mstattma · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026
diff --git a/.github/workflows/castlabs-vsi-pypi.yml b/.github/workflows/castlabs-vsi-pypi.yml
@@ -6,11 +6,11 @@ on:
       release_tag:
         description: Existing immutable Castlabs prerelease tag
         required: true
-        default: castlabs-v0.37.8.dev5
+        default: castlabs-v0.37.13.dev1
         type: string
 
 concurrency:
-  group: castlabs-vsi-pypi-0.37.8.dev5
+  group: castlabs-vsi-pypi-0.37.13.dev1
   cancel-in-progress: false
 
 permissions:
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-python
-          ref: castlabs-v0.37.8.dev5
+          ref: castlabs-v0.37.13.dev1
           fetch-depth: 0
           path: c2pa-python
 
@@ -45,13 +45,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
-          test "${INPUT_RELEASE_TAG}" = castlabs-v0.37.8.dev5
-          test "$(python3 c2pa-python/scripts/castlabs_release.py lock-value package.version)" = 0.37.8.dev5
-          test "$(gh api repos/castlabs/c2pa-python/releases/tags/castlabs-v0.37.8.dev5 --jq '(.draft == false and .prerelease == true)')" = true
+          test "${INPUT_RELEASE_TAG}" = castlabs-v0.37.13.dev1
+          test "$(python3 c2pa-python/scripts/castlabs_release.py lock-value package.version)" = 0.37.13.dev1
+          test "$(gh api repos/castlabs/c2pa-python/releases/tags/castlabs-v0.37.13.dev1 --jq '(.draft == false and .prerelease == true)')" = true
           SOURCE_SHA=$(git -C c2pa-python rev-parse HEAD)
-          test "$(git -C c2pa-python rev-list -n 1 castlabs-v0.37.8.dev5)" = "$SOURCE_SHA"
+          test "$(git -C c2pa-python rev-list -n 1 castlabs-v0.37.13.dev1)" = "$SOURCE_SHA"
           mkdir -p download dist
-          gh release download castlabs-v0.37.8.dev5 \
+          gh release download castlabs-v0.37.13.dev1 \
             --repo castlabs/c2pa-python --dir download
           python3 c2pa-python/scripts/castlabs_release.py validate-release-assets \
             --assets-dir download
@@ -63,29 +63,29 @@ jobs:
               --repo castlabs/c2pa-python \
               --signer-workflow castlabs/c2pa-python/.github/workflows/castlabs-vsi-release.yml \
               --signer-digest "$SOURCE_SHA" \
-              --source-ref refs/tags/castlabs-v0.37.8.dev5 \
+              --source-ref refs/tags/castlabs-v0.37.13.dev1 \
               --source-digest "$SOURCE_SHA" \
               --deny-self-hosted-runners
           done
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.8.dev5-native-linux-x86_64.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.8.dev5-native-windows-x86_64.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence download/c2pa-python-0.37.8.dev5-py3-none-wheels.tar.gz.evidence.json \
+            --evidence download/c2pa-python-0.37.13.dev1-py3-none-wheels.tar.gz.evidence.json \
             --artifact-dir download --source-sha "$SOURCE_SHA"
           python3 c2pa-python/scripts/castlabs_release.py extract \
-            --archive download/c2pa-python-0.37.8.dev5-py3-none-wheels.tar.gz \
+            --archive download/c2pa-python-0.37.13.dev1-py3-none-wheels.tar.gz \
             --destination dist
           test "$(find dist -maxdepth 1 -name '*.whl' | wc -l)" -eq 2
-          cmp dist/c2pa_python-0.37.8.dev5-py3-none-manylinux_2_28_x86_64.whl \
-            download/c2pa_python-0.37.8.dev5-py3-none-manylinux_2_28_x86_64.whl
-          cmp dist/c2pa_python-0.37.8.dev5-py3-none-win_amd64.whl \
-            download/c2pa_python-0.37.8.dev5-py3-none-win_amd64.whl
+          cmp dist/c2pa_python-0.37.13.dev1-py3-none-manylinux_2_28_x86_64.whl \
+            download/c2pa_python-0.37.13.dev1-py3-none-manylinux_2_28_x86_64.whl
+          cmp dist/c2pa_python-0.37.13.dev1-py3-none-win_amd64.whl \
+            download/c2pa_python-0.37.13.dev1-py3-none-win_amd64.whl
           python3 -m pip install packaging==25.0 twine==6.2.0
-          python3 -c 'from packaging.version import Version; v=Version("0.37.8.dev5"); assert v.is_prerelease and str(v)=="0.37.8.dev5"'
+          python3 -c 'from packaging.version import Version; v=Version("0.37.13.dev1"); assert v.is_prerelease and str(v)=="0.37.13.dev1"'
           python3 -m twine check dist/*.whl
 
       - name: Preflight retry-safe PyPI upload set
@@ -94,7 +94,7 @@ jobs:
         run: |
           STATUS=$(curl --silent --show-error --location \
             --output pypi-response.json --write-out '%{http_code}' \
-            https://pypi.org/pypi/c2pa-python/0.37.8.dev5/json)
+            https://pypi.org/pypi/c2pa-python/0.37.13.dev1/json)
           case "$STATUS" in
             200|404) ;;
             *) echo "unexpected PyPI JSON API status: $STATUS" >&2; exit 1 ;;

diff --git a/.github/workflows/castlabs-vsi-release.yml b/.github/workflows/castlabs-vsi-release.yml
@@ -3,21 +3,21 @@ name: Castlabs VSI prerelease
 on:
   push:
     tags:
-      - castlabs-v0.37.8.dev5
+      - castlabs-v0.37.13.dev1
   workflow_dispatch:
     inputs:
       source_sha:
-        description: Full Python SHA (feat/live-video-vsi tip for dev5; paired source for trusted_vsi_only)
+        description: Full Python SHA (feat/trusted-vsi-functional tip for 0.37.13.dev1; paired source for trusted_vsi_only)
         required: true
         type: string
       trusted_vsi_only:
-        description: Only non-publishing paired-source trusted API tests; bypass all dev5 jobs
+        description: Only non-publishing paired-source trusted API tests; bypass all release jobs
         required: false
         type: boolean
         default: false
 
 concurrency:
-  group: castlabs-vsi-release-0.37.8.dev5
+  group: castlabs-vsi-release-0.37.13.dev1
   cancel-in-progress: false
 
 permissions:
@@ -72,15 +72,15 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: 9b80687f386f2b373fd1ac9c705d8e61a07b608e
+          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
           fetch-depth: 1
           path: c2pa-rs
 
       - name: Validate locked sources and release event
         shell: bash
         run: |
           git -C c2pa-python fetch --no-tags origin \
-            refs/heads/feat/live-video-vsi:refs/remotes/origin/feat/live-video-vsi
+            refs/heads/feat/trusted-vsi-functional:refs/remotes/origin/feat/trusted-vsi-functional
           EVENT=manual
           if [[ "${GITHUB_REF}" == refs/tags/* ]]; then EVENT=tag; fi
           python3 c2pa-python/scripts/castlabs_release.py validate-sources \
@@ -123,15 +123,15 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: 9b80687f386f2b373fd1ac9c705d8e61a07b608e
+          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
           fetch-depth: 1
           path: c2pa-rs
 
       - name: Validate locked sources
         shell: bash
         run: |
           git -C c2pa-python fetch --no-tags origin \
-            refs/heads/feat/live-video-vsi:refs/remotes/origin/feat/live-video-vsi
+            refs/heads/feat/trusted-vsi-functional:refs/remotes/origin/feat/trusted-vsi-functional
           EVENT=manual
           if [[ "${GITHUB_REF}" == refs/tags/* ]]; then EVENT=tag; fi
           python3 c2pa-python/scripts/castlabs_release.py validate-sources \
@@ -195,7 +195,7 @@ jobs:
               test "$(find wheelhouse -maxdepth 1 -name "*.whl" | wc -l)" -eq 1
               WHEEL=$(find wheelhouse -maxdepth 1 -name "*.whl")
               case "$(basename "$WHEEL")" in
-                c2pa_python-0.37.8.dev5-py3-none-manylinux_2_28_x86_64.whl) ;;
+                c2pa_python-0.37.13.dev1-py3-none-manylinux_2_28_x86_64.whl) ;;
                 *) echo "unexpected Linux wheel: $WHEEL" >&2; exit 1 ;;
               esac
               /opt/python/cp310-cp310/bin/python -m auditwheel show "$WHEEL"
@@ -215,7 +215,7 @@ jobs:
           SOURCE_DATE_EPOCH: ${{ needs.prepare.outputs.source_epoch }}
         run: |
           cd c2pa-python
-          BUNDLE=release-out/c2pa-python-0.37.8.dev5-native-linux-x86_64.tar.gz
+          BUNDLE=release-out/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz
           python3 scripts/castlabs_release.py pack --output "$BUNDLE" \
             --epoch "$SOURCE_DATE_EPOCH" \
             --member x86_64-unknown-linux-gnu/libc2pa_c.so=release-out/libc2pa_c.so
@@ -278,7 +278,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          ref: 9b80687f386f2b373fd1ac9c705d8e61a07b608e
+          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
           fetch-depth: 1
           path: c2pa-rs
 
@@ -302,7 +302,7 @@ jobs:
             throw "checked-out Cargo.lock SHA-256 changed"
           }
           git -C c2pa-python fetch --no-tags origin `
-            refs/heads/feat/live-video-vsi:refs/remotes/origin/feat/live-video-vsi
+            refs/heads/feat/trusted-vsi-functional:refs/remotes/origin/feat/trusted-vsi-functional
           $event = if ($env:GITHUB_REF.StartsWith("refs/tags/")) { "tag" } else { "manual" }
           python c2pa-python/scripts/castlabs_release.py validate-sources `
             --python-root c2pa-python --rust-root c2pa-rs `
@@ -351,7 +351,7 @@ jobs:
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           $wheels = @(Get-ChildItem dist/*.whl)
           if ($wheels.Count -ne 1) { throw "expected exactly one Windows wheel" }
-          if ($wheels[0].Name -ne "c2pa_python-0.37.8.dev5-py3-none-win_amd64.whl") {
+          if ($wheels[0].Name -ne "c2pa_python-0.37.13.dev1-py3-none-win_amd64.whl") {
             throw "unexpected Windows wheel $($wheels[0].Name)"
           }
           python -m twine check $wheels[0].FullName
@@ -371,7 +371,7 @@ jobs:
           $ErrorActionPreference = "Stop"
           $PSNativeCommandUseErrorActionPreference = $true
           Push-Location c2pa-python
-          $bundle = "release-out/c2pa-python-0.37.8.dev5-native-windows-x86_64.tar.gz"
+          $bundle = "release-out/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz"
           python scripts/castlabs_release.py pack --output $bundle `
             --epoch $env:SOURCE_DATE_EPOCH `
             --member x86_64-pc-windows-msvc/c2pa_c.dll=release-out/c2pa_c.dll
@@ -424,9 +424,9 @@ jobs:
       - name: Test installed wheel in a clean environment
         shell: bash
         env:
-          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.8.dev5
+          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev1
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
-          C2PA_SOURCE_BUILD_VERSION: 0.91.0-dev
+          C2PA_SOURCE_BUILD_VERSION: 0.92.0-dev
         run: |
           test "$(find release-out -maxdepth 1 -name '*.whl' | wc -l)" -eq 1
           python -m venv "${RUNNER_TEMP}/wheel-test"
@@ -464,9 +464,9 @@ jobs:
       - name: Test installed wheel in a clean environment
         shell: pwsh
         env:
-          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.8.dev5
+          CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev1
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
-          C2PA_SOURCE_BUILD_VERSION: 0.91.0-dev
+          C2PA_SOURCE_BUILD_VERSION: 0.92.0-dev
         run: |
           $ErrorActionPreference = "Stop"
           $PSNativeCommandUseErrorActionPreference = $true
@@ -487,7 +487,7 @@ jobs:
 
   release:
     needs: [prepare, linux, windows, test-linux-wheel, test-windows-wheel]
-    if: github.ref == 'refs/tags/castlabs-v0.37.8.dev5'
+    if: github.ref == 'refs/tags/castlabs-v0.37.13.dev1'
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     environment: castlabs-vsi-release
@@ -522,7 +522,7 @@ jobs:
           LINUX_WHEEL=$(find collected/linux -maxdepth 1 -name "*.whl")
           WINDOWS_WHEEL=$(find collected/windows -maxdepth 1 -name "*.whl")
           test "$(find collected/linux collected/windows -name "*.whl" | wc -l)" -eq 2
-          BUNDLE=assets/c2pa-python-0.37.8.dev5-py3-none-wheels.tar.gz
+          BUNDLE=assets/c2pa-python-0.37.13.dev1-py3-none-wheels.tar.gz
           python3 c2pa-python/scripts/castlabs_release.py pack \
             --output "$BUNDLE" --epoch "$SOURCE_DATE_EPOCH" \
             --member "$(basename "$LINUX_WHEEL")=$LINUX_WHEEL" \
@@ -539,13 +539,13 @@ jobs:
           python3 c2pa-python/scripts/castlabs_release.py checksum \
             --artifact "$BUNDLE.evidence.json"
           cp "$LINUX_WHEEL" "$WINDOWS_WHEEL" assets/
-          cp collected/linux/c2pa-python-0.37.8.dev5-native-linux-x86_64.tar.gz* assets/
-          cp collected/windows/c2pa-python-0.37.8.dev5-native-windows-x86_64.tar.gz* assets/
+          cp collected/linux/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz* assets/
+          cp collected/windows/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz* assets/
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence assets/c2pa-python-0.37.8.dev5-native-linux-x86_64.tar.gz.evidence.json \
+            --evidence assets/c2pa-python-0.37.13.dev1-native-linux-x86_64.tar.gz.evidence.json \
             --artifact-dir assets --source-sha "${{ needs.prepare.outputs.source_sha }}"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
-            --evidence assets/c2pa-python-0.37.8.dev5-native-windows-x86_64.tar.gz.evidence.json \
+            --evidence assets/c2pa-python-0.37.13.dev1-native-windows-x86_64.tar.gz.evidence.json \
             --artifact-dir assets --source-sha "${{ needs.prepare.outputs.source_sha }}"
           python3 c2pa-python/scripts/castlabs_release.py validate-evidence \
             --evidence "$BUNDLE.evidence.json" --artifact-dir assets \
@@ -559,7 +559,7 @@ jobs:
       - name: Require immutable release tag
         shell: bash
         run: |
-          TAG=castlabs-v0.37.8.dev5
+          TAG=castlabs-v0.37.13.dev1
           git -C c2pa-python fetch origin "refs/tags/${TAG}:refs/tags/${TAG}"
           test "$(git -C c2pa-python rev-list -n 1 "$TAG")" = \
             "${{ needs.prepare.outputs.source_sha }}"
@@ -575,7 +575,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          TAG=castlabs-v0.37.8.dev5
+          TAG=castlabs-v0.37.13.dev1
           SOURCE_SHA="${{ needs.prepare.outputs.source_sha }}"
           RELEASE_NAME=$(python3 c2pa-python/scripts/castlabs_release.py release-value name)
           RELEASE_BODY=$(python3 c2pa-python/scripts/castlabs_release.py release-value body)
@@ -601,7 +601,7 @@ jobs:
           }
           discover_release() {
             gh api --paginate repos/castlabs/c2pa-python/releases \
-              --jq '.[] | select(.tag_name == "castlabs-v0.37.8.dev5")' > "$1"
+              --jq '.[] | select(.tag_name == "castlabs-v0.37.13.dev1")' > "$1"
             return 0
           }
           query_release_id() {

diff --git a/.github/workflows/trusted-vsi-paired.yml b/.github/workflows/trusted-vsi-paired.yml
@@ -34,9 +34,10 @@ jobs:
       C2PA_TRUSTED_VSI_FUNCTIONAL_REQUIRED: "1"
       C2PA_REQUIRE_SIGN_LADDER: "1"
       C2PA_REQUIRE_FRAGMENTED_FILES: "1"
-      FUNCTIONAL_BUILD_VERSION: 0.37.13.dev0
+      C2PA_FRAGMENT_OFFSET_REQUIRED: "1"
+      FUNCTIONAL_BUILD_VERSION: 0.37.13.dev1
       # The release smoke asserts the installed distribution version.
-      CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev0
+      CASTLABS_RELEASE_EXPECTED_VERSION: 0.37.13.dev1
     steps:
       - name: Require a full Python source SHA
         shell: bash
@@ -50,9 +51,10 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: castlabs/c2pa-rs
-          # Integrated native review fixes plus the explicit revision-3 gate.
-          # Qualification-only source pairing; never an immutable dev5 input.
-          ref: a6d4cdcc05638ee8dd0afce7fa5c850d7031a80c
+          # Revision-3 trusted VSI plus offset-aware fragment verification:
+          # the same native commit the 0.37.13.dev1 release lock pins. This job
+          # is qualification-only and never produces release artifacts.
+          ref: 3328b2b440fd07d9f857cbefa3c6d565093425de
           path: paired-rust
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
@@ -94,7 +96,7 @@ jobs:
         shell: bash
         working-directory: python-source
         # The release smoke is required here (no module-level skip): it exercises
-        # dev5 capabilities against the paired functional native library.
+        # release capabilities against the paired functional native library.
         env:
           CASTLABS_RELEASE_SMOKE_REQUIRED: "1"
         run: python -m pytest -q -ra --ignore=tests/test_unit_tests_threaded.py -o faulthandler_timeout=120