XLSX structured-workflow

Release evidenceA02

Implemented by@runstamp/xlsxAvailable

Gates closed: 7 of 7
Verified by: W04, independently of the builder
Integrated at: 38d57092
Category: Native artifact extensions

Gate record

What each gate checked, in the verifier’s words.

These summaries were written when the gate closed and are stored with the release. They are not marketing copy and they are not regenerated.

Typed contract

Typed inspect/import/map/read/write/export/verify operations cover sheets, ranges, defined names, tables, formulas/caches, style references, merges, legacy comments, validations, hidden state, date mode, external links, and macros as opaque bytes only; exclusions are frozen in the brief.

PASS

Fixtures red before implementation

Before implementation the known-bad formula/style corruption test failed because the workflow importer/verifier did not exist, while the other 353 XLSX tests passed; the implemented validator now rejects that control.

PASS

Focused correctness

The XLSX production build, typecheck, lint, 10 focused workflow tests, and all 363 package tests pass.

PASS

Semantic safety

Tests prove allowed-cell writeback, undeclared formula/style drift rejection, formula-injection rejection, hostile ZIP/XML/encryption limits, budgets, cancellation, stable artifact-bound locators, opaque macro preservation, and no network fetch or macro execution.

PASS

Determinism and declared loss

Two clean Node processes emitted identical SHA-256 a1a623f174a562628bea6e1a88fcd2182b86f208894300a89432a743427e57e8; typed preservation and LibreOffice round-trip limitations are recorded in losses.json.

PASS

Reference application validation

Microsoft Excel 16.111.3 opened the generated buyer-shaped XLSX and returned the expected answer, formula, sheet inventory, and veryHidden state. LibreOffice 26.2.2.2 opened/converted it, but its advisory round trip changed style/cache/veryHidden semantics and is not claimed as fidelity PASS.

PASS

Independent reproduction

W04 independently reproduced the clean offline install, focused and full XLSX suites, package build/typecheck/lint, hostile known-bad rejection, two-process deterministic export, EX01 composition, real Microsoft Excel open inspection, LibreOffice open/convert drift control, artifact hashes, and factory independent verification.

PASS

Typed invocation

One operation contract across API, SDK and MCP.

Every registered operation is reachable at the same URL shape, with the same envelope: the value, the loss ledger, the diagnostics and the provenance receipt.

HTTPA02

curl https://runstamp.com/v1/{domain}/{verb} \
  -H "Authorization: Bearer $RUNSTAMP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "input": ..., "options": { "lossPolicy": "collect" } }'

# GET https://runstamp.com/v1 lists every operation and its schema.

Related capabilities

Compose the next part of the workflow.

A01

DOCX controlled-document

Available

Inspect capability

A03

PDF evidence-processing

Available

Inspect capability

A04

PPTX template round-trip

Available

Inspect capability

curl https://runstamp.com/v1/{domain}/{verb} \ -H "Authorization: Bearer $RUNSTAMP_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "input": ..., "options": { "lossPolicy": "collect" } }' # GET https://runstamp.com/v1 lists every operation and its schema.