Release note · August 3, 2026

A Word frame source can change outside the document body

By SybilGambleyyu · Document Change Assurance Benchmark 0.14.0

A Word document’s visible body is not its whole dependency graph. A frameset stores its frame source in the Web Settings part, then reaches that source through a relationship owned by the Web Settings part. A body-text diff can therefore remain completely quiet while a stored external document dependency changes.

Document Change Assurance Benchmark (DCAB) 0.14.0 adds its twenty-fifth deterministic pair: external.frameset_source_target_retargeted. Both packages retain the same members, ordinary stored w:t values, content types, internal relationship, root frameset layout, frame size/name, and source anchor. Only word/_rels/webSettings.xml.rels changes: one private external frame-source target is retargeted.

The relationship lives beside Web Settings

Microsoft's w:sourceFileName documentation says that the element identifies a source file through a relationship in the Web Settings part and requires the standard frame relationship type. The OOXML Framesets contract specifies that a frame target is external.

word/document.xml.rels
  rIdWebSettings ──internal──> word/webSettings.xml

word/webSettings.xml
  w:frameset
    w:frame
      w:sourceFileName r:id="rIdFrameSource"

word/_rels/webSettings.xml.rels
  rIdFrameSource ──frame, External──> private source

That relationship graph is the review boundary. The fixture fixes the full topology around it, including the content-type override and internal main-document-to-Web-Settings relationship, then changes only the target value in the final relationship. It is a tighter test than merely counting external relationships because it requires a scanner to associate the right external relationship with the frame anchor that names it.

Stored text is not a rendering claim

A root w:frameset has an important limit: the standard describes the document as a frameset definition, not ordinary rendered document content, while it has child frames. DCAB intentionally preserves the normal stored body text to make the package-level contrast inspectable, but it does not assert what any client displays.

The generator and verifier require exactly one fixed root frameset, one layout, one frame size/name, one w:sourceFileName anchor, one internal Web Settings relationship, and one external frame relationship. They also require a stable package-member set, stable stored Word text, and the one declared relationship-member boundary. The public truth exposes only the target-free fact category and reference review convention.

No component opens Word, renders a frame, resolves or retrieves a source, imports a document, authenticates to a target, or claims a client will display the frame. This is static package review evidence only.

Aggregate evidence without the destination

The optional DocFence 0.27.0 adapter reports the aggregate external_document_dependency_inventory_changed transition. Both sides retain one frame-source anchor and one frame relationship; the adapter maps that evidence without placing the source, relationship ID, Web Settings path, frame layout/name/size, or document text in DCAB observations.

Hosted CI passed on Python 3.11, 3.12, and 3.13, including a separate clean DocFence adapter job. The standard python-docx reader opens all 48 .docx fixtures, while its lower-level OPC reader opens all 50 packages. Rebuilt fixtures, fresh wheel and source-distribution installs, the published GitHub release downloads, and a fresh Hugging Face dataset snapshot each validate the 25-case corpus.

Use the release

python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.14.0/document_change_benchmark-0.14.0-py3-none-any.whl
dcab validate
dcab docfence-observations --executable docfence --output observations.json
dcab score --observations observations.json --strict

DCAB 0.14.0 retains fixture schema version 1 because its public truth and observation envelopes are unchanged. It adds a precise external-document dependency boundary, not a Word renderer, document importer, or runtime security claim.

The MIT-licensed source, generated fixtures, structural verifier, release artifacts, and research notes are available on GitHub. The fixture corpus is also mirrored as a public Hugging Face dataset.