Release note · August 2, 2026
A sensitivity label can change without a cell changing
A workbook can keep every worksheet cell, formula, and calculated value stable while its stored sensitivity-label metadata changes. That is material review evidence. It is also sensitive evidence: a CI report that prints the label name, identifiers, action details, site information, or timestamps can turn a useful control into a metadata leak.
FormulaFence 0.225.0 and the Workbook Change Assurance Benchmark (WCAB) 0.43.0 establish a deliberately narrow boundary for this case: detect a persisted Office metadata transition, report count-only evidence, and leave policy, access, and enforcement claims outside the result.
One record, more than one stored location
Microsoft’s LabelInfo versus Custom Document Properties specification describes persisted sensitivity-label metadata in custom document properties or a LabelInfo stream, with policy and the actual storage location affecting how an implementation reads and writes it. The Sensitivity Label Information Part specification describes a package-root classification-label relationship to a docMetadata/LabelInfo.xml part whose root is labelList.
FormulaFence recognizes the bounded, stored forms that matter for review: the standard Sensitivity custom property, Microsoft Information Protection custom properties, and the relationship-backed LabelInfo part. This is package inspection, not a claim that every metadata representation is an effective label in every Office or service workflow.
Evidence that is useful without being a disclosure
When that bounded metadata changes, FormulaFence emits high-severity sensitivity_label_metadata_changed evidence with finding FF118. The report carries safe aggregate counts and a material-change signal. It intentionally withholds label identifiers and names, action and site identifiers, timestamps, property names and values, XML, relationship IDs, and relationship targets.
The generic custom-property signal remains available when docProps/custom.xml changes, but it is not a substitute for the explicit sensitivity-label review surface. Teams can also make the event blocking with the readable no_sensitivity_label_metadata_changes policy rule. A reviewer learns that protected metadata moved and can follow the organization’s protected workflow, without the review artifact becoming that workflow’s data store.
A deterministic fixture for the hard part
WCAB 0.43.0 adds governance.sensitivity_label_metadata_changed, a generated workbook pair with formula context fixed at Controls!B2=12, Controls!D2=B2*C2, and Dashboard!B4=Controls!$D$2. It contains both custom-property and relationship-backed LabelInfo metadata in standards-form package locations.
The candidate changes exactly one private synthetic MIP custom-property value. The root classification-label relationship, LabelInfo part, other custom properties, content types, calculation properties, formulas, and every other package member remain fixed. The raw validator proves that narrow one-member boundary; the public truth contains only the high-level transition and safe count profile. It contains no label, tenant, site, action, timestamp, private property value, XML, relationship ID, or target.
The optional WCAB adapter accepts the case only when FormulaFence produces the exact high-severity change category and FF118 alongside the expected redacted count profile. That makes the benchmark able to reject a tool that notices a generic property change but misses the specific review boundary, while preserving FormulaFence’s privacy contract.
What this result does not establish
A stored metadata difference is not proof of the label’s effective status, a policy-service decision, encryption, permissions, identity, access, Office-client behavior, SharePoint or OneDrive enforcement, or a successful workflow action. FormulaFence does not resolve those systems or expose the material needed to make such claims. The result is intentionally smaller: a local package changed in a review-relevant way.
Use the releases
python -m pip install https://github.com/SybilGambleyyu/formulafence/releases/download/v0.225.0/formulafence-0.225.0-py3-none-any.whl
formulafence diff approved.xlsx candidate.xlsx
git clone https://github.com/SybilGambleyyu/workbook-change-benchmark.git
cd workbook-change-benchmark
git checkout v0.43.0
python -m venv .venv
.venv/bin/python -m pip install -e '.[dev]'
wcab validate --fixtures fixturesFormulaFence 0.225.0 passed its 1,602-test local suite, packaging checks, and fresh-install verification. WCAB 0.43.0 contains 60 validated fixtures and passed its 287-test local suite, packaging checks, and fresh wheel/source-install checks. The benchmark dataset mirror is available on Hugging Face.
Both projects are MIT-licensed. Read the FormulaFence release, the WCAB release, or the benchmark note for the source, package hashes, and validation records.