document

Attested. A fixture written in AXON is compiled and executed by a gate in the test suite, so this page describes behaviour a test exercises.

Since v2.53.0 · Top-level declaration

Grammar

document <Name> {
    target:     docx | pptx | xlsx        # required — selects the serializer
    template: <name.dotx> # optional — enterprise template (v2.53.0)
    provenance: none | embedded | signed  # optional — provenance part (default none)
    effects:    <io, storage, sensitive:<cat>, legal:<basis>>   # propagated egress row

    # ── body (closed vocabulary per target) ──
    section { heading: "…"                # docx
      para  { text: <value>  attribute: <source> }
      table { columns: ["…"] rows: <value> attribute: <source> }
      chart { kind: bar|line|pie|scatter  series: <value>  range: "B2:B9" }
    }
    slide { layout: "…"                   # pptx
      bullets { items: <value>  attribute: <source> }
    }
    sheet { name: "…"                     # xlsx
      row     { cells: <value> }
      formula { cell: "B10"  expr: "SUM(B2:B9)" }
    }
}

document declares a DOCX, PPTX, or XLSX as a declarative, compile-time-validated structure. It is the mirror image of scrape (v2.52.0): where a scraped value ENTERS the program born adversarial, a document is the point where a value LEAVES the epistemic lattice and becomes a human artifact that outlives every guardrail (a_document_is_an_egress_boundary_and_the_type_system_guards_it).

A Word document with a corporate letterhead reads as fact — the format itself confers authority the value never earned. The assertion-laundering barrier makes that impossible: a flow value below believe cannot occupy an assertive slot (a body paragraph, table cell, chart series, spreadsheet formula, slide bullet) without an explicit attribute: annotation or a shield that elevates it. It is the exact dual of v2.52.0's content-injection barrier.

Surface

document is a top-level declaration. target: selects a serializer, not a capability — a docx, a pptx and an xlsx have identical effect rows.

document quarterly_report {
    target:     docx
    provenance: embedded
    effects:    <io, storage>

    section {
        heading: "Q3 Results"
        para  { text: "All figures below are audited and final." }   # literal → always allowed
        para  { text: revenue_summary  attribute: analyst_agent }    # flow value → attribute:
        table { columns: ["Region", "Revenue"]  rows: region_rows  attribute: finance_system }
        chart { kind: bar  series: region_rows  range: "B2:B9"  attribute: finance_system }
    }
}

The barrier is satisfied per assertive slot by EITHER a literal author-written value, OR an attribute: sibling (which renders as a visible source note), OR wrapping the document in epistemic { mode: believe } / { mode: know } when the author vouches the whole document is ≥ believe, OR passing the value through a shield scanning hallucination/pii_leak first. An unattributed flow-value binding is axon-T916.

Fields

target: (required)

docx | pptx | xlsx — a closed catalog (axon-T910). Selects the body vocabulary: a slide inside a docx, or a sheet inside a pptx, is axon-T912.

provenance: (optional)

none (default) | embedded (an unsigned custom XML part recording the flow id, model, per-field epistemic level, and source URIs) | signed (the embedded part, cryptographically signed — enterprise, v2.53.0). The point: an auditor holding only the .docx, months later, off any axon system, can still answer "which flow made this, from which model, and did the author believe it?".

effects: (optional)

The propagated egress effect row. Authoring a document value is pure; rendering is io (+ storage on the enterprise blob sink); sensitive:<category> / legal:<basis> are propagated from the bound data. A document binding sensitive:* data with no legal:<basis> is axon-T913.

body blocks

Closed per target (axon-T912 on a block outside the vocabulary; axon-T914 on an unknown field):

• docx: section ⊃ heading / para / table / chart / image / toc / page_break / footnote.
• pptx: slide{layout:} ⊃ placeholder / bullets / image / chart / notes.
• xlsx: sheet{name:} ⊃ row / formula / range / chart / format.

A chart.kind: is the bounded v1 subset bar | line | pie | scatter (axon-T917; SmartArt / pivots / 3-D are deferred, the design decision). A formula carries an A1 cell: + expr:; a range an A1 cells: (axon-T919).

What this primitive is NOT

• Not a document reader or editor. document creates a DOCX/PPTX/XLSX; it cannot open or modify one (the design decision — read/edit is v2.54.0, three engines not three methods). An ingested document is epistemically the v2.52.0 problem — born Untrusted.
• Not a formula engine. A formula's cached value is Excel's last recalculation; axon ships no recalc, so a headless reader sees the cached number.
• Not a filesystem grant. render returns bytes as a typed artifact value; the HOST writes the file. The agent gets zero filesystem surface.

See also

• axon://primitives/scrape — the mirror: web content entering born adversarial (v2.52.0). document is the egress dual.
• axon://primitives/shield — elevates an assertive-slot value past the barrier (hallucination/pii_leak scan).
• axon://primitives/tool — the render lands as a DocumentRenderer native tool; sensitive:/legal: effects propagate through it.