entries

No relationship target is required for this stored association.

DocFence accepts the standard CT_String leaf shape in Transitional and Strict Word namespaces: exactly one Word-namespace w:val attribute, with no child markup or nonblank text. It inventories the stored topology only. It never locates a schema, resolves a namespace, retrieves anything, loads a schema, validates document XML, opens Word, or predicts client behavior.

Aggregate evidence that can still detect a rewrite

Public JSON, Markdown, and SARIF report one count: attached_custom_xml_schema_count. Namespace identifiers, Settings-part paths, and private fingerprints stay local. A same-count namespace rewrite still changes the private semantic inventory and is visible in a diff; a public report never needs to publish the value that changed.

That leads to two small, readable policies:

rules:
  require_no_attached_custom_xml_schemas: true

The candidate-state gate emits DFP071 when any stored association is present. A team that deliberately retains a known association can instead protect its baseline:

rules:
  no_attached_custom_xml_schema_changes: true

DFP072 flags a material private-inventory transition. Neither rule judges a schema safe or unsafe; each makes a previously quiet configuration boundary visible in a policy that reviewers can inspect.

Evidence that preserves the boundary

The 55-test release suite covers conventional and Strict forms, multiple associations, malformed leaf rejection, same-count rewrites, privacy redaction, policy behavior, and JSON/Markdown/SARIF output. Hosted CI passed for the release commit and tag, and fresh wheel and source-distribution installs completed the package smoke checks.

Document Change Assurance Benchmark 0.19.0 supplies a matching deterministic fixture that changes one synthetic namespace while retaining the same count. Its optional DocFence adapter consumes only aggregate evidence; it does not read a namespace, path, or fingerprint.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.29.0/docfence-0.29.0-py3-none-any.whl

docfence profile candidate.docx --format markdown
docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The public release includes the wheel and source archive. The tagged policy reference, threat model, and validation notes define the exact evidence contract and its limits.