Verified Workbook Operations

wolfxl.operations performs an inspect → plan → approve (when required) → apply → verify → attest → commit workflow. apply() creates only a managed temporary artifact; commit() is the sole publication step and refuses to overwrite an existing destination.

Package-preserving operation matrix

Operation	Preserving patch parts	Preconditions	Unsupported boundary
set_cells	Target worksheet XML	Bounded cell matrix and no unsafe shared/array/data-table/merge interaction	Structural worksheet edits and unsupported formula groups
set_formulas	Target worksheet XML; xl/workbook.xml; may add calculation-chain metadata	Same bounded safety checks; output requests recalculation	Formula evaluation is not claimed by this operation
set_defined_name	xl/workbook.xml	A unique workbook- or existing-sheet-scoped name target; a valid sheets mapping	Missing or ambiguous scope/name mappings
set_document_properties	docProps/core.xml	Existing, unique core-properties part; only the listed core keys	Custom, extended, and missing core-property packages

set_defined_name accepts name, formula, and scope. scope is either "workbook" or the exact worksheet title. Repeating one (name, scope) target in a request is rejected during preflight.

set_document_properties accepts one properties mapping using only category, content_status, creator, description, identifier, keywords, language, last_modified_by, subject, and title. Strings, finite JSON numbers, and booleans are written as deterministic text; null removes that core-property element. The operation never creates package relationships or modifies extended/custom properties.

All preserving operations precompute every replacement before the source copy is rewritten. The archive is rebuilt privately, fsynced, and atomically replaced. Every package member other than the declared changed parts (and the documented formula calculation-chain additions) retains identical uncompressed member bytes. Verification compares that contract before an artifact can be attested. A preflight or apply error removes the managed temporary artifact: the source and caller destination remain unchanged.

Guard preservation matrix

Guard uses the existing "unchanged" / "preserve" vocabulary; null means unassessed. The default policy assesses the five core dimensions and each frozen fidelity dimension below. Explicit legacy policies may omit the added dimensions; specifying one assesses it.

Dimension family	Source/output measurement
charts	Chart, chart-sheet, and chart-style semantic fingerprint counts plus feature-part counts
pivots	Pivot semantic fingerprint and feature-part counts
conditional_formatting	Conditional-formatting semantic fingerprint and feature-part counts
data_validations	Data-validation semantic fingerprint counts
comments	Comment feature-part counts and feature-part-loss audit findings
connections, data_model, drawing_objects, extensions	Corresponding semantic fingerprints and accepted feature-part counts
named_sheet_views, page_setup, python, sheet_metadata	Corresponding semantic fingerprints and accepted feature-part counts
slicers, style_theme, structured_references, timelines, workbook_globals	Corresponding semantic fingerprints and accepted feature-part counts

For each assessed fidelity dimension, Guard records deterministic before and after measurements and fails on a changed count or related semantic-drift or feature-part-loss finding. The existing macro_inventory, external_link_inventory, worksheet_inventory, formula_integrity, and package_integrity dimensions remain unchanged.

Guard is a preservation comparison, not an authorization mechanism for an intended change. Operation verify() establishes declared changes; use an explicit Guard policy with the intentionally changed dimensions unassessed when comparing such artifacts.