This repository contains only reproducible, non-sensitive toolchain metadata and third-party cache descriptors for OfficeCLI builds.
It must never contain OfficeDex source, Office2Modoc source, Presentation assets, private registry credentials, signing material, customer data, or URLs with embedded tokens. The private OfficeDex build remains the only stage that handles those inputs and produces signed installers.
Each cache bundle is keyed by the commit SHA and includes a manifest, license metadata, and SHA-256 checksums. Consumers must pin an exact cache commit and verify the checksum before use.