The clawhub job in distribute.yml compares the SKILL.md version with
the published one on every GitHub Release and submits an update when
they differ. Gated on the CLAWHUB_TOKEN secret: without it the job
skips with a notice, so the workflow lands safely before the secret
exists. A submitted update waits for ClawHub security scans, so a
green job means submitted, not listed.
The runtime's _weights_dir resolves the Hub snapshot offline through an
inline allow_patterns list, so a deployment that pre-caches the snapshot
for HF_HUB_OFFLINE=1 had to re-list the files by hand and silently
drifted when a release added one: the offline resolution then failed on
a four-fifths-present cache even though every missing piece had its own
fallback. Export the exact runtime request list as one public name, use
it in _weights_dir, and pin the seam with a test that captures the
snapshot_download call. Document the contract in photo-classify.md and
module-internals.md.
Issue #98. cv2's encoders write no container metadata, so every pixel-path
output (all, visible, invisible, erase) came back without its colour profile
and orientation tag, even with --keep-metadata.
imwrite now takes display_tags_from, the file whose decode produced the
pixels, and restores the two display tags into the re-encoded output: PNG and
JPEG by splicing iCCP/eXIf chunks and APP1/APP2 segments into the encoded
bytes, WebP by a lossless Pillow re-save (libwebp hides hand-spliced chunks
from readers without a VP8X header), HEIF through the save call itself.
Orientation is re-tagged only when the raster still has the source's stored
dimensions: cv2 rotates JPEG and (build-dependent) PNG decodes under
IMREAD_COLOR but never IMREAD_UNCHANGED, which is what the pixel paths read
with, so the decision is made against the raster's own shape and cannot
double-rotate.
The default metadata strip now preserves what the restore put back: the PIL
path forwards the profile and a scrubbed EXIF (orientation included) for PNG
and WebP outputs, the 16-bit chunk walker re-emits eXIf scrubbed instead of
dropping it wholesale, and --remove-all actually drops the ICC profile on
every format (Pillow's saver fallback kept it alive, contradicting the
documented "removed by --remove-all").
Mirror and 180-degree orientations (2, 3, 4) stay untagged: no cheap signal
distinguishes a rotated decode from a stored one for them.
ComposioHQ accepted a submission with no adoption bar (PR 1841);
VoltAgent lists reject brand-new skills, and the openclaw list indexes
ClawHub entries only. Both re-attempts are deferred with their
re-entry criteria.
The gate head is fitted on the freeze CLIP-L-ft embedding space, so it
belongs with the model: _load_receipt_gate now prefers
receipt-gate-2026-09-02.npz from the Hub snapshot or the
RAIW_CLASSIFY_WEIGHTS directory, with the package asset kept as the
fallback for weights frozen before the gate existed. Card mode of the
publish workflow now uploads the gate alongside the README and the
operating point, and the snapshot allow-pattern includes it.
`skills/remove-ai-watermarks/` teaches a coding agent to drive the CLI on
content the user generated, and refuses stock-agency and other third-party
paid-asset marks. It ships with this repository rather than as a fifth release
surface, and installs through `npx skills add` in any harness or as a Claude
plugin from `.claude-plugin/marketplace.json`.
`scripts/probe.py` measures capability rather than presence: a found binary said
nothing about whether the build can run a visible-mark command, so it writes a
blank PNG with zlib and struct and runs the installed `visible` and `invisible`
on it. Exit 2 is a state only a working stack reaches, and `invisible` checks
its extra before detection, so a signal-free image answers in 0.23s with no
model download. That distinction matters: without CUDA, `all` writes nothing
with the invisible extra installed and writes a useful visible+metadata result
without it, and both exit 1.
The skill also carries what a weak model gets wrong. It must report only what a
command in the session actually did, because a run on a machine with no pixel
stack produced a finished-looking removal report, complete with a size table for
a file nobody wrote. It must not read exit 2 as a verdict, because Click's usage
errors share that code. And it must get explicit consent before
`verify-openai-synthid`, which uploads the user's image to a third party.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 2026-09-02 campaign measured the Aug ChatGPT renderer drift at the
Model 2 level and shipped nothing: leave-one-over-one recovers only the
margin near-miss, hard rejections resist sibling training, and every
refit variant regresses a sibling eval cell through the shared negative
pools (google -10 or meta -6). The drift corpus stays eval-only; the
tc260 producer split is deferred until ContentProducer metadata is
exported from the app database. Preconditions recorded for the next
retrain.
A DEFINITELY verdict now runs a linear receipt gate on the CLIP-L-ft
vector Model 1 already computes: a hit publishes unknown and skips the
124-d provider pass. Trained on CORD-v2 train (800, CC BY 4.0) plus 200
synthetic capture-style receipts against 2,400 ai_train negatives; the
threshold is certified on CORD validation and a synthetic holdout with
no field-receipt pixels. Field receipts false-AI 19/59 -> 2/59, CORD
89/99 -> 0/99, ai_test DEFINITELY cost 7/1,847.
The check read `latest_version` on the node object, which reports only the
ACTIVE version. The registry reviews an upload before activating it, so for the
length of that review a correctly published version looks exactly like a release
that was never synced -- and 0.37.0 hit precisely that: the node repo bumped to
0.1.37 requiring >=0.37.0, the registry accepted it as
NodeVersionStatusPending, and the check called it missing.
Read the versions list instead and branch on the status: active passes, pending
passes while saying so in the summary rather than claiming the node is live, and
anything else fails. A missing version still fails hard, which is the case this
check exists for. Sort the matches by createdAt rather than trusting the
endpoint's current newest-first ordering.
Verified against the live registry in all three states: 0.37.0 pending, 0.36.0
active, 0.99.0 absent and erroring.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
README omitted doubao from both places it lists supported video marks; the
mark has been registered since 2026-08-28 and docs/cli.md and
supported-signals.md already carry it. README also attributed the 2026-07-29
two-clip calibration to video-synthid-oracle.csv, which holds two rows from
one carrier dated 2026-07-31; that calibration was never recorded in a
tracked manifest, so say so rather than implying it is reproducible.
"Both surviving profiles" predates chroma-zimage; there are three. "The SDXL
profiles were removed" reads as false next to the shipped sdxl-zimage --
docs/synthid.md already had the right wording, naming the standalone SDXL and
ControlNet profiles, so use it in the other two places.
The Hub card declared a datasets entry for hugging-face/open-images, which
does not exist and rendered a dead link on the model page. Open Images stays
named in the prose, where it is a source rather than a Hub id.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The code-to-code seams were guarded and the code-to-docs seam was not, so it
drifted the way an unguarded seam does. docs/cli.md named none of
--adaptive-polish, --controlnet-scale, --detect/--no-detect, --humanize,
--strength, --tile-size or --tile-overlap; --no-detect is the escape hatch the
CLI's own --sensitivity help recommends. docs/python-api.md named 9 of the 16
InvisibleOptions fields.
The new test reads the live Click tree and the live dataclass rather than a
hand-kept list. Group spellings by the Click parameter, not by string surgery:
a boolean pair can be spelled --strip-metadata/--keep-metadata or
--keep-standard/--remove-all, and deriving the partner from a --no- prefix
splits those and demands both halves. Mutation-tested both ways -- removing a
flag from cli.md and adding a field to InvisibleOptions each fail it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Hub model and the private training repository were both called
raiw-models, so the training repo's README had to spend a paragraph telling
the two apart. Renamed on both sides: the Hub model to raiw-photo-classify
and the GitHub repository to raiw-classifier-training.
Done now because it is free now. classify.py landed after v0.36.0 and is in
no release, and the Hub model had zero all-time downloads, so no installed
package and no user carries the old id. Hugging Face redirects the old URL
and preserves counts, and the pinned freeze revision c0ac82b6 resolves on
the new name -- verified by downloading through the library's own constants.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Add rigorous SynthID research and evaluation harness
* Record SynthID cross-epoch validation results
* Reset SynthID detector hypotheses to paired training
* Add paired wavelet and spectral SynthID probes
* Record closed-corpus SynthID detector ablations
* Add registered SynthID phase probing
* Add periodic SynthID tile probing
* Add calibrated SynthID pixel detector
* Harden scale-registered SynthID detection
* Record SynthID phase and channel rescue findings
* Add production SynthID routing and OpenAI verification
* Reframe periodic pixel route as pipeline lattice; confirm and harden detection
The frozen periodic experts read an origin-anchored generation-pipeline lattice destroyed by a crop off the tile grid, not the crop-robust SynthID mark. Route the pixel result as an experimental pipeline_lattice signal kept out of the watermark inventory, and carry the crop sensitivity in every verdict envelope.
Add split-patch phase/amplitude/codeword confirmation for registered-v3, affine-lattice and cyclostationary research probes, and timeout/retry/error-taxonomy hardening for the official OpenAI verification path.
* Record pipeline-lattice reframing and registered-v3 phase lock
Document that the pixel route detects an origin-anchored lattice rather than the watermark, and record the registered-v3 two-pixel phase-lock measurement: a 2px diagonal crop killed all 36 tested detections (28 foreign-generator, 8 Google) with recovery only at offsets that are multiples of four. Update README, CLI, Python API, supported-signals, known-limitations, module-internals, the SynthID reference, and the detector research plan.
* Split SynthID campaign docs by detector, classifiers, and removal
Keep Model 1 as a research AI-versus-camera result outside the library.
Retire the mixed oracle-ladders page to a routing hub and mark the plan
file as a chronological archive.
* Keep 2026-08-22 SynthID campaign results in research docs only
Drop Bayer, Model 1, and lattice re-check numbers from user guides and
module internals. The library surface is unchanged.
* Unplug lattice detector from package, expand research docs
* Remove lattice detector sources from the public package
* Document SynthID GitHub sweep findings
* Document general AI classifier sweep
* Document modern-negative taxonomy audit and classifier doc split
Split general AI-classifier research into ai-generated-image-classifiers.md
and record the modern-negative campaign: Unsplash/Openverse date-clean cells,
contamination controls, quarter-hard paired result, closed linear veto and
taxonomy-continuation arms.
pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix (same triage as main); core checks separately green (ruff, format, pyright, 1564 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - split references updated everywhere, none stale; 4) CLAUDE.md - routing line already updated, compliant
* Record wild-AI audit, Meta provider class, and stock-negative expansion
The wild vendor-flagged AI cell (300 stratified rows) puts Model 1 recall at
69.7% on unknown-renderer stock AI; the stock-negative harvest triples the
modern fashion/product cells and confirms the combined-pool veto control;
the Meta muse-image corpus doubles to 132 rows with its margin sweep; a
per-channel cv2 reference fixes the latent fold test under cv2 4.10.0.
pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks separately green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - new run references point at the gitignored research store, none stale; 4) CLAUDE.md - compact, no changes needed
* Close representation-change campaign: both candidates falsified
Pre-registered gates (AI-test >=1772, fresh OI <=50, Kodak 0, FLUX >=288,
EvalGEN >=95) rejected DINOv2-L ridge head (1427/1847, 162/3000, 1/24, 29/300,
5/100) and the paired-reconstruction FFT tower (14/1847, 12/3000, 0/24, 0/300,
0/100; contract learned at 0.949 pairwise separation but no transfer to
production generators). Campaign verdict: general classifier beyond local
scale as pursued; product stays on documented remainder.
pre-commit: 1) maintain.sh - exit 1, known uv-secure lightning advisory with no upstream fix; core checks green minutes ago (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - verdict mirrored in data/research/REPRESENTATION-CAMPAIGN.md, no stale refs; 4) CLAUDE.md - no changes
* Record full failure map, H2 router falsification, and H3 process detector closure
20 measured negative domains with batch-2 (memes, whiteboards, tickets, book
pages). H2 domain router falsified: 97.9% of AI-test looks structured, every
family 94-100%. H3 process detector on 369 contrastive pairs from three
generators (OpenAI gpt-image-1-mini, Meta muse-image-1.0, Gemini flash-image)
achieves 0.909 pairwise AUC on training pairs but transfers at AUC 0.55-0.60
to production AI; human receipts score higher than any AI family. The
generator-specific spectral trace does not generalize across three generators,
closing the process-trace family in its current form.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs + research scripts, single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes
* Record H4-H6 research hypotheses: MLP probe, spectral invariant, TTA voting
H4 (MLP on frozen CLIP): 98.6% AI-test recall but 15.8% photo FPR — same
trade-off curve as quarter-hard. H5 (spectral invariant from CVPR 2025):
2.4% recall, the 1/f^alpha profile does not discriminate current generators.
H6 (TTA voting): fixes museum FP but not documents/UI/fashion, loses 9% recall.
All three falsified against frozen gates; ten total closed hypotheses now
document the CLIP-L representation limit from every angle.
Also records the provider cascade across all 20 domains (69.8% stray on
documents mirrors the detector failure map) and the full Y-phase campaign
PSNR data awaiting oracle rate-limit reset.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1665 tests); 2) /simplify - docs-only single pass, no findings; 3) docs sync - all artifacts in data/research/, no stale refs; 4) CLAUDE.md - no changes
* Fix Y-phase frequency convention, record H4-H6 and campaign results
The initial Y-phase campaign targeted FFT bins 16-32 instead of spatial
periods 16-32 px (1/32 to 1/16 cycles/px). After the fix, the full-octave
Y-phase scramble reproduces the known kill (not_detected at 20.5 dB on s1
at native 1122x1402). Partial sub-bands are visually invisible (42.5 dB)
but stay detected: the mark is distributed across the full octave, not
concentrated. Point intervention is not viable within this frequency band.
H4 MLP probe: 98.6% recall, 15.8% FPR (same trade-off wall).
H5 spectral invariant: 2.4% recall (1/f^alpha does not discriminate).
H6 TTA voting: fixes museum FP but not documents/UI/fashion.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (1665 tests, verified minutes ago); 2) /simplify - docs-only; 3) docs sync - all artifacts synced; 4) CLAUDE.md - no changes
* Add TC260 fifth class and per-class margin calibration to provider cascade
Five-head cascade (openai/google/tc260/meta/no_ai): openai 68.8%, google
76.6%, tc260 63.8%, meta 71.8% mean recall at uniform margin 0.50.
Per-class margins calibrated against 1.67% photo budget: openai 0.31,
google 0.29, tc260 0.39, meta 0.55. TC260 test recall 71.4% at calibrated
margins on 196 held-out images. Chinese-AIGC is a viable pixel class.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified within the hour); 2) /simplify - research script, single pass; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes
* Record universal detector v3-v8: diverse training shifts the curve
Fresh MLP on frozen CLIP embeddings with 49 negative domains (12,258 images)
and 5,043 AI positives achieves 93.0% AI-test recall with 39/49 domains at
zero false positives. Digital art FP dropped from 99.3% (Model 1) to 24.8%,
fashion from 62-71% to 12%, UI from 99.3% to 12%. Photo FPR 0.7%. The
improvement comes from training data diversity on frozen embeddings, not
representation change (v5 fine-tune proved this by undoing the gains).
Also adds .local-eval to ruff exclude so the gate covers only tracked files.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - all artifacts in data/research/; 4) CLAUDE.md - no changes
* Add three-tier ensemble detector: DEFINITELY/POSSIBLY/LIKELY_HUMAN
Combines Model 1 and v8 into calibrated confidence tiers. DEFINITELY_AI
(both models agree) achieves 79.6% recall at 0.50% photo FPR with 46/49
domains at zero FP. The union reaches 93.3% recall at 1.80% photo FPR
with Kodak 0/24. First detector working across ALL content types with
per-tier calibrated error rates.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + ensemble; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes
* Add provider v2: diversity training eliminates document leakage
Same diversity-training insight applied to the provider cascade. Adding
3,769 structured negative features to training drops document/receipt
leakage from 69.8% to 5.1%, UI from 10% to 4.3%, fashion from 5-15% to
0-3%. AI recall improves: OpenAI 84% (was 75%), Google 88.8% (was 79%).
Photo leakage 1.4%. Worst regression: memes 47.9% (was 27%).
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - provider v2; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes
* Add universal v11: full taxonomy, 136 domains, 124 at zero FP
Master data plan mapped 148 visual domains. Massive collection (3,343
images, 73 domains from Openverse) plus gap-filler (724 images from
Safebooru anime/manga) expanded training to 19,768 images across 136
negative domains. Universal v11 (MLP-512 + Model 1 ensemble):
DEFINITELY 90.3% recall at 0.50% photo FPR, ANY 95.6% recall,
124/134 domains at exactly 0% FP, worst FP 13.8% (digital art).
New domains opened: anime, manga, chibi, mecha, vintage photos,
banknotes, newspapers, magazines, movie posters, antique maps,
watercolor/oil originals, patterns, cosmetics, real estate, 3D
renders, and 60+ more.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes
* Confirm representation limit: v12 fine-tune destroys structured FP despite 6x data
Fine-tuning CLIP tower on 19,518 images achieves 95.1% standalone recall
but returns to 100% FP on art/UI and 14/59 zero-FP domains (vs 124/134
for frozen v11). This is a representation property, not a data issue.
Frozen CLIP + MLP (v11) is the only working architecture. Also records
provider v3 trained on all negative domains.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (ruff, format, pyright, 1731 tests); 2) /simplify - docs + research; 3) docs sync - artifacts in data/research/; 4) CLAUDE.md - no changes
* Document v13 plateau: 128/136 zero FP, frozen-CLIP ceiling confirmed
v13 with top-plan expansion (1,169 new images) improves domain coverage
to 128/136 at zero FP and reduces fashion FP to 5.3%, but DEFINITELY
recall plateaus at 89.6% and art FP at 15.9%. The frozen CLIP + MLP
architecture has reached its ceiling.
pre-commit: 1) maintain.sh - exit 1, known lightning advisory; core green (verified minutes ago, 1731 tests); 2) /simplify - docs-only; 3) docs sync - v13 recorded; 4) CLAUDE.md - no changes
* Document the 2026-08-31 photo-classifier freeze.
Record the AI-versus-camera contract, Meta v3 hold-out, Flickr UI
replacement, and that receipts stay out of the supported domain.
* Scrub Spaces catalog details from classifier research docs
* Record receipt layout-gate probe for the universal detector
The head was trained on mixed Chinese AIGC producers that share the
TC260 mark. openai and google stay provider classes. muse-image stays
a model class.
openai, google, and tc260 stay provider classes. The Muse Image head
is public as muse-image, not meta. The freeze file still keys that
head meta_muse_image.
Ship Model 1 then gated Model 2 as an explicit CLI and library call.
identify, has_invisible_target, and all do not import it. Weights stay
on Hugging Face wiltodelta/raiw-models at a pinned revision.
workflow_dispatch uploads wiltodelta/raiw-models using secrets.HF_TOKEN.
Weights stay out of git and come from a GitHub Release tag. Library
releases do not push new heads.
Two public docs named the private sibling repo and its directory layout
as the artifact location. Keep the dated archive key so the artifacts
stay findable, drop the repo-internal path from public view.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The four-fixture Google calibration showed a clean YuNet face-count split:
both zero-face text cards need 0.25 first-clean, both face fixtures clear
at 0.12 with zero cross-source spread. The adaptive arm routes face
content (face_count > 0) to the measured 0.125 rung, saving 6.4 dB PSNR
and doubling face identity cosine vs the flat 0.40 floor. The split is
Google-SynthID-specific: OpenAI's face fixture was harder than its text
fixture, so no other cohort gets an adaptive arm.
Extract TwoStageZImagePipeline shared base from QwenZImagePipeline so all three
profiles are siblings, not a chain. Add ChromaZImagePipeline on that base with
diffusers ChromaImg2ImgPipeline bf16, neutral calibrated prompt, guidance 5.0,
four effective steps with Diffusers truncation compensation, no Canny.
Flat vendor floors from the 2026-08-29/30 oracle calibration across OpenAI
(0.09), Microsoft InvisMark (0.125), Google (0.40), Meta Content Seal (0.17),
seed-stability verified on Meta, full-path face-stage interaction clean through
the Gemini oracle. Research record in docs/chroma1-engine-research.md with the
matched-strength addendum showing Chroma1 regenerates better per unit strength
but its boundaries scatter wider than qwen's. Fix text-manifest guard to reject
chroma-zimage at the boundary, update all profile references from 'both' to
'all three' across src, docs, README, and python-api.
Victor Kuznetsov