feat: functional trusted VSI binding, ladder signing and ownership hardening - #4

…uth#320)

* build: drop wheel, setuptools and pytest from runtime dependencies

None of the three is imported anywhere under `src/`. `c2pa.py` and `lib.py`
import only the standard library; `build.py` — the `download-artifacts` console
script — imports `requests` and, lazily, `toml`. Those two stay.

They are also already classified correctly elsewhere in the repo:

* `[build-system] requires` already lists `setuptools>=68.0.0` and `wheel`, so
  the build has what it needs and the runtime entries are duplicates.
* `requirements-dev.txt` lists `wheel` and `setuptools` under
  "# Build dependencies" and `pytest` under "# Testing dependencies".
* `.github/workflows/build.yml` installs pytest explicitly (`pip install
  pytest`, lines 285 and 377), so CI does not rely on the runtime declaration
  either.

Removing them is therefore a no-op for this repo's own build and test paths,
and it keeps three packages out of every consumer's production environment.

* build: declare pytest in a PEP 735 dev dependency group

Dropping pytest from `[project.dependencies]` left it undeclared in
pyproject.toml entirely, with `requirements-dev.txt` as the only manifest
naming it. `[dependency-groups] dev` states it where it belongs: installed
for contributors (`uv sync`, `pip install --group dev`) and, unlike
`[project.optional-dependencies]`, absent from the published package
metadata — which is the separation this branch is about.

The bound matches requirements-dev.txt (`pytest>=8.1.0`) rather than the
`>=7.4.0` the runtime entry carried; nothing installs the old one.

The comment above the remaining dependencies goes with it. The rationale
for keeping `toml` and `requests` belongs in the pull request, not in a
manifest that has carried no comments so far.

* build: keep pytest declared in requirements-dev.txt only

Review feedback: the PEP 735 group restated a bound that
`requirements-dev.txt` already carries, so the two could drift — which is
what this branch set out to stop, not to reproduce one line further down.

Nothing in the repo would have read the group. The Makefile's `install-deps`
and every workflow that installs dependencies do so with `pip install -r
requirements-dev.txt` (`build.yml` lines 52, 90/93, 164/167, 490/492), and
the wheel test jobs install pytest by name. The group was a declaration with
no consumer.

The published metadata — the point of this branch — is unaffected either
way, and the diff is now purely subtractive.

* Update c2pa version from v0.90.16 to v0.90.19

* Bump version from 0.37.9 to 0.37.10

* Bump version from 0.37.9 to 0.37.10

* chore: Update C2PA version to 0.90.22

* Bump version from 0.37.10 to 0.37.11

* Bump version from 0.37.10 to 0.37.11

…t-tooling

Add reusable c2pa-rs RC-preflight workflow; fix latent test bugs

…#327)

test_sdk_version compares the loaded native library's version against
c2pa-native-version.txt, but an RC-preflight run (per
test-c2pa-rs-source-build.yml) actually builds from whatever ref is in
c2pa-rs-preflight-ref.txt instead, so the test always failed on that
one assertion during a preflight even when everything else passed.

parse_native_version() now prefers c2pa-rs-preflight-ref.txt when
present, falling back to c2pa-native-version.txt otherwise -- the same
precedence the workflow itself uses to decide what to build. Verified
both paths locally: green against the pinned 0.90.22 with no preflight
file, and green against a c2pa-rc-v0.91.0-rc.3 build with the file
present.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

contentauth#328)

contentauth#327's parse_native_version() fix preferred c2pa-rs-preflight-ref.txt
whenever it existed in the checked-out tree. That broke the *real*
build.yml jobs on contentauth#325: that PR adds the ref file to the branch, so an
ordinary tests-unix/tests-windows run (which downloads and installs
the actual pinned release, unrelated to the preflight workflow) picked
up the file too and wrongly expected the RC's version string, failing
with e.g. "'0.91.0-rc.3' not found in '0.90.22'".

The file's mere presence was never a reliable signal -- only
test-c2pa-rs-source-build.yml's own "Run tests" step actually builds
from that ref. Gate on a new C2PA_PREFLIGHT_RUN env var that only that
step sets instead.

Verified locally: with the pinned 0.90.22 installed and no env var
set, all 444 tests pass regardless of whether
c2pa-rs-preflight-ref.txt happens to exist in the tree.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* Fix test_sdk_version regression: gate on an env var, not file presence

contentauth#327's parse_native_version() fix preferred c2pa-rs-preflight-ref.txt
whenever it existed in the checked-out tree. That broke the *real*
build.yml jobs on contentauth#325: that PR adds the ref file to the branch, so an
ordinary tests-unix/tests-windows run (which downloads and installs
the actual pinned release, unrelated to the preflight workflow) picked
up the file too and wrongly expected the RC's version string, failing
with e.g. "'0.91.0-rc.3' not found in '0.90.22'".

The file's mere presence was never a reliable signal -- only
test-c2pa-rs-source-build.yml's own "Run tests" step actually builds
from that ref. Gate on a new C2PA_PREFLIGHT_RUN env var that only that
step sets instead.

Verified locally: with the pinned 0.90.22 installed and no env var
set, all 444 tests pass regardless of whether
c2pa-rs-preflight-ref.txt happens to exist in the tree.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Point the RC preflight at c2pa-rs 0.91.0-rc.3

This is the entire diff this PR now carries on top of contentauth#328: pin the
preflight workflow at c2pa-rc-v0.91.0-rc.3 so it builds from that git
tag (no crates.io publish, no prebuilt GitHub release binaries for an
RC) and runs the full unit test suite against it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Point the RC preflight at c2pa-rs 0.91.0-rc.3

This is the entire diff this PR now carries on top of contentauth#328: pin the
preflight workflow at c2pa-rc-v0.91.0-rc.3 so it builds from that git
tag (no crates.io publish, no prebuilt GitHub release binaries for an
RC) and runs the full unit test suite against it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* Preflight against c2pa-rs 0.91.0-rc.4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* chore: bump c2pa-rs to v0.91.0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* chore: Bump version from 0.37.11 to 0.37.12

* Bump version from 0.37.11 to 0.37.12

Register the native ladder export as optional, validate path arrays, preserve typed errors and allocation ownership, and use the modern single-sign builder lifecycle. Add focused binding tests and isolated stock/candidate native qualification lanes without changing release pins.

Co-authored-by: bibinbaby444 <bibinbaby444@gmail.com>

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Use c2pa_free for new manifest allocations, include focused ladder tests in existing CI runs, reject optimized verification harness execution, and document the modern builder lifecycle.

Include a documented synthetic fixture and offline native smoke in the existing CI selection. Enforce candidate capability on request, verify the native signature and shared manifest, and cover typed ctypes conversion without changing stock native pins or builder semantics.

Co-authored-by: bibinbaby444 <bibinbaby444@gmail.com>

…idation

# Conflicts:
#	docs/class-diagram.md
#	pyproject.toml
#	src/c2pa/c2pa.py
#	tests/test_unit_tests.py

…anup

…7 as 0.37.13.dev0

…o 203dc08d

True merge of fix/native-resource-ownership-upstream 7ba8615. Takes its
anchored registry-tag parsing (strip one 'Other: ' prefix, match at start)
so tags quoted inside another error's payload no longer establish
ownership, its _handle_value and consume-first triage, its C2paStream
docstring, generic ownership tests and ownership documentation, keeping the
consolidation's fork content. Opaque-registry-only consumed-id checks move
to tests/test_native_ownership_opaque.py.

Paired CI now builds castlabs/c2pa-rs 203dc08d (ContentAuth main 69907b5a
merged; 0.92.0-dev, Rust 1.96.0 unchanged).

… of skipping

Require the opaque registry (odd object ids) with a fixture that fails when
C2PA_TRUSTED_VSI_ABI_REQUIRED/FUNCTIONAL_REQUIRED is set, list the new file
in the installed-wheel contract, and mark the 203dc08d pairing qualification
as pending in the contract status.