Release 0.40.6

.github/workflows/distribute.yml

@@ -7,8 +7,8 @@ name: Distribute on release
 #   - HF Space: factory-rebuild the version already pinned in the Space repo.
 #   - ComfyUI: sync, test, and publish the node against the exact library release.
 #   - ClawHub: publish the agent skill when its own version moved.
-# All wait for the freshly published sdist to appear on PyPI first, since the
-# Release event fires in parallel with publish.yml's upload.
+# All wait for the freshly published distribution to appear in both PyPI APIs
+# first, since the Release event fires in parallel with publish.yml's upload.
 
 on:
   release:
@@ -22,6 +22,9 @@ on:
 jobs:
   resolve:
     runs-on: ubuntu-latest
+    # Thirty attempts may spend up to 20 seconds each in the JSON request,
+    # simple-index request, and inter-attempt delay. Leave bounded headroom.
+    timeout-minutes: 25
     outputs:
       version: ${{ steps.v.outputs.version }}
       url: ${{ steps.sdist.outputs.url }}
@@ -63,26 +66,35 @@ jobs:
           path: release-identity.json
           if-no-files-found: error
 
-      - name: Wait for the sdist on PyPI, capture url + sha256
+      - name: Wait for the PyPI JSON and simple indexes, capture sdist metadata
         id: sdist
         run: |
           set -euo pipefail
           v="${{ steps.v.outputs.version }}"
           for i in $(seq 1 30); do
-            if rel=$(curl -fsSL "https://pypi.org/pypi/remove-ai-watermarks/$v/json" 2>/dev/null); then
-              url=$(echo "$rel" | python3 -c "import sys,json;d=json.load(sys.stdin);print(next((u['url'] for u in d['urls'] if u['packagetype']=='sdist'),''))")
-              sha=$(echo "$rel" | python3 -c "import sys,json;d=json.load(sys.stdin);print(next((u['digests']['sha256'] for u in d['urls'] if u['packagetype']=='sdist'),''))")
+            if rel=$(curl --connect-timeout 10 --max-time 20 -fsSL "https://pypi.org/pypi/remove-ai-watermarks/$v/json" 2>/dev/null); then
+              read -r url sha <<< "$(echo "$rel" | python3 -c "import sys,json;u=next((u for u in json.load(sys.stdin)['urls'] if u['packagetype']=='sdist'),{});print(u.get('url',''),u.get('digests',{}).get('sha256',''))")"
               if [ -n "$url" ] && [ -n "$sha" ]; then
-                echo "url=$url" >> "$GITHUB_OUTPUT"
-                echo "sha=$sha" >> "$GITHUB_OUTPUT"
-                echo "Found sdist for $v"
-                exit 0
+                # PyPI's JSON API can show a freshly uploaded file before the
+                # simple index used by pip has caught up. Downstream release
+                # jobs install by package version, so waiting on JSON alone
+                # creates a release-time race for them.
+                simple=$(curl --connect-timeout 10 --max-time 20 -fsSL https://pypi.org/simple/remove-ai-watermarks/ 2>/dev/null || true)
+                artifact=${url##*/}
+                if [[ "$simple" == *"$artifact"* ]]; then
+                  echo "url=$url" >> "$GITHUB_OUTPUT"
+                  echo "sha=$sha" >> "$GITHUB_OUTPUT"
+                  echo "PyPI JSON and simple indexes list $v"
+                  exit 0
+                fi
               fi
             fi
-            echo "sdist for $v not on PyPI yet (attempt $i), waiting..."
-            sleep 20
+            if [ "$i" -lt 30 ]; then
+              echo "PyPI indexes do not both list $v yet (attempt $i), waiting..."
+              sleep 20
+            fi
           done
-          echo "::error::sdist for $v did not appear on PyPI in time"
+          echo "::error::PyPI JSON and simple indexes did not both list $v in time"
           exit 1
 
   homebrew:

docs/module-internals.md

@@ -2272,6 +2272,17 @@ resolution case -- every verdict so far comes from one fixture and one seed.
 Both ends of the shipped curve now have oracle verdicts, and the shipped curve clears
 everything it has been tested at:
 
+A source-fresh GPT Image 2.5 check on 2026-09-15 exercised the complete shipped
+profile rather than only a strength sweep. One 1024 x 1024 API generation from
+Flare and one from Sunburst both validated as current OpenAI C2PA, routed to the
+flat OpenAI strength, and remained OpenAI SynthID-positive after pixel-identical
+metadata removal. The complete `qwen-zimage` profile at 0.07675, seed 0, cleared
+both in the official OpenAI Content Provenance API. The Flare output measured
+37.48 dB PSNR / 0.9329 SSIM and the Sunburst output 37.01 dB / 0.9179 against
+their sources. Those fidelity numbers describe two neutral studio-photo
+carriers, not a content-wide quality estimate, and the source-positive/output-negative
+oracle pairs do not replace the wider OpenAI calibration that set the floor.
+
 | oracle | fixture size | detected at | clean from |
 |---|---|---|---|
 | openai.com/verify | 1.57 MP | 0.06 | 0.08 |

docs/release-and-distribution.md

@@ -255,13 +255,15 @@ lists it: uv serves its cached pre-release view of the index. Re-run with a
 fresh cache (`UV_CACHE_DIR=$(mktemp -d)`) before treating it as a release
 failure.
 
-The ComfyUI sync run can fail the same way on its own: it resolves the version
-from the PyPI JSON API (which updates first) but installs the test dependency
-with pip against the simple index, whose CDN edges lag by minutes. The
-`distribute.yml` waiter also has a clock: 0.40.0's node suite finished after
-the 15-minute poll, so the job now waits 30 minutes and then accepts a
-registry row that already requires this library version. Rerun the failed
-`comfyui` job only when the registry still has no such row.
+The ComfyUI sync resolves the version from the PyPI JSON API but installs its
+test dependency through pip's simple index, whose CDN edges can lag by
+minutes. `distribute.yml` gates every downstream job on both APIs listing the
+release, so it cannot dispatch that race again. The ComfyUI waiter itself has
+a clock: 0.40.0's node suite finished after the 15-minute poll, so it now
+waits 30 minutes and then accepts a registry row that already requires this
+library version. For an older distribution that started before the simple
+index caught up, rerun its failed `comfyui` job only when the registry still
+has no such row.
 
 The automatic `verify-release.yml` run after `distribute.yml` checks the
 Hugging Face Space pin. When `RAIW_HF_SPACE_TOKEN` is set, that pin lands

docs/supported-signals.md

@@ -171,7 +171,11 @@ and `scripts/synthid_runtime/`.
 The tool recognizes presence from supported provenance: Google AI C2PA
 under Google's all-media watermark policy, and current OpenAI C2PA carrying an
 explicit `c2pa.watermarked.*` action. Legacy OpenAI C2PA without that action
-does not assert SynthID.
+does not assert SynthID. GPT Image 2.5 Flare and Sunburst were verified on
+2026-09-15: both API outputs carried valid OpenAI C2PA with
+`c2pa.watermarked.unbound` and exercised the existing model-independent OpenAI
+route. Automatic routing selected `qwen-zimage` with the OpenAI strength cohort,
+and both outputs cleared the official OpenAI SynthID check.
 
 Provider verifiers and provenance APIs are reserved for development-time
 calibration. They are not exposed through the installed CLI, the top-level

docs/synthid-classifiers.md

@@ -62,6 +62,56 @@ support treating augmentation and architecture shift as first-class tests,
 rather than reading an untransformed source-classification score as watermark
 evidence.
 
+### Abstaining fused source classifier, 2026-09-15
+
+The follow-up experiment combined the existing 124-d forensic descriptor with
+the 16x16 phase-free spectral grid in a class-balanced ridge head. Its three
+outputs are `openai`, `google`, and `unknown`; a provider result is emitted only
+when it beats both the other provider and `unknown` by a margin selected on a
+separate calibration split. The public implementation is
+[`scripts/source_pipeline_classifier.py`](../scripts/source_pipeline_classifier.py).
+It includes training, strict pickle-free model loading, and JSON inference, but
+no fitted weights: the experimental training freeze contains inputs that are
+not redistributable. This keeps the code reproducible without publishing a
+derivative artifact whose data provenance does not permit redistribution.
+
+Penalty 100 and margin 0.6392407698660646 were selected using only the training
+and calibration partitions. The 2,669-image locked internal test and Mark's
+900-image public set were not used for feature, penalty, or threshold selection.
+Feature-extraction failures count as `unknown` in every result below.
+
+| Evaluation | Accuracy | OpenAI recall | Google recall | Unknown recall |
+| --- | ---: | ---: | ---: | ---: |
+| Locked internal, 2,669 images | 84.2% | 60.9% | 48.8% | 95.8% |
+| Mark original exports, 900 images | 90.1% | 76.3% | 94.3% | 99.7% |
+| Mark crop 2 px | 89.8% | 76.7% | 94.3% | 98.3% |
+| Mark resize 95% | 59.7% | 81.7% | 0.0% | 97.3% |
+| Mark JPEG quality 75 | 33.3% | 0.0% | 0.0% | 100.0% |
+| Mark blur radius 0.7 | 68.3% | 42.3% | 63.0% | 99.7% |
+
+The untouched-export result is useful source-attribution evidence, but the
+transforms decide the claim. Resizing eliminated the Google branch, JPEG made
+the classifier abstain on every row, and blur materially reduced both provider
+recalls. The locked unknown false-attribution rate was 4.2%, versus 0.9% on the
+calibration split. This is therefore an inspectable research baseline, not a
+runtime detector or a product watermark verdict.
+
+Training requires hash-disjoint `train` and `calibration` directories, each
+with `openai`, `google`, and `unknown` subdirectories:
+
+```bash
+uv run python scripts/source_pipeline_classifier.py train \
+  /path/to/train /path/to/calibration --model-out .local-eval/source-pipeline.npz
+
+uv run python scripts/source_pipeline_classifier.py predict \
+  .local-eval/source-pipeline.npz image.png
+```
+
+A stronger public release needs a publication-cleared multi-era training set
+and a causal marked/unmarked contrast. Mark's same-prompt triples remain an
+external source/export test, not evidence that the fitted features read the
+SynthID payload.
+
 Krawetz's Gemini-chat TPR critique is a verifier-quality claim, not a
 feature we can ship. [Lead Stories, 2026-07](https://leadstories.com/analysis/2026/07/google-gemini-synthid-detector-confuses-results-within-same-chat.html)
 documented Gemini repeating the first file's SynthID verdict inside a

docs/synthid.md

@@ -775,6 +775,20 @@ SynthID. Current OpenAI manifests distinguish the watermarked output with the
 signed `c2pa.watermarked.unbound` action. The detector requires that action, so
 old OpenAI C2PA remains an origin signal without becoming a SynthID claim.
 
+**GPT Image 2.5 compatibility, verified 2026-09-15.** One fresh low-quality
+1024 x 1024 API generation from each released model, `gpt-image-2.5-flare` and
+`gpt-image-2.5-sunburst`, carried a valid bound OpenAI C2PA claim generated by
+`OpenAI Media Service API`, with `trainedAlgorithmicMedia` and the action set
+`created, converted, watermarked.unbound`. `identify` reported high-confidence
+OpenAI provenance plus SynthID, `has_invisible_target` returned true, and the
+automatic strength cohort resolved to OpenAI for both files. After C2PA was
+removed without changing decoded pixels, the official OpenAI Content Provenance
+API still returned SynthID `detected` for both sources. The complete shipped
+`qwen-zimage` profile at strength 0.07675 and seed 0 then produced two outputs
+for which the same metadata-independent API returned SynthID `not_detected`.
+This is one controlled source per model and proves the current routing and
+operating point on those two sources; it is not a provider-wide removal rate.
+
 ### 4.3 Other vendors
 
 - **Kakao** (South Korea): SynthID adopter as of May 2026 (Google announcement)

pyproject.toml

@@ -4,7 +4,7 @@
 # on it, including the ComfyUI node package. The console script below carries
 # the same weight, since users have it on PATH.
 name = "remove-ai-watermarks"
-version = "0.40.5"
+version = "0.40.6"
 description = "AI watermark remover for visible, invisible, and provenance marks in images and video"
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

scripts/README.md

@@ -51,6 +51,7 @@ explicitly names a tracked canonical result.
 | `visible_sheets.py` | Build blinded contact sheets for relaxation candidates. |
 | `watermark_benchmark_cohort.py` | Build the deterministic synthetic DWT-DCT and TrustMark cohort consumed by `watermark_benchmark.py`. |
 | `spectral_pipeline_probe.py` | Measure a prompt-grouped, phase-free spectral source-pipeline hypothesis without presenting it as SynthID detection. |
+| `source_pipeline_classifier.py` | Train or run an abstaining OpenAI/Google/unknown source-export classifier; research-only and not SynthID detection. |
 | `watermark_benchmark_real_cohort.py` | Build a publication-cleared, provider-paired and content-stratified real-image cohort. |
 | `retrain_photo_classify.py` | CPU-retrain the 2026-08-31 photo heads from a sha256-keyed cache pack, no images. |
 | `publish_photo_classify_hf.py` | Upload the photo-classify card and freeze weights to Hugging Face `wiltodelta/raiw-photo-classify`. Manual; the Action `publish-photo-classify-hf.yml` is the write-token path. |

scripts/source_pipeline_classifier.py

@@ -0,0 +1,371 @@
+"""Train or run an abstaining source/export-pipeline classifier.
+
+This research tool combines the library's 124-d forensic descriptor with the
+phase-free spectral descriptor from ``spectral_pipeline_probe.py``. Its labels
+describe complete generation and export pipelines. It does not decode SynthID
+or establish that a watermark is present.
+
+Expected training layout::
+
+    train/openai/*.png
+    train/google/*.png
+    train/unknown/*.png
+    calibration/openai/*.png
+    calibration/google/*.png
+    calibration/unknown/*.png
+
+Examples::
+
+    uv run python scripts/source_pipeline_classifier.py train \
+        train calibration --model-out model.npz
+    uv run python scripts/source_pipeline_classifier.py predict \
+        model.npz image.png
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import cast
+
+import click
+import numpy as np
+import spectral_pipeline_probe as spectral
+from numpy.typing import NDArray
+from PIL import Image
+from watermark_benchmark import sha256_file
+
+from remove_ai_watermarks._internal.forensic_124d import FEATURE_WIDTH, PATCH, image_features
+
+log = logging.getLogger(__name__)
+
+CLASSES = ("openai", "google", "unknown")
+UNKNOWN_INDEX = CLASSES.index("unknown")
+DEFAULT_GRID = 16
+DEFAULT_PENALTY = 100.0
+DEFAULT_UNKNOWN_FPR = 0.01
+CLAIM = "source/export pipeline classification; not SynthID detection"
+
+FloatArray = NDArray[np.float64]
+IntArray = NDArray[np.int64]
+
+
+@dataclass(frozen=True)
+class RidgeModel:
+    """One standardized three-class ridge head with an abstention margin."""
+
+    mean: FloatArray
+    scale: FloatArray
+    weights: FloatArray
+    margin: float
+    grid: int
+    penalty: float
+
+
+def discover_labeled_paths(root: Path) -> tuple[list[Path], IntArray, list[str]]:
+    """Find images under the three fixed label directories."""
+    paths: list[Path] = []
+    labels: list[int] = []
+    hashes: list[str] = []
+    for class_index, class_name in enumerate(CLASSES):
+        directory = root / class_name
+        if not directory.is_dir():
+            raise ValueError(f"class directory does not exist: {directory}")
+        class_paths = sorted(
+            path for path in directory.rglob("*") if path.is_file() and path.suffix.lower() in spectral.IMAGE_SUFFIXES
+        )
+        if not class_paths:
+            raise ValueError(f"class directory has no supported images: {directory}")
+        for path in class_paths:
+            paths.append(path)
+            labels.append(class_index)
+            hashes.append(sha256_file(path))
+    if len(hashes) != len(set(hashes)):
+        raise ValueError(f"duplicate image bytes found inside {root}")
+    return paths, np.asarray(labels, dtype=np.int64), hashes
+
+
+def _feature_from_path(path: Path, geometry: spectral.SpectralGeometry) -> FloatArray | None:
+    """Return the fused representation for one path and prepared geometry."""
+    with Image.open(path) as source:
+        image = source.convert("RGB")
+    forensic = image_features(np.asarray(image, dtype=np.uint8))
+    if forensic is None:
+        return None
+    phase_free = spectral.feature_from_image(image, geometry, "original")
+    return np.concatenate(
+        (
+            np.asarray(forensic, dtype=np.float64),
+            np.asarray(phase_free, dtype=np.float64),
+        )
+    )
+
+
+def feature_from_path(path: Path, grid: int) -> FloatArray | None:
+    """Return the fused forensic and phase-free spectral representation."""
+    return _feature_from_path(path, spectral.make_geometry(size=PATCH, grid=grid))
+
+
+def extract_features(paths: list[Path], labels: IntArray, grid: int) -> tuple[FloatArray, IntArray, list[Path]]:
+    """Extract valid rows and report files whose forensic feature abstains."""
+    geometry = spectral.make_geometry(size=PATCH, grid=grid)
+    features: list[FloatArray] = []
+    kept_labels: list[int] = []
+    skipped: list[Path] = []
+    for index, (path, label) in enumerate(zip(paths, labels, strict=True), start=1):
+        try:
+            feature = _feature_from_path(path, geometry)
+        except (OSError, ValueError) as error:
+            log.warning("Could not extract %s: %s", path, error)
+            feature = None
+        if feature is None:
+            skipped.append(path)
+            continue
+        features.append(feature)
+        kept_labels.append(int(label))
+        if index % 100 == 0:
+            log.info("Extracted %s/%s images", index, len(paths))
+    if not features:
+        raise ValueError("no image produced a valid feature vector")
+    return np.asarray(features), np.asarray(kept_labels, dtype=np.int64), skipped
+
+
+def fit_ridge(
+    features: FloatArray,
+    labels: IntArray,
+    penalty: float,
+    grid: int = DEFAULT_GRID,
+) -> RidgeModel:
+    """Fit a class-balanced standardized ridge head before calibration."""
+    if features.ndim != 2 or len(features) != len(labels):
+        raise ValueError("features and labels must describe the same rows")
+    counts = np.bincount(labels, minlength=len(CLASSES)).astype(np.float64)
+    if np.any(counts == 0):
+        raise ValueError("training data must contain all three classes")
+    if penalty <= 0:
+        raise ValueError("penalty must be positive")
+    mean = features.mean(axis=0)
+    raw_scale = features.std(axis=0)
+    active = raw_scale > 1e-10
+    scale = np.where(active, raw_scale, 1.0)
+    normalized = (features[:, active] - mean[active]) / scale[active]
+    sample_weight = len(labels) / (len(CLASSES) * counts[labels])
+    root_weight = np.sqrt(sample_weight)[:, None]
+    weighted = normalized * root_weight
+    targets = np.eye(len(CLASSES), dtype=np.float64)[labels] * root_weight
+    gram = weighted.T @ weighted + penalty * np.eye(weighted.shape[1])
+    active_weights = cast("FloatArray", np.linalg.solve(gram, weighted.T @ targets))
+    weights = np.zeros((features.shape[1], len(CLASSES)), dtype=np.float64)
+    weights[active] = active_weights
+    return RidgeModel(mean, scale, weights, 0.0, grid, penalty)
+
+
+def scores(features: FloatArray, model: RidgeModel) -> FloatArray:
+    """Return the uncalibrated ridge scores."""
+    return ((features - model.mean) / model.scale) @ model.weights
+
+
+def decision_margins(raw_scores: FloatArray) -> FloatArray:
+    """Return each row's best-provider advantage over every alternative."""
+    target_scores = raw_scores[:, :UNKNOWN_INDEX]
+    best = np.argmax(target_scores, axis=1)
+    other = 1 - best
+    rows = np.arange(len(raw_scores))
+    reference = np.maximum(raw_scores[rows, other], raw_scores[:, UNKNOWN_INDEX])
+    return target_scores[rows, best] - reference
+
+
+def calibrate_margin(
+    calibration_scores: FloatArray,
+    calibration_labels: IntArray,
+    unknown_fpr: float,
+) -> float:
+    """Choose the smallest empirical cut meeting the unknown false-positive target."""
+    if not 0 <= unknown_fpr < 1:
+        raise ValueError("unknown_fpr must be in [0, 1)")
+    unknown_scores = calibration_scores[calibration_labels == UNKNOWN_INDEX]
+    if not len(unknown_scores):
+        raise ValueError("calibration data must contain unknown rows")
+    return max(
+        0.0,
+        float(
+            np.quantile(
+                decision_margins(unknown_scores),
+                1.0 - unknown_fpr,
+                method="higher",
+            )
+            + 1e-12
+        ),
+    )
+
+
+def predict_scores(raw_scores: FloatArray, margin: float) -> IntArray:
+    """Return provider labels only when the calibrated margin is met."""
+    best = np.argmax(raw_scores[:, :UNKNOWN_INDEX], axis=1)
+    accepted = decision_margins(raw_scores) >= margin
+    return np.where(accepted, best, UNKNOWN_INDEX).astype(np.int64)
+
+
+def save_model(path: Path, model: RidgeModel) -> None:
+    """Write a pickle-free model artifact."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    np.savez_compressed(
+        path,
+        classes=np.asarray(CLASSES),
+        mean=model.mean,
+        scale=model.scale,
+        weights=model.weights,
+        margin=np.asarray(model.margin),
+        spectral_grid=np.asarray(model.grid),
+        penalty=np.asarray(model.penalty),
+    )
+
+
+def load_model(path: Path) -> RidgeModel:
+    """Load and validate a pickle-free model artifact."""
+    with np.load(path, allow_pickle=False) as payload:
+        required = {
+            "classes",
+            "mean",
+            "scale",
+            "weights",
+            "margin",
+            "spectral_grid",
+            "penalty",
+        }
+        if set(payload.files) != required:
+            raise ValueError(f"model fields must be exactly {sorted(required)}")
+        classes = tuple(str(value) for value in payload["classes"])
+        mean = np.asarray(payload["mean"], dtype=np.float64)
+        scale = np.asarray(payload["scale"], dtype=np.float64)
+        weights = np.asarray(payload["weights"], dtype=np.float64)
+        margin = float(payload["margin"])
+        grid = int(payload["spectral_grid"])
+        penalty = float(payload["penalty"])
+    expected_features = FEATURE_WIDTH + 3 * grid * grid
+    if classes != CLASSES:
+        raise ValueError(f"model classes must be {CLASSES}")
+    if mean.shape != (expected_features,) or scale.shape != mean.shape:
+        raise ValueError("model normalization vectors have the wrong shape")
+    if weights.shape != (expected_features, len(CLASSES)):
+        raise ValueError("model weights have the wrong shape")
+    if not np.all(np.isfinite(mean)) or not np.all(np.isfinite(scale)):
+        raise ValueError("model normalization vectors must be finite")
+    if not np.all(np.isfinite(weights)) or np.any(scale <= 0):
+        raise ValueError("model weights must be finite and scales positive")
+    if not np.isfinite(margin) or margin < 0:
+        raise ValueError("model margin must be finite and non-negative")
+    if grid < 2 or PATCH % grid or not np.isfinite(penalty) or penalty <= 0:
+        raise ValueError("model calibration fields are invalid")
+    return RidgeModel(mean, scale, weights, margin, grid, penalty)
+
+
+@click.group()
+def main() -> None:
+    """Train or run the research-only source-pipeline classifier."""
+    logging.basicConfig(level=logging.INFO, format="%(levelname)s %(message)s")
+
+
+@main.command("train")
+@click.argument("train_root", type=click.Path(exists=True, file_okay=False, path_type=Path))
+@click.argument("calibration_root", type=click.Path(exists=True, file_okay=False, path_type=Path))
+@click.option("--model-out", type=click.Path(dir_okay=False, path_type=Path), required=True)
+@click.option("--grid", type=click.IntRange(min=2), default=DEFAULT_GRID, show_default=True)
+@click.option("--penalty", type=click.FloatRange(min=0.0, min_open=True), default=DEFAULT_PENALTY, show_default=True)
+@click.option(
+    "--unknown-fpr",
+    type=click.FloatRange(min=0.0, max=1.0, max_open=True),
+    default=DEFAULT_UNKNOWN_FPR,
+    show_default=True,
+)
+def train_command(
+    train_root: Path,
+    calibration_root: Path,
+    model_out: Path,
+    grid: int,
+    penalty: float,
+    unknown_fpr: float,
+) -> None:
+    """Fit on TRAIN_ROOT and calibrate abstention on CALIBRATION_ROOT."""
+    if PATCH % grid:
+        raise click.UsageError(f"--grid must divide {PATCH}")
+    try:
+        train_paths, train_labels, train_hashes = discover_labeled_paths(train_root)
+        calibration_paths, calibration_labels, calibration_hashes = discover_labeled_paths(calibration_root)
+        overlap = set(train_hashes) & set(calibration_hashes)
+        if overlap:
+            raise ValueError(f"train/calibration byte overlap: {len(overlap)} images")
+        train_features, kept_train_labels, train_skipped = extract_features(train_paths, train_labels, grid)
+        calibration_features, kept_calibration_labels, calibration_skipped = extract_features(
+            calibration_paths, calibration_labels, grid
+        )
+        provisional = fit_ridge(train_features, kept_train_labels, penalty, grid)
+        margin = calibrate_margin(
+            scores(calibration_features, provisional),
+            kept_calibration_labels,
+            unknown_fpr,
+        )
+        model = replace(provisional, margin=margin)
+        save_model(model_out, model)
+    except ValueError as error:
+        raise click.ClickException(str(error)) from error
+    click.echo(
+        json.dumps(
+            {
+                "model": str(model_out),
+                "claim": CLAIM,
+                "train_rows": len(train_features),
+                "calibration_rows": len(calibration_features),
+                "feature_abstentions": len(train_skipped) + len(calibration_skipped),
+                "margin": margin,
+            },
+            indent=2,
+        )
+    )
+
+
+@main.command("predict")
+@click.argument("model_path", type=click.Path(exists=True, dir_okay=False, path_type=Path))
+@click.argument("images", nargs=-1, required=True, type=click.Path(exists=True, dir_okay=False, path_type=Path))
+def predict_command(model_path: Path, images: tuple[Path, ...]) -> None:
+    """Classify original-export IMAGES with MODEL_PATH."""
+    try:
+        model = load_model(model_path)
+    except (OSError, ValueError) as error:
+        raise click.ClickException(str(error)) from error
+    results: list[dict[str, object]] = []
+    geometry = spectral.make_geometry(size=PATCH, grid=model.grid)
+    for path in images:
+        try:
+            feature = _feature_from_path(path, geometry)
+        except (OSError, ValueError) as error:
+            raise click.ClickException(f"could not extract {path}: {error}") from error
+        if feature is None:
+            results.append(
+                {
+                    "path": str(path),
+                    "label": "unknown",
+                    "reason": "124-d feature unavailable",
+                    "claim": CLAIM,
+                }
+            )
+            continue
+        raw_scores = scores(feature[None, :], model)
+        prediction = int(predict_scores(raw_scores, model.margin)[0])
+        results.append(
+            {
+                "path": str(path),
+                "label": CLASSES[prediction],
+                "decision_margin": float(decision_margins(raw_scores)[0]),
+                "required_margin": model.margin,
+                "scores": {name: float(raw_scores[0, index]) for index, name in enumerate(CLASSES)},
+                "claim": CLAIM,
+            }
+        )
+    click.echo(json.dumps(results, indent=2))
+
+
+if __name__ == "__main__":
+    main()

scripts/spectral_pipeline_probe.py

@@ -134,10 +134,10 @@ def _apply_attack(image: Image.Image, attack: str) -> Image.Image:
 def feature_from_path(path: Path, geometry: SpectralGeometry, attack: str) -> FloatArray:
     """Decode one path, apply ATTACK, and return its phase-free feature."""
     with Image.open(path) as source:
-        return _feature_from_image(source.convert("RGB"), geometry, attack)
+        return feature_from_image(source.convert("RGB"), geometry, attack)
 
 
-def _feature_from_image(image: Image.Image, geometry: SpectralGeometry, attack: str) -> FloatArray:
+def feature_from_image(image: Image.Image, geometry: SpectralGeometry, attack: str) -> FloatArray:
     """Extract one attacked feature from an already decoded RGB image."""
     attacked = _apply_attack(image, attack)
     canonical = attacked.resize((geometry.size, geometry.size), Image.Resampling.LANCZOS)
@@ -253,7 +253,7 @@ def _extract_all_attacks(
         with Image.open(path) as source:
             image = source.convert("RGB")
         for attack in attacks:
-            rows[attack].append(_feature_from_image(image, geometry, attack))
+            rows[attack].append(feature_from_image(image, geometry, attack))
     return {attack: np.asarray(features) for attack, features in rows.items()}
 
 

src/remove_ai_watermarks/__init__.py

@@ -33,7 +33,7 @@ _os.environ.setdefault("TRANSFORMERS_VERBOSITY", "error")
 _warnings.filterwarnings("ignore", message=r".*ImageProcessorFast.*")
 
 
-__version__ = "0.40.5"
+__version__ = "0.40.6"
 
 __all__ = [
     "BatchItemResult",

tests/test_source_pipeline_classifier.py

@@ -0,0 +1,119 @@
+"""Tests for the abstaining source-pipeline classifier research tool."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import numpy as np
+import pytest
+from click.testing import CliRunner
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "scripts"))
+
+import source_pipeline_classifier as classifier
+
+
+def test_command_help_exits_cleanly() -> None:
+    result = CliRunner().invoke(classifier.main, ["--help"])
+
+    assert result.exit_code == 0
+    assert "Usage:" in result.output
+    assert "train" in result.output
+    assert "predict" in result.output
+
+
+def _training_rows() -> tuple[np.ndarray, np.ndarray]:
+    rng = np.random.default_rng(20260915)
+    rows = np.vstack(
+        (
+            rng.normal((-3.0, 0.0, 0.0), 0.1, size=(12, 3)),
+            rng.normal((3.0, 0.0, 0.0), 0.1, size=(12, 3)),
+            rng.normal((0.0, 3.0, 0.0), 0.1, size=(12, 3)),
+        )
+    )
+    labels = np.repeat(np.arange(3), 12)
+    return rows, labels
+
+
+def test_fit_and_abstention_separate_provider_rows() -> None:
+    features, labels = _training_rows()
+    model = classifier.fit_ridge(features, labels, penalty=1.0)
+    raw_scores = classifier.scores(features, model)
+    margin = classifier.calibrate_margin(raw_scores, labels, unknown_fpr=0.01)
+    predictions = classifier.predict_scores(raw_scores, margin)
+
+    assert np.array_equal(predictions[:24], labels[:24])
+    assert np.all(predictions[24:] == classifier.UNKNOWN_INDEX)
+
+
+def test_model_round_trip_is_pickle_free_and_strict(tmp_path: Path) -> None:
+    grid = 4
+    feature_count = classifier.FEATURE_WIDTH + 3 * grid * grid
+    model = classifier.RidgeModel(
+        mean=np.arange(feature_count, dtype=np.float64),
+        scale=np.full(feature_count, 2.0),
+        weights=np.arange(feature_count * 3, dtype=np.float64).reshape(feature_count, 3),
+        margin=0.25,
+        grid=grid,
+        penalty=100.0,
+    )
+    path = tmp_path / "model.npz"
+
+    classifier.save_model(path, model)
+    loaded = classifier.load_model(path)
+
+    assert loaded.grid == grid
+    assert loaded.margin == model.margin
+    assert np.array_equal(loaded.mean, model.mean)
+    assert np.array_equal(loaded.scale, model.scale)
+    assert np.array_equal(loaded.weights, model.weights)
+
+    with np.load(path, allow_pickle=False) as payload:
+        assert payload.files
+
+
+def test_model_loader_rejects_extra_fields(tmp_path: Path) -> None:
+    path = tmp_path / "model.npz"
+    np.savez(
+        path,
+        classes=np.asarray(classifier.CLASSES),
+        mean=np.zeros(136),
+        scale=np.ones(136),
+        weights=np.zeros((136, 3)),
+        margin=np.asarray(0.1),
+        spectral_grid=np.asarray(2),
+        penalty=np.asarray(100.0),
+        unexpected=np.asarray(1),
+    )
+
+    with pytest.raises(ValueError, match="model fields must be exactly"):
+        classifier.load_model(path)
+
+
+def test_model_loader_rejects_nonfinite_margin(tmp_path: Path) -> None:
+    grid = 2
+    feature_count = classifier.FEATURE_WIDTH + 3 * grid * grid
+    path = tmp_path / "model.npz"
+    np.savez(
+        path,
+        classes=np.asarray(classifier.CLASSES),
+        mean=np.zeros(feature_count),
+        scale=np.ones(feature_count),
+        weights=np.zeros((feature_count, 3)),
+        margin=np.asarray(np.nan),
+        spectral_grid=np.asarray(grid),
+        penalty=np.asarray(100.0),
+    )
+
+    with pytest.raises(ValueError, match="margin must be finite"):
+        classifier.load_model(path)
+
+
+def test_calibration_requires_unknown_rows() -> None:
+    with pytest.raises(ValueError, match="must contain unknown"):
+        classifier.calibrate_margin(
+            np.zeros((2, 3)),
+            np.asarray([0, 1]),
+            unknown_fpr=0.01,
+        )

uv.lock

@@ -3449,7 +3449,7 @@ wheels = [
 
 [[package]]
 name = "remove-ai-watermarks"
-version = "0.40.5"
+version = "0.40.6"
 source = { editable = "." }
 dependencies = [
     { name = "c2pa-python" },