[mstattma]

Functional trusted VSI Python binding plus ladder/fragmented signing and ownership hardening, paired with castlabs/c2pa-rs feat/trusted-vsi-functional.

Current Qualified Pair

Python 97c820efde96af75c900c02e05457aab1ba2e1e1, native a6d4cdcc05638ee8dd0afce7fa5c850d7031a80c.

• TrustedVsiSession and helpers admit only exact revision 3, native SDK token c2pa-rs/0.92.0-dev, required symbols and mask 63, before operational ctypes binding. No version range, fallback or trial operation. Contract: docs/trusted-vsi-python-contract.md.
• Callback-triggered close is immediately logical; new admissions are refused and physical native teardown waits for admitted signing calls. Callback pins survive native free, including borrowed Signer/Context lifetimes. This is not generic thread safety: native operations still require serialization.
• blocked is exposed by ctypes/status, with offset 18 and total native status size 24. Failure/recovery tests exercise it.
• Stock-native scripted dynamic-assertion cases use has_dynamic_assertions(); source and installed-wheel paired jobs actually execute their functional checks.
• The fragmented wrapper preserves the existing six-argument glob-aware ABI, supporting one shared manifest across segmented renditions without per-rendition fallback.
• Ladder cleanup guidance permits deletion only of positively owned newly created outputs; sources and pre-existing destinations are never cleanup targets.

Merge Provenance

True merges retain ladder candidate 502b8bb2, generic ownership 7ba8615, reviewed follow-up a303db8 and callback-lifetime review fixes, without temporary CI-only commits or rewritten history. Ladder DynamicAssertion exceptions preserve identity and claim-signer interrupts propagate. Consume-first registry rejection parsing and opaque stream ownership remain anchored to rejected handle IDs.

Unreleased source identity 0.37.13.dev0 and immutable dev5 release inputs/locks/tooling remain distinct. Exact revision/version gating is intentionally coordinated, not source or binary authentication.

Current Qualification

• Exact pair Linux/Windows non-publishing qualification: 37688529697. Each platform passed 286 focused, 831 non-threaded, 54 threaded and 286 installed-wheel tests, plus the real native ladder harness.
• Local source qualification: 831 tests and 135 subtests; threaded 54; installed 286 and 18 subtests; installed release smoke 5. Review, stock-native and artifact provenance is in docs/archive/trusted-vsi-review-verification.md.
• Required downstream stack: 37807071502, passing required Linux/Windows scopes for both CBOR versions. Informational full Windows retains 21 failures per version.
• Frozen signer 0bf8949f passed fresh exact-source public/operational qualification with the downloaded native artifact: 84 passed, zero skips/failures per version. Execution evidence and selected integration review.

Historical Qualification And Limits

The old 12d265db/native 6b506352 pair (36808706395) is historical, superseded above. Stock 0.91.0 Windows x64 ownership/unit/ladder/threaded proof remains separate (36775608167); stock Windows ARM64 ownership was outside that scope. Ordinary stock-native hosted release jobs did not run in the current paired lane.

Remaining generic opaque-native concurrency/sticky-slot work stays in the roadmap. No generic thread-safety, native composed event-ID carry, production provider or universal platform guarantee is claimed.

No publication; dev5 tooling still refuses this source. Immutable historical release artifacts are unchanged.

[mstattma]

@BibinBaby444 requesting your review (a formal review request isn't possible: you're not a collaborator on this repository). Companion draft PRs: castlabs/c2pa-rs#15, #4, castlabs/stardustproof-keystore#13, castlabs/stardustproof-c2pa-signer#25.

[mstattma]

The independently reviewed ownership follow-up a303db8 is true-merged (not cherry-picked) into functional head 5c64f2cc090eeb29506bc766faa69b959e4ed982; the CI-only commit remains excluded. The remaining native-registry checks and stock Windows ARM64 ownership qualification are in docs/roadmap.md. Paired run 36793704783 passed on Linux and Windows against native 203dc08d: 186 focused, real-native ladder harness, 730 non-threaded, 54 threaded, and 186 installed-wheel tests per platform. Stock 0.91.0 Windows x64 passed in mstattma run 36775608167. @BibinBaby444 please review the new merge abef446 and roadmap commits bc9e99d, 5c64f2c. No release or dev5 evidence was changed.

[BibinBaby444]

Changes requested. One memory-safety bug reachable from plain Python, plus one native state that's invisible to Python. Verified at 12d265db against a native built from c2pa-rs d738fbb2 (debug, unstable_live_video). Note that CI is not evidence here yet: every test job on this PR was skipped, including "Trusted VSI paired-source API"; only format and tooling checks ran.

P1: closing a session during a native call frees callbacks native is still using.

• TrustedVsiSession._release drops _signer_callback_cb, _dynamic_assertion_cbs and _trusted_vsi_callback, and _teardown calls it before c2pa_free.
• Native free defers the actual drop while a call holds the borrow, so the in-flight finalize_init_uuid keeps calling through the freed thunks.
• Once the Context has been closed (which the contract allows), the session holds the only reference to the claim-signer thunk.
• A single thread is enough. Close the session from inside its own signer_binding callback, then allocate fresh SignerCallbacks:

  finalize raised: _C2paSignature('Signature: internal error (bad parameter: signer callback returned error code -1)')
  real claim callback calls: []  impostor calls: [1876]
  

• Native jumped through the freed claim thunk into an unrelated callback, which received the 1,876-byte claim payload. With different reuse that's a crash or a call into arbitrary code.
• Suggest keeping the callback pins alive for the object's lifetime (don't clear them in _release), or deferring close() until in-flight calls drain.
• The same drop-on-close pattern exists in the older live-video VSI session and Builder _releases, and the native contract text ("until the handle is freed") should say "until the deferred drop".

P2: blocked is never exposed.

• Native C2paLiveVideoTrustedVsiStatusV1 has blocked: bool between has_exhaustion_reason and exhaustion_reason, at offset 18.
• The ctypes struct, TrustedVsiStatus and status() all omit it. The layout still lines up, since Python treats the byte as padding, so there's no memory hazard.
• But Python can't see the one state the contract tells adapters to act on ("After a failure once an external signing call began, the session is blocked. Discard it, construct a NEW session…"):

  before failure: native blocked byte[18] = 0  -> status() has no blocked field
  after failure:  native blocked byte[18] = 1  -> status() unchanged
  next call: _C2paOther Other: bad parameter: session is blocked after a failed external signing step; …
  

• Add the field and a blocked attribute on TrustedVsiStatus, update the offsets pinned in tests/test_trusted_vsi_api.py, and add a paired test that asserts status().blocked after a callback failure.

P2: the stock-native lane will fail, and CI hasn't run it. The dynamic variant of test_scripted_wrappers_store_base_exceptions_return_minus_one_and_reraise calls signer.add_dynamic_assertion unguarded. The -k "not paired" lane in build.yml downloads upstream c2pa-v0.91.0 (c2pa-native-version.txt), and v0.91.0 (e7cc666c) doesn't export c2pa_signer_add_dynamic_assertion, so those four parametrizations raise NotSupported. Guard the variant on has_dynamic_assertions() (or stub the export in _ScriptedNative), then get the skipped jobs to actually run.

P3

• Ladder error guidance drops a guarantee. docs/ladder-signing.md and the sign_ladder docstring say "Errors may leave partial newly created outputs; discard these files", but leave out native's guarantee that "Existing files, including every source, are never overwritten". The native error doesn't say which path failed, so say callers should delete only destinations they confirmed absent before the call. Otherwise a cleanup-everything handler deletes a pre-existing file.
• The version gate is a release label, not an ABI identity. 0.92.0-dev is upstream's workspace version, so the gate effectively rests on the symbol plus mask 63. A native ABI-revision probe would make a future in-place V1 struct change detectable.

[mstattma]

Resolution mapping for the existing review at Python 97c820efde96af75c900c02e05457aab1ba2e1e1, paired with native a6d4cdcc:

• P1 reentrant-close callback lifetime: close becomes logical immediately, refuses new admissions, and defers physical native teardown until admitted calls drain. Callback pins remain alive through native destruction, including borrowed Signer/Context lifetimes. Native operations still require serialization; generic thread safety is not claimed.
• P2 blocked state: ctypes, the status dataclass and status() expose blocked, at native offset 18 with total status size 24; real failure/recovery coverage is included.
• P2 stock-native dynamic cases: scripted dynamic-assertion cases check has_dynamic_assertions(). Paired jobs now actually run focused, ladder, non-threaded, threaded and installed-wheel checks. Stock 0.91.0 and Windows ARM64 limits remain separate, not inferred from this pairing.
• P3 unsafe ladder cleanup guidance: documentation forbids deletion of sources or pre-existing destinations; only positively owned new outputs are cleanup candidates.
• P3 label-only compatibility gate: exact revision 3, SDK token, required symbols and capability mask 63 are checked before trusted operational ctypes binding. Incompatible native libraries fail closed.

The integrated fragmented wrapper also restores the existing six-argument glob-aware ABI and shared-manifest segmented signing, without per-rendition fallback or ownership changes.

Exact-head paired qualification 37688529697 passed on Linux/Windows: 286 focused, 831 non-threaded, 54 threaded and 286 installed-wheel tests per platform, plus the real-native ladder harness. Source/stock/installed evidence is in docs/archive/trusted-vsi-review-verification.md. Required downstream qualification and fresh frozen-source execution are recorded separately with their exact heads and limitations.

Ordinary stock-native hosted release jobs did not run in this paired lane. Immutable dev5 artifacts, release inputs and publication gates are unchanged; no release or universal platform guarantee is claimed.