Release note · August 4, 2026

A type selector is not an attribute

By SybilGambleyyu · DocFence 0.41.0 and DCAB 0.31.0

Package-signature review has a small but important XML distinction. In an OPC relationships transform, an individual relationship is selected with RelationshipReference/@SourceId. A relationship type is selected with the separate RelationshipsGroupReference/@SourceType element. Treating those as interchangeable accepts a shape the format does not define.

DocFence 0.41 corrects that boundary, and Document Change Assurance Benchmark (DCAB) 0.31 adds an independently generated test case for it. The change is intentionally narrow: it makes one standards-defined static declaration auditable. It does not turn a declaration into cryptographic validation or a client-trust decision.

Correction, August 4, 2026: 0.41 corrected the selector-element form but did not require the standard canonicalization transform immediately after a relationship transform. DocFence 0.42 now treats missing, misordered, duplicate-list, or otherwise unsupported transform sequences as unsupported rather than crediting coverage. The 0.41 parser did not claim to verify a signature, but its selector audit was broader than this OPC sequencing requirement.

The two selector forms

The OPC Relationships Transform Algorithm filters stored relationship elements when their @Id matches a declared @SourceId or their @Type matches a declared @SourceType; both comparisons are case-sensitive. The accompanying digital-signature markup defines two distinct selector elements:

DocFence now accepts exactly those bounded forms in its static declaration audit. A SourceType attribute placed on RelationshipReference is not credited with coverage; it is reported only as an unsupported reference. This preserves a fail-closed result without silently inventing a selector rule.

Why equal counts can still hide a change

DCAB 0.31 adds review.package_signature_relationship_type_coverage_reassigned, the corpus’s 42nd deterministic pair. Its baseline and candidate have the same package-member set, the same Word text, the same signature-origin topology, and the same public declaration-coverage counts. Each standard type selector matches one stored Word relationship. Only the private type selection in _xmlsignatures/sig1.xml changes.

A count-only check therefore sees no transition. DocFence’s private semantic comparison still emits package_signature_coverage_changed, while its public report keeps selector values, relationship IDs and types, reference URIs, package paths, object identifiers, and digest material out of the output. DCAB’s target-free truth file names only the fact category and review convention.

Static declaration, not signature validity

The fixture uses fixed XMLDSIG-shaped placeholder values. Neither DCAB nor this DocFence boundary recomputes a digest or canonicalization, validates a signature value, inspects a certificate, establishes trust, checks revocation or timestamps, or predicts what an Office client will accept. Those are separate processes with separate inputs and policies.

Teams can use the static gate to require complete bounded declaration coverage, or preserve an approved declaration baseline:

version: 1
rules:
  require_complete_package_signature_coverage: true
  no_package_signature_coverage_changes: true

DFP092 and DFP093 remain structural review controls, not trust assertions. The exact boundary is documented in the tagged policy reference and threat model.

Released and checked

Both releases passed their hosted CI matrices. DCAB ran source, wheel, source-distribution, and adapter checks on Python 3.11, 3.12, and 3.13 with the released DocFence 0.41 adapter. The tagged GitHub artifacts were downloaded and byte-compared against their verified builds.

Correction, August 4, 2026: the current 42-case corpus is mirrored on Hugging Face. DCAB 0.32 normalizes the private package-specific object identifier in the two XMLDSIG-shaped fixture pairs while retaining the 42 public facts and schema; the current card and paired archives were fetched back after publication.

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.41.0/docfence-0.41.0-py3-none-any.whl
python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.31.0/document_change_benchmark-0.31.0-py3-none-any.whl

docfence diff approved.docx candidate.docx --format markdown
dcab validate

The useful discipline is simple: give a standards-defined declaration change the attention it deserves, while refusing to represent that change as proof of cryptographic validity or trust.