[mstattma]

Purpose

Prepare the operator-selected signer-aligned dependency version
0.37.13+signer.1.0.8, intended tag castlabs-v0.37.13+signer.1.0.8.
This is preparation only: no tag, release or publication is authorized here.

Inputs

• Native castlabs/c2pa-rs@6021100cc5060b06061ca15b634281cfeb97c718, the merged
  proof-of-concept: go library contentauth/c2pa-python#27/Add note about not accessing cert locally in prod contentauth/c2pa-python#28/c2pa_api: remove double return statement contentauth/c2pa-python#29 source: generic BMFF exclusions, ZIP 9.0.4/WASI fixes, verified
  VSI init refreshes and native CLI update timelines.
• Cargo.lock SHA-256 ff5cf2de2403ff491957fc8a2206c289203d2799a30425bd615f7c9e69974a8f.
• Rust 1.96.0, native 0.92.0-dev, trusted contract revision 3, capability mask 63,
  native feature set and Python runtime ABI unchanged.

The native exact-SHA focused tests/Clippy/feature-off checks and complete
Linux/Windows binary/bundle qualification passed. Publication remains a separate gate.

Changes

• Align package, schemas, release inputs, workflow checkouts, tests and current
  documentation to the selected version and native source.
• Prepare final immutable GitHub releases (prerelease=false), still created
  as owned/no-clobber drafts behind the exact tag-push and environment gates.
• Escape the literal + in the tag trigger, retain the local version in wheel
  and dist-info identities, and encode asset-upload query names.
• Explicitly reject aligned releases in PyPI promotion; the historical dev2
  PyPI target and all historical release/tag/evidence records remain unchanged.
• Reuse the isolated qualification builder for the exact signer-aligned source
  identity or future development versions. Other final/historical identities
  remain rejected. No future development version is selected in this candidate.

The locked artifact-release branch remains feat/trusted-vsi-functional.
Manual artifact builds on arbitrary preparation branches remain forbidden.
The separate reviewed-source paired path is non-publishing and can qualify this
PR before integration. The upstream-prebuilt c2pa-native-version.txt is unchanged.

Verification

Static release-safety review found no blocking code issues. Lock validation and
whitespace checks passed. No local tests, builds or installs were run.

Paired Linux/Windows qualification passed on Python source 44b4bf4 and native
6021100c: 286 focused tests, 926 nonthreaded tests, 54 threaded tests, real-native
ladder tests, isolated aligned wheel/sdist packaging, and 286 installed-wheel
tests on each platform. All paired checks executed; artifact/release jobs were
skipped in that qualification-only run. No local tests/builds were run.

Signer release/1.0.8 dependency declarations/input/lock and bundled CLI provenance
must be updated only after the new immutable dependency set is approved.

Merged Source And Artifact CI

Merged as abc9a034ec82ba54552f9927d6affc993b25b6c1. Its source tree matches the qualified 44b4bf4 tree exactly (e80fa17beffb1381616da0ea86028e2dbd4131ac).

Paired qualification: https://github.com/castlabs/c2pa-python/actions/runs/39005436175

Build-only artifact CI on the exact functional tip: https://github.com/castlabs/c2pa-python/actions/runs/39007004136. trusted_vsi_only=false here builds and tests platform artifacts; the tag-push-only release job was skipped for this manual branch run. Both platform builds and clean
installed-wheel test matrices (Python 3.10 through 3.13) passed. Artifacts have
been downloaded and retained locally; bundle/evidence checksums and both
schema-2 platform evidence documents validated against the actual wheels and sources.

Final native bundle qualification: https://github.com/castlabs/c2pa-rs/actions/runs/39004441528. Both Linux and Windows passed release binary builds, exports/header/CLI smoke,
bundle generation and upload. Release publication was skipped.

After qualification, the operator explicitly authorized dependency-only publication. Tag castlabs-v0.37.13+signer.1.0.8 points to abc9a034; tagged CI is https://github.com/castlabs/c2pa-python/actions/runs/39010024287 and it passed. After the explicitly authorized one-run protected-environment approval, all 16 tagged assets/evidence and pinned GitHub/Sigstore attestations validated. Release https://github.com/castlabs/c2pa-python/releases/tag/castlabs-v0.37.13%2Bsigner.1.0.8 is published: ID415634231, immutable=true, draft=false, prerelease=false. No PyPI or signer publication occurred. Operator-approved signer pin preparation is proposed separately in castlabs/stardustproof-c2pa-signer#54; protected signer approval variables remain unchanged.