Repository navigation
Updates the CLI to c2pa 0.91.8 and ZIP 9.2.2, with refreshed dependency notices, source metadata and software bills of materials. The reviewed RSA exception retains its 28 November 2026 expiry. The CLI reads and removes embedded C2PA stores from PNG and JPEG through the reviewed asset I/O paths.
The release includes three experiment records:
- Mixed passages: a separately calibrated window search detected 19 of 648 marked mixtures, with six correctly localised detections. It missed most insertions and exceeded the registered human-control target in one length group.
- V3 registration: candidate context, article agreement, pre-draw checks, atomic output writes, seed bindings and profile loading are checked in an isolated successor. Its single marked fixture scored 1.90 below the selected 3.30 cut-off. The r2 archive and existing registered contracts retain their bytes.
- Window families: exhaustive enumeration of 4,096 sequences under a finite independent null records every outcome. The dyadic family's false-alarm probability is 5.42139411 per cent without correction and 0.07521510 per cent with Bonferroni correction. These figures establish no real-text or provider detector performance.
A separate future-registration guard corrects a generic split-token preflight defect found during review. It joins adjacent literals, requires safe token boundaries, binds its code and inputs into a committed receipt, and records an exclusive attempt before requesting entropy. Its 21 tests use mocked entropy. No new experimental draw was made for this correction. The recorded v3 template remains valid with 290 guaranteed pairs, above its recorded bound of 286.
The existing TrustMark experiment retains ten exact payload recoveries from twelve cases before and after C2PA removal, including both misses. The browser's active r2 and SynthID demonstrations keep their historical release pins.
Four platform archives accompany the crate, source contract, Rust and Python software bills of materials, and the SynthID teaching bundle. Each downloadable asset has a SHA-256 checksum and GitHub build provenance. The registered experiment histories are preserved by their evidence tags.