A file from someone else is an input, not an instruction.

Core safeguards

• No VBA or embedded-code execution.
• ZIP path-traversal and symbolic-link rejection.
• Bounded uncompressed package size.
• SHA-256 internal verification.
• Source inputs are never overwritten.
• Conversion loss is explicit.
• Predictions are append-only proposals, not formal facts.
• Review decisions and promotions are separate events.
• External natural-workbook intake is fail-closed and purpose-limited.

Read SECURITY.md and the threat model before using MLF with untrusted or sensitive files.

Proposal is not fact

The research layer can predict things — dependency edges, roles, corrections. None of that enters the package as truth.

So the trail from a model thought this to the document now says this has two human-legible steps in it, and both are recorded.

Fail-closed intake

External natural-workbook intake is fail-closed and purpose-limited: when the conditions for accepting a file are not met, the answer is refusal, not a best effort. Purpose limitation means an accepted file is accepted for something, and that scope is recorded with it.

What a manifest does not prove

• A submitted authorization manifest≠proof of legal authority
• Pseudonymization≠anonymity
• Model confidence≠permission to modify formal data

These three are in the specification's own non-claims list. They are the failure modes a governance layer invites if it is not explicit, so MLF is explicit.

Governed extensions

The repository retains the v0.2–v0.9 research work: dataset generation and anti-leakage splitting, runtime and tensor/graph projections, model comparison, append-only inference ledgers, review and promotion workflows, confidence calibration and OOD routing, and external intake with purpose limitation.