Validation methodology
The claims are inspectable. This page identifies the source file, the exact ruleset and the proof that a finished workbook changes only its data sheet.
Pinned source
FAS SRP Excel Upload Reporting Template v4.2, updated 2026-06-24.
SHA-256
cf8e13a8c005dd5a19c7b03d33ad7af9f705594e6895eec0c41e5509a87ae3b9
Machine contract
Ruleset 2026.08.17. Stable rule IDs and input limits are published as JSON.
What blocks a file
An error is demonstrably against the pinned workbook or arithmetic. A warning is useful review guidance whose value set is not stated in that workbook. Warnings never masquerade as official GSA rules.
| Rule ID | Level | Source | Decision |
|---|---|---|---|
required.nonempty | error | template | Every template column marked mandatory must contain a value. |
money.parse | error | template | Money fields must be parseable decimal amounts. |
money.nonnegative | error | template | Money fields cannot contain negative amounts. |
quantity.parse | error | template | Quantity fields must be parseable numbers. |
quantity.positive | error | template | Quantity must be greater than zero. |
date.parse | error | template | Date fields must use a recognised date representation. |
total.arithmetic | error | arithmetic | Total must equal quantity multiplied by unit price within one cent. |
date.future | warning | heuristic | A future transaction date is unusual and should be reviewed. |
yesno.shape | warning | heuristic | A yes/no value outside the recognised set is passed through unchanged. |
sin.shape | warning | heuristic | A SIN that does not match the expected shape should be reviewed. |
sin.contract | warning | account configuration | A SIN outside the list saved for the selected contract should be reviewed. |
zip.shape | warning | heuristic | A destination ZIP outside the 5- or 9-digit shape should be reviewed. |
rows.present | error | template | A report must contain at least one data row unless it is a nil report. |
Workbook integrity
The official XLSX is treated as a ZIP archive. The writer replaces only the XML entry for the selected data sheet and copies every other entry byte-for-byte. Automated checks compare the complete entry set and fail if anything besides that sheet changes. The example receipt exposes both file hashes and the changed-entry list.
Security and data boundary
Before parsing, workbooks are checked for encryption, malformed ZIP structures, extreme entry counts, oversized expanded content and dangerous compression ratios. Uploads are capped at 16 MB, processed in memory and expire after 30 minutes. Public write endpoints are rate-limited. Browser responses carry CSP, HSTS on HTTPS, anti-framing, MIME-sniffing and privacy-oriented referrer headers.
Vulnerability reports: kontakt@dali-ai.ch · security.txt.
Scope
The service validates file structure and the values it can prove. It cannot prove that a sale belongs to a contract, that a SIN is contractually correct, or that GSA accepted a submission. The filer remains responsible for those business facts and uploads the result to SRP personally.