Redstrata Knowledge Base

Business Glossary Reader

7 min read

Business Glossary Reader

Built 2026-08-02 by Ringer swarm business-glossary-reader (orchestrated by Claude Fable 5). A read-only, single-file HTML glossary viewer derived from the CLM Taxonomy Dashboard V4 UI, regenerated by a data steward from an Excel template via a VBA macro and published to SharePoint. V4 security-assessment Findings 1/3/6/7 mitigated; Findings 2 and 4 made not-applicable by feature removal.

Status: active Started: 2026-08-02 Last touched: 2026-08-02

Why this project exists

To give the client a locked-down, read-only view of the 440-term CLM glossary that a data steward can regenerate from Excel with no Python, no CDN, no sibling fetch and no export controls — a sibling of the production dashboard (CLM Taxonomy Dashboard — Production UI) tuned for the most restricted end of the estate. It operationalises the same governed-taxonomy / data-lineage intent (BCBS 239 and Data Lineage) as the dashboard, but strips every write path so the published artefact is inert.

Current state

  • v0.3 UI release built and verified 2026-08-03 — a one-task Codex round (reader-ui-v03, PASS first try, ~420s) under the same artifact. Business Glossary tab: displayed copyright removed (retained only as an HTML comment), “Credit lifecycle management” subtitle removed to make the reader business-area-neutral, and the ten oversized native <select multiple> list boxes replaced with compact custom multi-select dropdowns (button + checkbox popover + selected-count badge, Escape/outside-click close, OR-within/AND-across preserved). Summary tab: “(real tag counts)” dropped from the regulatory chart title; charts re-laid to two rows — regulatory | policy, then process | new Coverage-by-asset-class chart (term counts per asset token); Tag taxonomy moved down beside Regulatory sources; reg-source links reverted to the V4 compact ↗ arrow style (&#8599; entity to keep the shell ASCII, still safeUrl-gated). Bumped to template v0.3 (template, build_reader.py, .bas, parity twin in lock-step). Verified in-browser: dropdown multi-select filters 440→197 on Day 1+Day 2, no console errors, copyright absent from rendered text, chart order and side-by-side bottom tables confirmed via DOM. The executed check (check_ui_v03.py) re-enforced every prior guarantee alongside the new changes — baselined to fail 14/14 on the unchanged shell first.
  • Reader built and verified 2026-08-02 — single-file Business_Glossary_Reader.html (440 terms / 23 tags / 10 regulations), data injected at build time as a JSON data island into a data-less shell reader_shell.html.
  • In-Excel end-to-end test PASSED (Paul, 2026-08-03). The one-time .bas import + BuildGlossaryReader macro run produced the HTML successfully — clearing the round-1 “VBA correctness is an assumption” blocker for the v0.2 path.
  • Three-task Ringer swarm, all deliverables produced. reader-build (Codex / GPT-5.6 Sol) produced the shell, the Python build script, the built reader, the v0.2 Excel template, the VBA module and a Python parity twin. steward-guide (nvidia/nemotron-3-super-120b-a12b:free via OpenCode — an exploration-lane audition) produced the steward guide. approach-wiki (GLM 5.2 via OpenCode) produced this record.
  • Executed checks PASS. JSON data island parses (440/23/10 reconcile); node --check on all scripts; a poisoned-workbook build proving XSS payloads stay inert; v0.2-template data equality against v0.1 (cell-for-cell); byte-identical parity between the Python twin of the VBA algorithm and build_reader.py, both reading the v0.2 template.
  • UI delta vs V4 locked. Two tabs only (Business Glossary, Summary View); title “Business Glossary Reader”; collapsible side menu; multi-select filters plus new Process/Policy/Regulatory Tags and Data Owner filters; list columns swap Domain and Priority Tier for Asset Class Applicability / Policy Tags / Regulatory Tags; Summary swimlane swaps Baseline for Process Anchors and Policy Anchors; two new tag-coverage charts; evidence register removed; all import/export/email/refresh removed.
  • Security posture vs the V4 assessment (S-2026-07-28-clm-security-assessment) closed. Finding 1 (full escaping), Finding 3 (no inline handlers), Finding 6 (URL scheme allowlist), Finding 7 (CSP) — mitigated. Finding 2 (SheetJS import) and Finding 4 (exports) — made not-applicable by removing those features.

Decisions made

  • 2026-08-02 — Shell-in-worksheet + streaming VBA over giant VBA string literals. The HTML shell lives on a hidden _ReaderShell sheet and VBA streams it out cell-by-cell, splicing the JSON island at the marker; avoids brittle multi-hundred-line VBA strings and keeps the shell editable as a worksheet.
  • 2026-08-02 — ASCII-only shell so ANSI VBA file writes are safe. VBA’s default write is ANSI, not UTF-8; an ASCII shell guarantees no encoding corruption. Non-ASCII content lives only in the data, \u-escaped into the JSON island.
  • 2026-08-02 — JSON data island with \u-escaped angle brackets as defence in depth: the JSON is inert before the runtime escaper runs; the escaper is a second layer.
  • 2026-08-02 — Hard gate on Term IDs only; escaping as the general defence. Narrows the V4 broad hard-gate philosophy: in a read-only reader only the identifier must be structurally valid; everything else is escaped display text.
  • 2026-08-02 — Security by removal for Findings 2 and 4. SheetJS import and all exports are deleted rather than mitigated; the attack surface ceases to exist (recorded not-applicable, not mitigated).
  • 2026-08-02 — Ship .xlsx + .bas with a documented one-time import, not a ready xlsm. Forced by the vbaProject.bin constraint (see Open questions); the steward imports the .bas once and saves as xlsm.

Open questions / blockers

  • vbaProject.bin cannot be authored headlessly — Excel 16 on macOS removed the “do Visual Basic” AppleScript verb (no headless automation path) and xlsxwriter can only embed a bin extracted from a real xlsm, not synthesise one from a .bas. Consequence: the template ships as .xlsx + BusinessGlossaryReader.bas with a one-time manual import step; VBA correctness is proven by structural review + a byte-identical Python parity twin, not by executing VBA. The one-time import + an in-Excel end-to-end regeneration test are the next action and remain unverified by this swarm.
  • VBA correctness is an assumption, not executed evidence. It rests on (a) structural review of the VBA transcription and (b) byte-identical output between vba_parity_check.py (the Python twin) and build_reader.py both reading the v0.2 template. No Excel run was performed in the build.
  • Data Owner column is empty in the v0.1 data. The new Data Owner filter is wired but inert until the column is populated.
  • Licence wording is proposed, pending Paul’s confirmation: (c) 2026 Redstrata Ltd, Ireland, distribution rights retained.
  • Raw security-assessment source not yet ingested. The Source page S-2026-07-28-clm-security-assessment is reconstructed from this project’s context; the assessment document itself should be ingested into /_raw_sources/ to complete schema §7 traceability for the finding claims.

Connected wiki pages

History

  • 2026-08-02 — Business Glossary Reader built and verified by Ringer swarm business-glossary-reader (orchestrator Claude Fable 5): three tasks (reader-build / GPT-5.6 Sol, steward-guide / nemotron-3-super-120b-a12b:free exploration-lane audition, approach-wiki / GLM 5.2). Shell + Python build + VBA + v0.2 template + guide produced; checks PASS (JSON 440/23/10, node --check, poisoned-workbook inert, v0.1→v0.2 cell-for-cell equality, byte-identical VBA-twin↔Python parity). V4 security Findings 1/3/6/7 mitigated, 2 and 4 not-applicable by removal. One-time .bas import + in-Excel end-to-end test left as next action.

Sources / notes

Graph View

Backlinks

Recently updated

See 113 more →