Certificate signing and Compare were dispatched while the first batch was still in re-review, and merged within two hours of each other. A second build went to the owner at half past three in the morning.
Compare
Two files side by side, scrolling and zooming together, with the words that changed marked on each page and a pixel difference for everything words cannot describe. A report can be saved as HTML or text. Only runs of a few words count as moved text, so a single common word shuffling position does not light up the page.
One decision went against the manager’s own brief. The brief said Compare should be hidden from the menu when no document is open. The project’s rule, set on the first day, is that a tool which needs a file is grayed out, never hidden. The manager held the rule over the brief and the item is grayed.
Certificate signing
The app’s earlier Sign placed a picture of a signature. This one signs cryptographically: a detached signature in the standard format, from a certificate the app makes for the owner or one imported from a file, with the private key stored under the operating system’s own protection. Opening a signed file shows a signatures bar and a panel that reports each signature as Valid, Signed then changed, or Invalid.
The reviewer did not take the builder’s word for it. It verified the signatures independently with a separate tool, tried four different tampers and confirmed every one was caught, and checked that a second signature leaves the first valid. Its one medium finding was that the detector for changes after signing was looser than the app’s own signatures required, so a file could be altered in ways the detector did not count. That was hardened before the merge: a later signature from another tool now shows the earlier ones as Signed then changed. Conservative beats a false Valid.
What came next
Redaction and Compress, the two items the owner said to fit in wherever they would go, were dispatched as the second batch merged. Both got the same rule: they write a complete new file, never an update appended to the old one, because an appended update would keep the redacted bytes in the file, and both are refused on signed or encrypted documents. Redaction must also verify its own work, by extracting the text, scanning the bytes and rendering the page, before it reports success. Compress merged a little after four in the morning. Redaction was still in progress at the time of writing.