Draft: reproducible publication checklist

Human-run only. This is a local preflight checklist. It does not authorize publication, posting, package upload, repository-visibility changes, or a deployment. It intentionally contains no live destination URL. Do not perform a public action until the owner authorizes that exact action and destination.

Preconditions

• Select one clean candidate commit. Record its commit, tree, and dirty state.
• Select the exact evidence receipts that support any sentence or number.
• Keep the local Codex macOS and stock-LibreOffice Linux results as separate sections, tables, and result groups.
• Retain unsupported, failed, red, and inconclusive rows in the selected receipt set.
• Confirm the final copy does not state a universal spreadsheet, Excel parity, formula-correctness, latency, memory, rendering, preservation, or corruption result.
• Do not use a session directory, a temporary directory, a private hostname, a token, a workbook, a screenshot, or a raw command transcript as public input.

Candidate identity

Run these commands in the candidate repository with a POSIX shell (sh, bash, or zsh). They are not Windows commands.

git rev-parse HEAD
git rev-parse HEAD^{tree}
git status --short

The commit and tree must be the identities in every new receipt. Any dirty output requires either an explicit classification or a clean rebuild; it must not be silently described as a clean-source result.

Receipt review

For every material statement, write down all of the following before copying it into an article or post:

1. repository-relative receipt path and SHA-256;
2. source commit, tree, and dirty state;
3. build mode and built-artifact or wheel SHA-256;
4. runtime, operating system, architecture, and selected engine;
5. scenario and fixture identities;
6. warmups, iterations, concurrency, timeout, and cache/reuse state;
7. terminal status, failure reason when present, and limitations; and
8. result of a path/privacy scan.

Do not combine numbers from separate platform groups or different fixture identities. The compact report retains fixture identity as a median-grouping dimension. A runtime disagreement, unsupported route, or failed row is a result to show, not a reason to calculate a more favorable average.

Clean Codex-runtime wheel smoke

This is the POSIX-shell command sequence used for the source-matched runtime exercise. It is parameterized so it cannot guess a runtime, use a private path, or download a package. Repeat it for any different candidate, wheel, runtime, or dependency artifact.

export RUN_DIR="${RUN_DIR:?set to a private writable run directory}"
export CODEX_RUNTIME_ROOT="${CODEX_RUNTIME_ROOT:?set to the selected Codex runtime root}"
export CODEX_PYTHON="${CODEX_PYTHON:?set to that runtime's bundled Python executable}"
export MATURIN_BIN="${MATURIN_BIN:?set to an explicit maturin executable}"
export WOLFXL_DEPENDENCY_WHEEL="${WOLFXL_DEPENDENCY_WHEEL:?set to the offline defusedxml wheel}"

uv run python scripts/build_codex_runtime_wheel.py \
  --python "$CODEX_PYTHON" \
  --maturin "$MATURIN_BIN" \
  --output-dir "$RUN_DIR/wheels" \
  --receipt "$RUN_DIR/codex-wheel-build.json"

export WOLFXL_WHEEL="${WOLFXL_WHEEL:?set to the one wheel produced above}"

uv run python scripts/smoke_codex_runtime_wheel.py \
  --runtime-root "$CODEX_RUNTIME_ROOT" \
  --wheel "$WOLFXL_WHEEL" \
  --build-receipt "$RUN_DIR/codex-wheel-build.json" \
  --dependency-wheel "$WOLFXL_DEPENDENCY_WHEEL" \
  --scratch-dir "$RUN_DIR/scratch" \
  --output "$RUN_DIR/codex-wheel-smoke.json"

The result must identify the exact supplied wheel and runtime. If discovery, installation, dependency resolution, source identity, or cleanup fails, retain the generated failure receipt and do not substitute a system Python or office installation.

Source-matched local benchmark

Use the wheel and runtime selected above. SOFFICE must be the explicit Codex runtime wrapper or another explicitly identified LibreOffice executable.

export SOFFICE="${SOFFICE:?set to the selected soffice executable}"
export SOURCE_SHA="$(git rev-parse HEAD)"
test -z "$(git status --short)"

"$CODEX_PYTHON" -m venv "$RUN_DIR/benchmark-venv"
"$RUN_DIR/benchmark-venv/bin/python" -m pip install \
  --no-index --no-deps \
  "$WOLFXL_DEPENDENCY_WHEEL" \
  "$WOLFXL_WHEEL"

"$RUN_DIR/benchmark-venv/bin/python" \
  scripts/benchmark_libreoffice_vs_wolfxl.py run \
  --soffice "$SOFFICE" \
  --python "$RUN_DIR/benchmark-venv/bin/python" \
  --output-dir "$RUN_DIR/local-benchmark" \
  --run-id "local-codex-$SOURCE_SHA" \
  --iterations 3 \
  --warmups 1 \
  --large-rows 20000 \
  --large-cols 8 \
  --timeout-seconds 120 \
  --parallel-jobs 2 \
  --wolfxl-worker-jobs 2 \
  --build-mode codex-exact-wheel

uv run python scripts/benchmark_libreoffice_vs_wolfxl.py \
  validate "$RUN_DIR/local-benchmark/local-codex-$SOURCE_SHA"

The published local table may contain only ok rows from that bundle. unsupported, failed, unavailable, and unstable rows remain in the receipt and must be described beside any selected numbers.

Formula, package, render, and app receipts

The formula comparison consumes an independently produced LibreOffice oracle plus the exact authored workbook root. It is not an Excel-correctness oracle.

export LIBREOFFICE_ORACLE="${LIBREOFFICE_ORACLE:?set to the selected Oracle B JSON}"
export AUTHORED_ROOT="${AUTHORED_ROOT:?set to its exact authored workbook root}"

uv run python scripts/report_calc_wolfxl_vs_libreoffice.py \
  --oracle "$LIBREOFFICE_ORACLE" \
  --authored-root "$AUTHORED_ROOT" \
  --output "$RUN_DIR/calc.json"

uv run python scripts/run_libreoffice_ooxml_preservation_compare.py \
  --output-dir "$RUN_DIR/preservation" \
  --soffice-path "$SOFFICE" \
  --timeout-seconds 120 \
  --allow-incomplete \
  tests/fixtures/tier1/03_text_formatting.xlsx \
  tests/fixtures/render/styled.xlsx \
  tests/fixtures/tier2/13_hyperlinks.xlsx

mkdir -p "$RUN_DIR/visual-fixtures"
cp tests/fixtures/tier1/03_text_formatting.xlsx \
  tests/fixtures/render/styled.xlsx \
  tests/fixtures/tier2/13_hyperlinks.xlsx \
  "$RUN_DIR/visual-fixtures/"

uv run python scripts/run_ooxml_render_compare.py \
  "$RUN_DIR/visual-fixtures" \
  --output-dir "$RUN_DIR/render-work" \
  --render-engine libreoffice \
  --soffice "$SOFFICE" \
  --timeout 120 |
  tee "$RUN_DIR/render.json"

uv run python scripts/run_ooxml_app_smoke.py \
  "$RUN_DIR/visual-fixtures" \
  --output-dir "$RUN_DIR/app-smoke-work" \
  --app libreoffice \
  --soffice "$SOFFICE" \
  --mutation source \
  --mutation no_op \
  --timeout 120 |
  tee "$RUN_DIR/app-smoke.json"

Keep the full formula disagreement set, unrelated package drift, render failures, app repairs, and unavailable routes. Do not select only favorable families or fixtures after inspecting results.

Separate Linux benchmark

Run the Linux boundary on a configured private remote. The queue pins the source commit into the plan and prints the remote run directory. Do not publish that private path.

export SOURCE_SHA="$(git rev-parse HEAD)"
export LINUX_RUN_ID="libreoffice-benchmark-${SOURCE_SHA}-launch1"

uv run python scripts/vps_benchmark_queue.py \
  plan --run-id "$LINUX_RUN_ID"

uv run python scripts/vps_benchmark_queue.py \
  launch --run-id "$LINUX_RUN_ID"

export REMOTE_RUN_DIR="${REMOTE_RUN_DIR:?set to the completed run directory}"
uv run python scripts/vps_benchmark_queue.py \
  fetch "$REMOTE_RUN_DIR" \
  --dest "$RUN_DIR/linux-benchmark"

uv run python scripts/benchmark_libreoffice_vs_wolfxl.py \
  validate "$RUN_DIR/linux-benchmark"

The Linux result is a separate platform group. Do not pool its observations with the local Codex macOS group.

Compact public receipt

Aggregate only the selected, source-matched receipts. The producer rejects inconsistent source identity and unsupported aggregate boundaries.

uv run python scripts/report_codex_libreoffice_evidence.py \
  --benchmark-bundle "$RUN_DIR/local-benchmark/local-codex-$SOURCE_SHA" \
  --calc-report "$RUN_DIR/calc.json" \
  --preservation-bundle "$RUN_DIR/preservation" \
  --render-report "$RUN_DIR/render.json" \
  --app-smoke-report "$RUN_DIR/app-smoke.json" \
  --wheel-smoke-receipt "$RUN_DIR/codex-wheel-smoke.json" \
  --vps-benchmark-bundle "$RUN_DIR/linux-benchmark" \
  --output "$RUN_DIR/codex-libreoffice-evidence.json"

shasum -a 256 "$RUN_DIR/codex-libreoffice-evidence.json"

Before copying that compact JSON into docs/trust/, confirm it contains no absolute path, private hostname, IP address, token, raw workbook, screenshot, or command transcript.

Copy and claim audits

Run these commands after the final article, FAQ, social drafts, and any linked repository copy are selected. The current launch copy passed this audit on 2026-09-02; rerun it after any copy or evidence change.

uv run python scripts/audit_public_claim_wording.py --root . --strict

If an independently verified website checkout also changes, set WOLFXL_SITE_ROOT to that explicit checkout and run the repository’s existing site checker. Do not guess a sibling directory or copy an unverified site path.

test -n "${WOLFXL_SITE_ROOT:-}" && test -d "$WOLFXL_SITE_ROOT"
python3 scripts/check_site_claims.py --site-root "$WOLFXL_SITE_ROOT"

A passing wording audit does not turn an old receipt into current-head evidence. A site audit does not replace the source-receipt audit.

Human publication preflight

After the owner explicitly authorizes the exact destination, a human must:

1. verify the repository, package, article, evidence, checksum, license, and issue destinations using a logged-out session;
2. confirm each destination resolves to the selected revision or release artifact, not a mutable temporary result;
3. check that no destination exposes a private path, hostname, token, session identifier, raw workbook, screenshot, or command transcript;
4. confirm that article links, receipt paths, and checksums match the final audited copy;
5. confirm that the linked issue form is available and warns against public workbook uploads; and
6. preserve the human’s completion note with the selected URLs and timestamp in an approved release handoff, not in a public claim before the check occurs.

The following actions remain human-only even after preflight: social posting, Show HN submission, public package upload, public release creation, version-tag push, repository-visibility change, and deployment.

Final release decision

Do not publish when any selected evidence is source-mismatched, receipt validation fails, a required platform is unavailable, copy has not passed its claim audit, a public destination has not been checked logged out, or an unsupported result has been omitted. Record the exact blocker and defer the claim rather than rewriting it into a broader assertion.