Release note · August 3, 2026

A task pane can be enabled without changing Word text

By SybilGambleyyu · Document Change Assurance Benchmark 0.10.0

A Word document can carry Office Add-in configuration in package parts that ordinary text comparison never sees. One stored property can change from false to true while every w:t text node remains the same. That is review-relevant configuration evidence—but it is not, by itself, proof that an add-in is installed, trusted, or will run.

Document Change Assurance Benchmark (DCAB) 0.10.0 adds its twenty-first deterministic pair: interaction.taskpane_auto_show_setting_enabled. Both packages retain the same members, Word text, content types, internal relationship chain, task-pane declaration, web-extension reference shape, and property name. Only word/webextensions/webextension1.xml changes: Office.AutoShowTaskpaneWithDocument moves from its stored false value to true.

A stored configuration, not an installed add-in

Microsoft’s Office web-extension XML specification describes the document-borne XML structures used for Office Add-ins. Its task-pane auto-open guidance specifies a webextension part, a taskpane part, and the property that must be true for this setting.

Those same Microsoft instructions set the boundary for this fixture. The auto-open setting is ignored if the add-in is not already installed, and, as of March 2, 2026, Microsoft says the feature is supported only for centrally deployed or sideloaded add-ins—not Marketplace-published add-ins. DCAB therefore fixes only syntactic, internal package data. It does not provide a manifest, retrieve content, install or authenticate an add-in, open a Word client, execute code, or claim that a pane opens.

One property, a complete internal topology

The pair has a main-document relationship to word/webextensions/taskpanes.xml; its invisible, unlocked task pane has one internal reference to webextension1.xml. The web-extension part retains fixed synthetic IDs, an EXCatalog reference shape, one property, no bindings, and an empty snapshot. The baseline and candidate differ only at that property value.

The independent verifier checks the content-type overrides, both internal relationships, exact XML roots and attributes, fixed extension/reference topology, property shape, deterministic package bytes, stable member set, unchanged stored Word text, and the one-member pair boundary. The standard python-docx reader opens all 40 .docx fixtures, and its lower-level OPC reader opens all 42 packages.

The optional local DocFence 0.27.0 adapter maps the aggregate taskpane_web_extension_inventory_changed evidence. It sees one task-pane part, one task pane, one web-extension part, one reference, and one property on each side; visible panes, locked panes, bindings, and bound controls remain zero. Only the auto-show setting count changes from 0 to 1. The adapter relies on counts and private local signatures, not the fixed IDs, store data, or property values.

The release passed the full 17-test suite in hosted CI on Python 3.11, 3.12, and 3.13 plus a clean DocFence installation. Fresh wheel and source-distribution installs, the uploaded GitHub artifacts, and a fresh Hugging Face dataset download each validate the bundled 21-case corpus.

Use the release

python -m pip install https://github.com/SybilGambleyyu/document-change-benchmark/releases/download/v0.10.0/document_change_benchmark-0.10.0-py3-none-any.whl
dcab validate
dcab docfence-observations --executable docfence --output observations.json
dcab score --observations observations.json --strict

DCAB 0.10.0 retains fixture schema version 1 because the public truth and observation envelopes are unchanged; it extends the corpus from 20 to 21 cases. It publishes a narrow static review fact, not a deployment, identity, trust, client-behavior, or security-policy claim.

The MIT-licensed source, generated fixtures, structural verifier, release artifacts, and research notes are available on GitHub. The fixture corpus is also mirrored as a public Hugging Face dataset.