fix(privacy): redact Excel compatibility worksheet names

[seonghobae]

Closes #245.
Closes #283.
Closes #284.
Closes #287.
Closes #314.

Protected base is independently resolved main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03; exact branch head is 5da8f0e63a79264cb3b57eb62c1a4ddc2861683a. PR API base SHA is historical.

This Draft hardens Inkspan-owned local Office publication, diagnostics, and bounded request traversal: Excel compatibility worksheet names, filesystem paths, caller-controlled XML/object keys, rejected output extensions, temporary publication cleanup, accurate collision/cleanup failure classification, and DOCX rich-run preflight. Host transport/auth/tenancy/persistence/credentials/deployment/model ownership is unchanged.

Hosted RED lineage:

• fix(privacy): redact Office library output paths from filesystem errors #283: test-only 5146a3480258089b3d119d3396956e95128fb141, CI 31605125522 failed in Office tests after setup; repair starts fb09e44ee9cd4692400049766153e07b987239ae.
• fix(privacy): redact caller-controlled object keys from Office safety diagnostics #284: test-only 72311561cffb67edbdd0b242ee4a4d835fb1d618, CI 31610618676 failed in Office tests after setup; repair 5b4e484a04a0f408fbdadf54cef4a65c5cea6a4d.
• fix(privacy): redact caller-controlled output extensions from Office diagnostics #287: test-only 69ba9d1ad3145cf697ea852b6e644a9d8618dd2b, CI 31649209029 failed in Office tests after setup; Security 31649209013 and SAST 31649208990 succeeded; repair 90114b2b80c87531f0cdf9fa9546c461260e2e47.
• fix(reliability): preflight DOCX rich-run count before safety traversal #314: test-only 1d41b29b8050a64cf29f1df03f214501698ade18, CI 31693905857 failed at the intended oversized custom-Sequence traversal boundary; repair 720a8b30ee31240e4bf25410f74eb5b2b5ba6ff0 preflights the 4,096-run ceiling before recursive safety traversal. Exact current head 5da8f0e63a79264cb3b57eb62c1a4ddc2861683a adds defense-in-depth regressions proving non-sequence validation remains with the strict renderer and the strict renderer retains its own run-count ceiling.
• Redact Excel-compatibility worksheet names from safe-renderer errors #245 predecessor 7fc53b653c70b37a8efb1f582d05ce4f9886fa85 had successor-cancelled runs, so no hosted RED is claimed for it.

Exact-head GREEN for unchanged 5da8f0e63a79264cb3b57eb62c1a4ddc2861683a: CI 31694556417, Security 31694556344, and SAST 31694556389 all succeeded; canonical CI includes root typecheck/100% owned-production coverage/package/demo, cross-engine browser evidence, and Office Python 3.11–3.14 100% branch/package gates. Formal reviews 0; unresolved review threads 0.

Any head/live-base movement invalidates this proof. Keep Draft/unmerged while #118 owns the protected v0.6.0 publication/provenance boundary.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f821ef0-4818-459c-afc4-8f33b3da8882

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}