pillow-heif's opener rewrites the EXIF orientation to 1 and stashes the real
value in info["original_orientation"], while libheif turns the raster on decode
exactly when the container declares an effective irot/imir transform. A camera
HEIC (stored raster, EXIF-only rotation) and a re-encoded one (rotation baked
as irot) both decode with Image.size matching the raster and the tag blanked,
so _read_display_tags dropped the turn for both (issue #105): a camera HEIC
went through erase and came out sideways with nothing on it saying so.
For HEIF the caller's orientation_applied claim is now ignored the way it is
for TIFF, and the container decides: isobmff.heif_transform_applied scans
meta/iprp/ipco for an irot with a non-zero angle or any imir, the orientation
comes from original_orientation, and a transform-bearing file drops the tag.
AVIF keeps the generic path: this plugin build neither blanks its tag nor
applies the transform there, and a camera-style AVIF's orientation stays
unreachable from Pillow (recorded in known-limitations).
Tests build the camera fixture without exiftool: a pillow-heif-written file
with its irot angle neutralized to the identity behaves like the reporter's
exiftool-built camera file. Mutation-checked in both directions: forcing the
detector either way fails exactly the tests whose property broke.
pre-commit: 1) maintain.sh - exit 2 at the uv-secure gate, the three triaged
no-fix advisories in docs/development.md (rechecked 2026-09-09: accelerate
1.15.0 and lightning 2.6.5 still carry no fix); ruff check+format clean,
pyright src/ 0 errors, 2368 passed 3 skipped run separately; 2) /simplify -
single pass, no fan-out available, one duplicate test helper inlined, no
other findings; 3) docs sync - heif_transform_applied, original_orientation,
irot, imir live only in module-internals.md and known-limitations.md, both
updated, no other refs; 4) CLAUDE.md - audited against the structure rule,
no additions; revise-claude-md: no CLAUDE.md changes
Both readers in the imread stack apply the TIFF orientation tag (cv2's
libtiff path under IMREAD_UNCHANGED too, and Pillow's TIFF plugin,
identically), so the visible path's blanket orientation_applied=False
carried the tag onto an already-turned raster. _read_display_tags now
ignores the explicit claim for TIFF and decides on the IFD's stored size,
which also keeps a hypothetical non-turning build correct: a stored-shape
raster still carries the tag. Guarded at the api seam, not just imwrite.
pre-commit: 1) maintain.sh - exit 2 at the uv-secure gate, the three
triaged no-fix advisories in docs/development.md (rechecked 2026-09-08);
ruff check+format clean, pyright src/ 0 errors, 2363 passed 3 skipped
run separately; 2) /simplify - single pass, no fan-out available, nothing
to fix (api-state plumbing rejected as disproportionate); 3) docs sync -
identifiers live only in docs/module-internals.md, updated, no other
refs; 4) CLAUDE.md - audited against the structure rule, no additions,
revise-claude-md: no additions
Resolve image_io.py and test_image_io.py the same way the rebased
adaptation branch does, so the branch carries the author's original
commit 1cfdf19 on top of current main.
commands.md names liblib_pill and the auto pipeline routing OpenAI
provenance to qwen-zimage, both of which only exist since CLI 0.39.0,
while probe.py kept MIN_CLI_VERSION at 0.38.0: a 0.38.0 install would
pass the probe's currency check and then reject the very mark key and
routing the skill hands it. The references now carry the established
(since CLI X.Y.Z) annotations and the floor rises to 0.39.0, per
docs/agent-skill.md.
The floor was hand-synced against prose only a person could read, so it
drifted exactly the way its own comment warns about, twice before. A new
guard derives the floor's lower bound from every (since CLI X.Y.Z)
annotation in the skill tree and fails when the floor lags the newest
one; combined with the existing package-version ceiling, the floor is
now pinned from both sides. Skill version 1.0.6 in SKILL.md, plugin.json,
and marketplace.json.
pre-commit: 1) maintain.sh - exit 2 (uv-secure on the documented
lightning/accelerate blocks, unchanged lock; core checks separately:
C2PA sync current, Ruff 1 fix + 1 reformat folded into this commit,
Pyright src/ 0 errors, 2361 passed 3 skipped); 2) /simplify -
single-pass four angles, clean; 3) docs sync - grepped MIN_CLI_VERSION
and since CLI over docs/ and rules/: both mentions stay accurate;
4) CLAUDE.md - improver grade A earlier this session, revise: no
additions
download-artifact@v8 extracts the only pattern-matched artifact directly
into the target path, without the artifact-name directory the resolve
step assumed, so every workflow_run verification died at
"No distributed release identity found" before checking a single
surface. The directory-name attempt check now applies only when the
artifact directory exists; a flat identity is still pinned by the
run-id and attempt-eligibility asserts. The workflow_run path of
5c6588b had never executed: v0.38.0's run failed on later checks and
the surfaces were confirmed by a manual dispatch.
The new test drives the real workflow script against the flat layout
and reproduced the production failure before the fix.
pre-commit: 1) maintain.sh - exit 2 (uv-secure on the documented
lightning/accelerate blocks, unchanged lock; core checks separately:
C2PA sync current, Ruff clean with no rewrites, Pyright src/ 0 errors,
2360 passed 3 skipped); 2) /simplify - single-pass four angles, clean;
3) docs sync - grepped distributed-release over docs/: the one mention
stays accurate; 4) CLAUDE.md - improver grade A earlier this session,
revise: no additions
Round unsharp output in its existing buffer before uint8 conversion, preserving
constant images across OpenCV builds. Compare explicit stored WebP decodes.
Use host-absolute launcher fixtures and restrict Ubuntu Bash harnesses to POSIX.
Document the CI findings and the unresolved Dependabot Transformers/tokenizers
candidate conflict. Keep the existing model dependency constraints.
Repair image and metadata publication contracts, detection routing, research
artifact validation, release verification, and the published agent skill.
Refresh the dependency lock and reconcile documentation with verified behavior.
Add regression coverage and record the completed audit and corrected VideoSeal
measurements. Preserve the existing Accelerate and Lightning versions.
Validation: Ruff and Pyright pass; 2358 tests pass with 3 skipped. The maintenance
gate exits 2 on the documented Accelerate and Lightning security findings.
bytedance generator class (surgical six-head provider.pt), tc260 group
veto, stable-name receipt-gate.npz with the threshold inside the
artifact, snapshot-tolerant loader, weights pinned to revision
4c276376 (published via photo-classify-freeze-2026-09-07 release).
The ignore rule landed with a comment naming the private product, its storage
provider, the private rule file, and the size of the customer set. That text is
the disclosure the rule exists to prevent, so it says what a public reader needs
instead: these trees are local-only and not publication-cleared.
`data/research/` gets the same tracked rule as `data/spaces/`. It held 68 GB
behind `.git/info/exclude` alone, which no clone has, so a fresh checkout could
commit the whole corpus with nothing to stop it, and a test now pins both
entries.
A first draft of that test also carried a denylist of private identifiers,
which published six of them into a tracked file to keep two out, and only its
own self-exclusion hid that. The mechanized half is now the one that discloses
nothing: no cloud GPU harness under `scripts/`. Reading the ignore entries
rather than the file text matters too, because a comment naming
`data/research/README.md` satisfied the first assertion with the rule deleted.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Content Seal manifest named the production GPU worker in its provenance
column and in two row keys, several docstrings described their sources as user
uploads from the private corpus, and that corpus was called by the storage
product holding it. Each is now what a public reader can check: a pipeline and
strength, material that is not publication-cleared, and a private corpus. The
corpus test follows the renamed rows. Deployment and tier detail goes the same
way, since which backend each hosting tier can afford is a product decision,
not a library fact.
Twelve harnesses that need a cloud GPU account leave scripts/. The research
pages that cite their findings name them as harnesses kept outside this
repository and stop implying a reader can rerun them; the tracked inputs and
recorded verdicts remain the durable record, and the offline analysis step
stays here with its test. A development invariant states the rule so the next
harness is not added back.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The previous commit slipped past a red test: the pytest exit code was
swallowed by a pipe in the shell chain. This pins the test to
4c2763766dd1c8c212d64e01e1cc3f166243c47d.
Provider classes now name the GENERATOR that rendered the pixels, never
the brand. bytedance joins openai/google/muse-image as the shared
ByteDance lineage (Doubao and Jimeng render with one model family;
measured: separate heads cross-fire 32/22 at 3.5x mass, the surgical
union holds 83.9% on the frozen test cell while openai/google/meta/no_ai
stay byte-identical to run1). tc260 stops being a public value: its head
remains as the group veto for the rest of China's generators (without
it, 207/379 China test rows would be falsely named openai or
muse-image), and the loader tolerates provider snapshots that predate
bytedance. The receipt gate moves model-side: stable-name artifact
receipt-gate.npz carries its threshold, head and threshold always load
from one file, and the publish script stages the stable gate from the
weights source. Microsoft stays metadata-only: 144 of its 253 bank rows
name an OpenAI model as their C2PA softwareAgent and none names a
Microsoft renderer.
pre-commit: 1) maintain.sh - exit 1 (uv-secure: lightning 2.6.5 via
trustmark, PYSEC-2026-3624 no fix released; per docs/development.md the
core checks ran separately: ruff clean, pyright 0 errors, 2059 passed
3 skipped); 2) /simplify - single-pass four angles, clean, one noted
skip (gate-test npz staging duplication); 3) docs sync - grepped
bytedance/receipt-gate.npz/provider values over README, docs, skill,
rules: no stale references; 4) CLAUDE.md - improver: no changes,
revise: no additions (learnings live in canonical docs)
Extend the development-only benchmark family from images to audio and
video, and close four research directions from the watermark-landscape
map with local, revision-pinned evidence.
Benchmark schema: media_type audio and video rows, audioseal and
videoseal adapters with media-checked adapter binding, sample-domain
audio fidelity (SNR with unbounded_identical), frame-domain video
fidelity (mean PSNR, changed-frame fraction), and per-frame temporal
evidence in videoseal detection records. The report accepts all three
media types and carries SNR columns.
Audio: shared pinned AudioSeal oracle, synthetic and system-voice
speech cohorts with matched negatives, codec, noise, removed, and
forged arms, and the provenance experiment proving visual-only video
cleaning leaves the audio bitstream and watermark verdict invariant.
Video: TorchScript-only VideoSeal oracle (the pip package is unusable
on macOS arm64 and its loader resolves paths relative to cwd), video
cohort with crf/scale/fps attacks and four-state arms, temporal
evaluation measuring the crf decay curve, the frame-aggregation matrix
(computed locally after finding the TorchScript build ignores the
aggregation argument), and real provider clips as carriers.
Forgery: double-embedding study showing the last writer wins completely
under both oracles, scoped remover-trace probe, and the forged/
removed cohort arms encoding each scheme's correct expected verdict
(presence rule for audioseal, message rule for videoseal).
C2PA resolution: measured the five vendors' resolver contracts and the
C2PA 2.2 18.10.5 privacy gradient; product decision recorded that this
tool never resolves over the network. A registry guard pins the
published resolution-API set.
Gate: ruff and pyright src/ clean, 2114 passed / 3 skipped; maintain.sh
stops only on the known unfixed lightning 2.6.5 CVEs, pre-existing.
`_read_display_tags` drops the orientation when the raster no longer has the
source's stored dimensions, which is what stops an upright decode from being
tagged into a second rotation. It read those dimensions off `Image.size`.
That is not the stored size for TIFF: Pillow's TIFF reader applies the EXIF
orientation itself and reports the upright one. For a transposing orientation
the comparison was upright-against-upright, so it matched and the tag rode
along onto pixels that were already turned. `erase` on a 96x64 TIFF tagged 6
returned a 64x96 PNG carrying Orientation 6, and a viewer turned it again.
The TIFF IFD keeps the real geometry in ImageWidth/ImageLength, and no other
Pillow plugin exposes `tag_v2`, so every other container falls back to
`Image.size` and is byte-for-byte unaffected.
Also corrects `_pil_read`'s "No EXIF auto-rotation, matching cv2": Pillow's
TIFF reader rotates and cannot be told not to. Coming back upright is the
useful outcome; carrying the tag on top of it was the defect.
The test monkeypatched huggingface_hub.snapshot_download by string, which
imports the real module. huggingface-hub rides the classify extra, not
the dev sync, so the CI matrix failed with ModuleNotFoundError on every
platform while the shared checkout venv hid the gap. Insert a stub into
sys.modules instead: the seam under test is classify's request, not the
hub client.
The runtime's _weights_dir resolves the Hub snapshot offline through an
inline allow_patterns list, so a deployment that pre-caches the snapshot
for HF_HUB_OFFLINE=1 had to re-list the files by hand and silently
drifted when a release added one: the offline resolution then failed on
a four-fifths-present cache even though every missing piece had its own
fallback. Export the exact runtime request list as one public name, use
it in _weights_dir, and pin the seam with a test that captures the
snapshot_download call. Document the contract in photo-classify.md and
module-internals.md.
Issue #98. cv2's encoders write no container metadata, so every pixel-path
output (all, visible, invisible, erase) came back without its colour profile
and orientation tag, even with --keep-metadata.
imwrite now takes display_tags_from, the file whose decode produced the
pixels, and restores the two display tags into the re-encoded output: PNG and
JPEG by splicing iCCP/eXIf chunks and APP1/APP2 segments into the encoded
bytes, WebP by a lossless Pillow re-save (libwebp hides hand-spliced chunks
from readers without a VP8X header), HEIF through the save call itself.
Orientation is re-tagged only when the raster still has the source's stored
dimensions: cv2 rotates JPEG and (build-dependent) PNG decodes under
IMREAD_COLOR but never IMREAD_UNCHANGED, which is what the pixel paths read
with, so the decision is made against the raster's own shape and cannot
double-rotate.
The default metadata strip now preserves what the restore put back: the PIL
path forwards the profile and a scrubbed EXIF (orientation included) for PNG
and WebP outputs, the 16-bit chunk walker re-emits eXIf scrubbed instead of
dropping it wholesale, and --remove-all actually drops the ICC profile on
every format (Pillow's saver fallback kept it alive, contradicting the
documented "removed by --remove-all").
Mirror and 180-degree orientations (2, 3, 4) stay untagged: no cheap signal
distinguishes a rotated decode from a stored one for them.
Three invariants the deterministic suite did not pin: the version
triple (SKILL.md, plugin.json, marketplace.json), the 500-line SKILL.md
budget, and probe.py MIN_CLI_VERSION never exceeding the package
version. skill.yml gives skill-only changes a seconds-fast gate on top
of the full Tests workflow.
ffc46db5 carries receipt-gate-2026-09-02.npz and the receipt_gate
operating-point entry, so fresh classify installs load the gate from the
model snapshot; the package asset remains the fallback for pre-gate
weights directories.
The gate head is fitted on the freeze CLIP-L-ft embedding space, so it
belongs with the model: _load_receipt_gate now prefers
receipt-gate-2026-09-02.npz from the Hub snapshot or the
RAIW_CLASSIFY_WEIGHTS directory, with the package asset kept as the
fallback for weights frozen before the gate existed. Card mode of the
publish workflow now uploads the gate alongside the README and the
operating point, and the snapshot allow-pattern includes it.
Victor Kuznetsov