Release note · August 4, 2026
A future-save privacy request deserves review
A document-review system should be able to notice a stored privacy-related request without pretending that it knows the current privacy state of a document. A direct Word Settings leaf can change while every package member except that Settings XML and every stored text value remain fixed. That is a narrow, useful static review fact.
Document Change Assurance Benchmark (DCAB) 0.22.0 adds its thirty-third deterministic pair: review.personal_information_removal_on_save_enabled. The baseline stores w:removePersonalInformation w:val="false"; the candidate stores w:removePersonalInformation w:val="true". Only word/settings.xml changes.
One settings boundary, no personal data payload
Microsoft documents RemovePersonalInformation as a direct CT_OnOff setting for a hosting application to remove document authors’ personal information when saving. The standard deliberately does not define the extent of “personal information.” DCAB models the stored request, not an author, property, or save result.
word/settings.xml only changed package member
w:removePersonalInformation w:val="false" baseline direct leaf
w:removePersonalInformation w:val="true" candidate direct leaf
word/_rels/settings.xml.rels absent on both sides
word/document.xml byte-identical stored textThe pair retains the same package-member set and stored w:t sequence. Construction and validation do not identify an author, inspect or rewrite document properties, remove information, save a document, open Word, or claim that a host will do any of those things.
A target-free fact for static reviewers
The public oracle publishes one narrow fact:
{
"kind": "personal_information_removal_on_save_enabled",
"source": "word_settings"
}It excludes raw Settings serialization, author identity, document-property content, comments, revisions, document content outside fixed synthetic text, and private fingerprints. Structural validation checks exact direct-leaf forms, a one-member change boundary, absent Settings relationships, unchanged stored text, independent reader compatibility, and deterministic regeneration.
One released consumer, still a tool-neutral benchmark
The optional DocFence 0.32.0 adapter reaches a strict 33/33 score using only public aggregate evidence: personal_information_removal_on_save_inventory_changed, an enabled-count transition from zero to one, and a disabled-count transition from one to zero. It never consumes raw XML, author data, a Settings path, or a private fingerprint.
Hosted CI passed on Python 3.11, 3.12, and 3.13, including a fresh public-DocFence adapter install. Clean wheel and source-distribution installs validate the bundled 33-case corpus. The public Hugging Face dataset mirror was downloaded, byte-compared with the generated tree, and validated directly after publication.
Use the release
python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.22.0/document_change_benchmark-0.22.0-py3-none-any.whl
dcab validate
dcab docfence-observations --executable docfence --output observations.json
dcab score --observations observations.json --strictDCAB retains fixture schema version 1 because its public truth and observation envelopes are unchanged. This release adds one exact static-review fact—not a privacy classifier, document scrubber, save engine, Word client, renderer, or universal policy claim. The MIT-licensed builder, fixtures, verifier, release artifacts, and research notes are available on GitHub.