feat: sign single-file rendition ladders with one manifest

[mstattma]

Aligned Python binding candidate: merge hold

Primary review: mstattma#2. Parallel Castlabs review: #3. Both use mstattma:feat/single-file-presentation-signing at 502b8bb, on frozen integration/upstream-base-7785f540 (Python 0.37.12).

Tracking: mstattma/c2pa-rs#13. Native pair: mstattma/c2pa-rs#19 / castlabs/c2pa-rs#13. Bibin's stable binding #2 is now approved at b13e8a3c; attribution is retained. Issues remain disabled in this repository; this PR owns binding-specific tracking without a repository-setting change.

Contract

Optional Builder.sign_ladder supports bounded ordered UTF-8 paths and an explicit signer. Missing native capability raises typed NotSupported at call time, not import time. NUL/encoding/list errors are rejected before FFI; copy errors propagate; returned bytes are freed once through c2pa_free. Modern signing closes the builder after an attempted native call; preflight preserves it and the signer remains caller-owned. This intentionally differs from stable builder reuse.

Destinations must be new with existing parents. Failed calls can leave newly created partial outputs; no unconditional cleanup guarantee is made. Native pins, submodule, dependencies, releases and workflow guards are unchanged.

Latest test integration

502b8bb adds a committed 3,812-byte synthetic fixture with generation/hash provenance, typed CFUNCTYPE conversion tests, and an offline native pytest smoke in the file already selected by seven CI commands. The smoke checks the real export signature, shared embedded bytes/active manifests, Reader Valid, source preservation and lifecycle behavior. It signs two copies of one fixture, not different resolution encodes.

Stock native lacks the export, so only that smoke skips. C2PA_REQUIRE_SIGN_LADDER=1 makes absence fail; a present export always runs, and missing fixture data always fails. The stronger fresh-process harness remains available with loaded-path/hash checks and rejects optimized Python that would disable assertions.

Opus 5.5 reviewed the new additions without fallback. Signature checking and combined candidate execution address the review's main coverage suggestions; no production binding change was needed.

Verification

• Final stock combined selection: 477 passed, one intentional native-smoke skip.
• Final candidate combined selection with REQUIRE: 477 passed, one deselected, zero skipped; 44 subtests passed. Only the existing stock-version assertion was deselected for SDK 0.92.0-dev versus the unchanged 0.91.0 release pin.
• Focused candidate: 34 passed, no skips. Stock REQUIRE and missing-fixture negative controls fail as intended.
• Stock/candidate fresh-process native harnesses passed; formatting/compilation/diff checks passed.
• Candidate native SHA-256 e7cc30bec2a4e14ba9600198ca82e28c025f6310279eec09c8960ac010d53f09; stock dfa68d2a8ee739bb75919dcb5300f2cb289e1b51ecce94b0f339ff287ebe0703.

The published head has no failed/pending checks at inspection. Default CI tests the stock library and therefore skips the new real-native smoke; the unpublished-native lane above was executed separately. Do not interpret that skip as native release qualification. No live TSA/keystore/watermark, full release-stack, or all-filesystem success is claimed.

Do not merge into the frozen base or change release pins before native API acceptance and qualified artifacts. Reconcile the accepted Contentauth implementation across forks later; future upstream-authored content must not link back to fork issues/PRs. No Contentauth artifact or existing published upstream head was changed.

[mstattma]

The initial head checks only completed formatting/ref-resolution work; unit and wheel jobs were skipped by the existing authorization flow, so that run is not CI test qualification.

Both aligned candidate PRs are now labeled safe to test through the existing workflow guard. On the mstattma fork the author association is OWNER, which the current MEMBER/COLLABORATOR guard does not include. No guard code, secrets, repository permissions, or Contentauth artifacts were changed. New runs are pending; the label is CI authorization, not a formal approval or merge/release authorization.

Local verification is independently complete for the reported scope: final combined CI selection 475 tests plus 44 subtests; 31 focused tests on stock/candidate; fresh-process real-native stock/candidate checks. Cross-platform CI, packaged-wheel, and unpublished-native qualification remain distinct statuses.