Pro Local Solo
$299/year
1 named developer, 2 devices, 1 CI runner.
Best-effort async support. No synchronous calls or document uploads.
Coming soonPro Local · Coming soon
Catch regressions before shipping editable Word documents. Runs locally.
You let an AI assistant edit a Word document. WolfDocx checks the file it hands back, on your own machine, before it reaches anyone else.
Launch interest opens your email client. No web form, analytics, or tracking.
- Evidence lanes
- 4 available · 2 optional · 1 planned
- Document uploads
- none
- Commercially verified on
- CPython 3.13 · macOS ARM64
- Runtime telemetry
- none
- Package metadata requires
- Python 3.11+
- Technical licence enforcement
- none
- Support
- async email, no calls
- Exit codes
- 0 pass · 1 regression · 2 tool failure
Working with an AI assistant
Tell your assistant to check its own work.
Your assistant does the checking. You give it one instruction, once, and from then on every Word file it edits is verified before it comes back to you.
-
Once
Install it on your computer
One install command, the same one at the top of this page. No account, no sign-in, and no upload. Your documents never leave the machine.
-
Every time
Give your assistant this instruction
Paste it into your assistant's instructions once, wherever it keeps its standing rules, and it applies from then on. wolfdocx is the name of the command your assistant will run.
-
Result
You get a plain answer
Either the file passes, or you get a short list of what changed that you never asked to change: a table, a heading style, a page setting, a field that quietly went stale. A readable report opens in your browser, and it contains none of your document's text.
What a check actually holds
The edit you asked for lands. Everything else has to prove it did not move.
A generator changes and the new text is correct, so a read-through looks fine. Meanwhile a table border shifted, a field went stale, or a style got clobbered somewhere nobody scrolled to. WolfDocx makes that a failing gate instead of something you find out about later.
Quarterly Revenue Report
Group revenue grew 9.4% across all three regions in the third quarter.
| Region | Q2 2026 | Q3 2026 |
| North | 1,204,880 | 1,318,402 |
| EMEA | 913,455 | 1,002,117 |
| APAC | 664,201 | 708,930 |
Prepared by
{ DOCPROPERTY ReportOwner }
The highlighted clause is the only intended edit. Policy allows the text category and nothing else.
What was compared
WolfDocx takes a fingerprint of fifteen separate parts of the file and compares them one by one. A matching fingerprint means that part is provably untouched, not merely that nobody noticed a change. The technical name is a SHA-256 hash.
- document textchanged
- stylesheld
- tablesheld
- fieldsheld
- formattingheld
- structureheld
- sectionsheld
- numberingheld
- featuresheld
- non-text bodyheld
Compared, but empty in this document
headers · footers · comments · content controls · drawings
One changed. Nine held with content, five compared and empty. exit 0. The empty five are listed apart because an empty set matching an empty set is not evidence, and a pass should not borrow credibility from it.
It reports what it did not prove.
The quickstart ships deterministic synthetic fixtures, runs the full gate, verifies the evidence, and packs it. Repeat the command and the hashes match. The boundary below is part of the output, not a disclaimer bolted onto a slide.
{
"archive_verified": true,
"claim_boundary": {
"arbitrary_docx_support_proven": false,
"customer_value": false,
"input_kind": "project-authored-deterministic-synthetic",
"microsoft_word_compatibility": false,
"package_only_workflow": true,
"package_published": false,
"private_documents_used": false,
"production_accuracy": false
},
"evidence_verified": true,
"gate_passed": true,
"issues": [],
"passed": true
}Real output. Five keys omitted for width: artifacts, execution_error, hashes, output_name, schema_version. Nothing else is changed.
A narrower, testable question
Did the requested edit happen, and did unrelated document semantics survive?
One gate run composes independent lanes into a single decision, pins every input and output by SHA-256, never updates the baseline, and refuses to overwrite existing evidence. Both lists below are generated from the same versioned offer file that governs what this product is allowed to claim.
Proven by a pass
- the installed local package completes the documented package-only workflow
- configured package, semantic, intent, content, and active-content lanes produce hash-bound evidence
- customer document bytes stay on the local machine in the package-only workflow
- privacy-safe support export omits document bytes, document text, paths, raw logs, and approval metadata
Not proven by a pass
- Microsoft Word opened, paginated, or rendered a document correctly
- unmodeled DOCX semantics were preserved
- a configured policy is appropriate for a buyer's workflow
- cross-platform reliability outside the exact commercially verified profile
- commercial demand, saved review time, or prevented production regressions
From generated file to release decision
Five commands. No hidden mutation.
-
01
wolfdocx init baseline.docx approved.docx --allow text --require textTurn a reviewed baseline and an approved output into an explicit local policy. Requires an explicit allowance decision and verifies the approved example against the policy it just wrote.
-
02
wolfdocx check candidate.docx --openStage one candidate, write non-overwriting evidence, and always create the privacy-safe HTML review.
-
03
wolfdocx statusReport active hashes, candidate evidence, and proposal readiness without exposing document text or changing files.
-
04
wolfdocx accept --reason "reviewed release"Verify passing evidence and create a proposal. It does not change the active project.
-
05
wolfdocx activate --proposal <sha256> --reason "…" --confirm-activationPromote one exact, hash-addressed proposal. Requires the proposal hash, a reason, and a separate confirmation flag.
Evidence lanes
Six tiers. Reported separately, on purpose.
A single “valid DOCX” check hides which guarantee actually held. The tiers stay independent so a pass never borrows credibility from a lane that did not run.
| Tier | Lane | State | What it covers |
|---|---|---|---|
| 01 | Package and XML health | available | Defensive ZIP and OPC reading rejects ambiguous duplicate entries, unsafe paths, decompression bombs, DTD and entity declarations, and XML outside a recorded resource envelope. |
| 02 | Active-content posture | available | A privacy-minimized inventory and explicit policy for macros, embedded objects, external relationships, altChunk content, and external-data fields. |
| 03 | Semantic and style invariants | available | Fingerprints for text, structure, styles, numbering definitions, sections, headers and footers, comments, fields, drawings, content controls, formatting, and tables. |
| 04 | Intent-aware change containment | available | Permit the text change you asked for while rejecting unrelated formatting or structure drift. |
| 05 | Headless round-trip and rendering | optionalLibreOffice + Poppler | Sandboxed rendering compared on page geometry, normalized pixel RMSE, and changed-component ratio. An independent renderer lane, not Microsoft Word proof. |
| 06 | Microsoft Word application evidence | planned | The customer-owned runner architecture and the detached evidence validator exist. The controlled runner does not, and Word evidence is excluded from the founding support promise. |
| Outside the tier ladder | |||
| — | Open XML SDK schema conformance | optional.NET 9 | A pinned Microsoft Open XML SDK sidecar reports SDK version, target Office format version, bounded validation errors, affected parts, and XML paths. A schema pass proves conformance to the selected SDK model, not Microsoft Word behavior. |
Deliverables
Evidence you can hand to someone else.
Every gate writes a bounded, hash-pinned artifact set. Verify it later without reopening the DOCX inputs, or pack it and re-verify the archive after transport.
evidence/release-candidate/ ├─ report.json authoritative gate decision ├─ evidence-manifest.json SHA-256 pins for the set ├─ review.html script-free review page ├─ junit.xml optional CI view ├─ summary.md optional Markdown status └─ ci-exports.json pins exports to the report
wolfdocx evidence verify evidence/release-candidate wolfdocx evidence pack evidence/release-candidate --output rc.zip wolfdocx evidence verify rc.zip # Optional: authenticate the verified manifest with a # detached OpenSSH signature. Signing never selects a # default key, and verification trusts only the # allowed-signers policy you supply.
# WolfDocx CI summary
- Gate: `synthetic-text-update`
- Result: **PASS**
- Policy SHA-256: `5bac64ad52f095b259754c4c523c7369b79c5cd11d035660e99bc059ae519b58`
- Full evidence: `report.json`
| Check | Status | Privacy-minimized diagnostics |
|---|---|---|
| policy | PASSED | |
| package | PASSED | |
| intent | PASSED | |
| content | SKIPPED | disabled_by_policy |
| active_content | PASSED | |
| schema | SKIPPED | disabled_by_policy |
| render | SKIPPED | disabled_by_policy |
This summary omits document text and formatting values. Use the pinned JSON report for complete evidence.The file exactly as the gate writes it, unaligned Markdown and all. A skipped lane is reported as skipped, with its reason; it is never folded into the pass.
Positioning
Not another redline viewer.
Comparison products help a person inspect change. SDKs help a developer manipulate files. WolfDocx answers whether one generated release stays inside a reviewed contract.
| Question | WolfDocx | Compare viewer | Document SDK |
|---|---|---|---|
| Primary job | Release decision and evidence | Human-readable change review | Build or manipulate DOCX |
| Runs in CI | Designed for it | Sometimes | You assemble the policy |
| Intent-aware policy | Explicit, versioned contract | Usually filters and profiles | Application-specific code |
| Local document custody | Package-only path stays local | Product-dependent | Deployment-dependent |
| Microsoft Word proof | Separate controlled lane only | Not implied | Not implied |
Use something else when you need
- interactive legal redlining
- generic DOCX authoring
- DOCX-to-PDF conversion
- a Microsoft Word replacement
Founding offer
One local product. Two licenses.
Same product bits in evaluation and paid editions. Purchase keys cover receipts, renewals, refunds, and async support. There is no DRM and no runtime license check.
Pro Local Team
$999/year
5 named developers, 10 devices, 3 CI runners.
Priority async support. No synchronous calls or document uploads.
Coming soonFounding pricing is planned at $299/year for Solo and $999/year for Team. Availability and terms may change before launch.
Questions before launch
What buyers should know.
Who is this for?
Anyone whose Word documents get edited by software rather than only by people. The current founding offer is sold as local release evidence and regression testing for generated DOCX files, for engineering and QA teams that programmatically generate editable Word documents. The check itself does not care whether the edit came from a script, a pipeline, or an AI assistant.
Do I need to be technical to use it?
You need to install one package and decide once which kinds of change are allowed, such as text but not formatting. After that your assistant runs the checks and you read a plain pass or fail. There is no graphical application today; WolfDocx is a command-line tool that an assistant can drive on your behalf.
Does WolfDocx upload my documents?
No. The founding package-only workflow runs locally and does not upload document bytes, document text, or paths.
Does a pass guarantee Microsoft Word layout?
No. Microsoft Word evidence is a separate customer-controlled lane and is not included in the founding support promise.
Can I run this in CI?
Yes. gate is the CI-facing check: exit 0 is a passing gate, 1 is a policy or document regression, and 2 is a required tool failure. Optional JUnit and Markdown exports are pinned to the authoritative report and do not add a second decision engine.
What happens to my baseline when a check passes?
Nothing, unless you say so. check writes non-overwriting evidence, accept creates a proposal without touching the active project, and activate requires the exact proposal hash, a reason, and a separate confirmation flag.
What platform is commercially verified?
The current founding proof covers package-only lanes on CPython 3.13 and macOS ARM64. Python 3.11+ is package metadata, not equivalent cross-platform evidence.
How does licensing work?
The founding distribution is private and proprietary. The product has no DRM or runtime phone-home. A purchase key is for transaction and support entitlement. Legal terms and public distribution remain owner-gated.
What support is included?
support@wolfdocx.com Support uses sanitized bundles and deterministic synthetic reproductions; customer document uploads and synchronous calls are not included.
Coming soon
Private local DOCX release evidence, without document uploads.
WolfDocx Pro Local is preparing for a limited founding release. Checkout and downloads are disabled while commercial terms and fulfillment are finalized.