[NAT.11] Image family: functional PNG/TIFF/EXR codecs over OpenImageIO and the managed ImageReader binding

[deku2026]

Claim: NAT.11 epoch 1 (w-deku-20261008-nat-11)

Task record: native lane, task-nat-11. Authority: Annex 06 image clarification (planning repair 2026-10-09) and the coordinator decisions D1 to D12 (brief section 10, "NAT.11 decisions" and "NAT.11 straight alpha and packaging check").

What this changes

• Native shim native/arcimage-abi (logical library ArcImageNative, ABI 1.1): implements the functional arc_image_open / arc_image_read / arc_image_close family over OpenImageIO 3.1.14.0 with OpenEXR and Imath. Its behaviour:
  • PNG, TIFF and EXR metadata, and bounded tiled and region reads;
  • straight alpha read through the open configuration (oiio:UnassociatedAlpha), with byte-exact 8-bit PNG and TIFF RGBA;
  • format conversion selected by arc_image_options_v1.format at open;
  • raster-order coverage counted once, refusing overlapping and out-of-order regions without changing state (D3);
  • cancellation at tile boundaries (D9), bounded open handles (RESOURCE_LIMIT), and decompression-bomb limits refused before allocation;
  • corrupt or truncated input answers CORRUPT with zero output, and unsupported formats are refused (D10);
  • the build-info is a JSON capability manifest.
• Native tests: 33 arcslate_image_abi.codec.* CTest cases plus arcslate_image_abi.hello. Fixtures are generated in test code, with no downloads. The cases are added to the native-abi.yml CTest filter (D5).
• Managed binding src/Native/ArcForges.Native.Image:
  • LibraryImport bindings, with a SafeHandle that owns the generation token;
  • typed options and immutable results;
  • CancellationToken on bounded async work, and IAsyncDisposable;
  • an ImageReader completion step that refuses missing coverage.
    It is AOT and trim clean with warnings as errors, and exposes no native pointer.
• Managed tests tests/NativeAbiTests: the functional oracle (15 ImageReaderTests) and the smoke and probe expectations for ABI 1.1 and the JSON build-info. CommonAbiLayoutTests.cs is unchanged.
• Policy:
  • the successor dependency receipt nat-11-r1, chained from gov-30-r1, names reviewer w-deku-20261008-rev-nat-11;
  • the policy pointer and input hashes;
  • provenance rows for the new files;
  • the reconciliation path and blob rows of the changed projects;
  • the eng/test_desktop_rids.py active-receipt assertion;
  • eng/packaging/native_consumer.py expects ArcImageNative 1.1 and the JSON build-info.

Validation actually performed (Windows, through the workstation build slot)

• win-x64, preset win-x64-shim-static:

  • a clean configure, build and install (CMake 4.4.3, Ninja 1.13.2, MSVC 19.51.36257, toolset 14.51.36231);
  • /W4 /WX with zero warnings;
  • CTest with the CI-anchored filter: 36 of 36 passed.

• The reviewer's fresh build differs from the author's staged DLL only in the PE and debug timestamps. Both embed source 9061e47d, dirty=false.

• Managed, SDK 10.0.400:

  • locked restore;
  • Native.Image and NativeAbi test builds with 0 warnings;
  • NativeAbiLayout tests: 3 of 3 passed;
  • NativeAbi functional tests: 16 of 16 passed;
  • dotnet format --verify-no-changes.

• Python suites and policy scripts:

  • unit tests: desktop RIDs 11, dependency policy 22, build identity 6, licence boundary 12, architecture evidence 11, reconciliation 8, runtime ownership 26, tooling 51;
  • dependency_policy (58 NuGet, 10 Python, 281 inputs), reconciliation (67 projects, 7 native), native_provenance (21 components) and check_provenance (994 files).

• Not run locally:

  • linux-x64, because WSL has no cmake, ninja or libtool (D8, recorded as not run);
  • the 13 eng/packaging PackageGuards tests, which need the CI stage artifacts;
  • the native_consumer.py packaging consumers;
  • a Native AOT consumer publish (only the IsAotCompatible analyzers ran).

  Hosted CI is authoritative for these.

Follow-up commits after the first review

• e8dff231: one clang-format hunk printed by the repository-hooks job.
• df3cf780: pins OpenImageIO limits:imagesize_MB to the shim's own bounds (131072 MiB = 2^28 pixels x 64 channels x 8 bytes). OIIO's default of min(32 GiB, physical memory) made codec.limits_bomb depend on host memory, and it failed on the hosted runner. The new host-independent case oiio_size_pin covers it.
• 0097442f: re-pins the native/arcimage-abi/CMakeLists.txt blob in the GOV.18 active inventory.
• 71a2aec8: the packaging export-set checks admit the six ABI 1.1 exports for ArcImageNative only (arc_image_get_abi_version, _get_build_info, _get_last_error, _open, _read, _close). All other libraries keep the probe-only set.
  • ADP-07 supporting-file binding: eng/packaging/native.py and eng/packaging/packages.py are outside the recorded NAT.11 writes. They are changed only so that CI can package the delivered functional ABI. No dependency receipt binds their hashes.
  • Stage, pack and PackageGuards need the reviewed owned tools (CMake 4.3.3, Ninja 1.13.1), which are not installed locally, so hosted CI is authoritative for them.
• a68092e2: hosted managed-packages "Platform validation" (tests/ArchitectureTests) failed twice. ProductionNativeBindingsHaveOneCapabilityOwner listed ArcImageNative:arc_image_open, and RP-10 found no contract-test correspondence for the new public ArcForges.Native.Image API. The resulting invariant-accounting "Malformed TRX" failure was downstream of the RP-10 message. The fix:
  • The closed binding map gains arc_image_open, arc_image_read and arc_image_close with the single owner src/Native/ArcForges.Native.Image, using the flags of ImageAbi.Functional.cs.
  • RP-10 gains seven bindings to existing real ImageReaderTests facts.
  • Both rules are unchanged, and no exemption is added.
  • ADP-07 supporting-file binding: tests/ArchitectureTests/RepositoryPolicyTests.cs (the closed native binding map) and eng/policy/architecture-contract-tests.json (the RP-10 contract-test map) are outside the recorded NAT.11 writes. Their owner is the DesktopPlatform integration owner, and they are append-only rows. They are changed only so that the shared architecture policy accepts the delivered functional ABI and its public binding. No dependency receipt binds their hashes.

Scope note (2026-10-09)

Under the user's scope correction of 2026-10-09, NAT.11 is finished as an in-progress DesktopPlatform delivery under the DesktopPlatform exception: review, CI, merge and publication closeout, and then it stops. It is not an ArcScope prerequisite, and no further native-image work (NAT.22, NAT.25, NAT.31, PLT.54, the image legs of NAT.28 and NAT.30) follows from it.

🤖 Generated with Claude Code

[deku2026]

Reviewed 9061e47 for [NAT.11] epoch 1: approved

Reviewer: independent session w-deku-20261008-rev-nat-11, which authored none of this.

Rounds: round 1 at 7ac7536 had two material findings:

• the managed ReadRegionAsync could cancel after a successful native read, leaving coverage and the outcome in disagreement;
• arc_image_open wrote metadata before the handle was registered.

Both were fixed in 9061e47. Round 2 approved.

Verified at the exact head:

• a fresh win-x64 shim-static configure, build and install through the build slot: /W4 /WX, zero warnings; CTest with the CI-anchored filter 36 of 36;
• a fresh-DLL functional run of all 15 ImageReaderTests, covering:
  • byte-exact PNG and TIFF straight alpha, and float premultiply;
  • coverage and completion, and overlap and raster-order refusal;
  • corrupt input, unsupported GIF, a cancellation sweep, dispose, invalid options and the output limit;
• managed builds under the pinned SDK 10.0.400 with 0 warnings; NativeAbiLayout 3/3 and NativeAbi 16/16;
• dotnet format clean;
• the Python unit suites run with CI discovery;
• dependency_policy, reconciliation, native_provenance and check_provenance all pass;
• receipt nat-11-r1 names this reviewer, and its input hashes and the reconciliation blob pins match HEAD.

Non-blocking (recorded as follow-ups):

• the rgba8 conversion uses the shim's own clamp and round instead of OIIO convert_type. The semantics match D4; the deviation's evidence should be recorded in the README;
• nat-11-r1 does not carry forward the namingToolCandidate block;
• the image_coverage.hpp row erase is quadratic, bounded by the 64 MiB region cap;
• ReadNative should fail the handle if native returns OK with an unexpected Required (unreachable today);
• build_info_json hardcodes the ABI minor and the OIIO version;
• the test-owned smoke binding fails under the direct runner, but passes under dotnet test;
• the functional managed suite is local-only; D5 requires only CTest in CI;
• xUnit1051 NoWarn in the test project;
• the native README still says 15 of 15 functional tests.

Not run locally (hosted CI authoritative): linux-x64 (D8), the PackageGuards tests, the packaging consumers, and a Native AOT consumer publish.

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Reviewed e8dff23 for [NAT.11] epoch 1: approved (delta review over the approved 9061e47).

Reviewer: independent session w-deku-20261008-rev-nat-11.

• e8dff23's single parent is 9061e47. The diff joins one two-line expect() call in native/arcimage-abi/tests/arcslate_image_codec_tests.cpp, exactly the hunk that the repository-hooks job (clang-format v22.1.8) printed. The whitespace-stripped contents are identical, so no token, string or behaviour changes.
• No hash-bound input changes. eng/provenance/files.json lists the file without a hash, and receipt nat-11-r1 and the reconciliation pins do not name it.
• repository-hooks passes on the new head.

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Reviewed df3cf78 for [NAT.11] epoch 1: approved (delta review over the approved e8dff23).

Reviewer: independent session w-deku-20261008-rev-nat-11.

Defect fixed. Hosted native-win-x64 failed codec.limits_bomb. OpenImageIO 3.1.14 refuses headers above the global limits:imagesize_MB, whose default is min(32 GiB, physical memory) (imageio.cpp:57, imageinput.cpp:1580). On a smaller runner OIIO therefore refused the 65535 x 65535 RGBA8 header before the shim's own bound, and the status depended on host memory.

Fix. pin_openimageio_size_limit sets limits:imagesize_MB once, through a function-local static, before the only ImageInput::open. The value is 131072 MiB, which is hard_max_pixels (2^28) x 64 channels x 8 bytes; static_asserts tie it to the shim's bounds. OIIO is linked statically and PRIVATE to arcslate_image_abi, so the global is private to ArcImageNative. limits:channels keeps its host-independent default of 1024, above the shim's 64-channel bound.

Test. The new case oiio_size_pin opens a header-only 128 GiB TIFF through arc_image_open. It can pass only with the pin, because the default is at most 32 GiB. The author's mutation check failed it with the pin lowered.

Verified:

• the reviewer's own build-slot gate run: clean shim-static build with 0 warnings under /WX; CTest CI filter 37 of 37 (including oiio_size_pin, limits_bomb and bomb_before_decode); the codec executable reports 374 checks with 0 failures; NativeAbiLayout 3/3; NativeAbi 16/16; dotnet format clean;
• no policy, provenance, receipt or reconciliation file changed.

Non-blocking, recorded as follow-ups:

• On hosts below 128 GiB, OIIO's open-time parsing now admits larger declared headers before the shim's checks. This is the same exposure large hosts already had. Untrusted-decode containment belongs to NAT.31, and one README sentence should say so.
• The README count corrections (374 checks, 16 functional) fix counts that were already stale. Receipt nat-11-r1 still states the counts at its review head; it is not hash-bound to these files.

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Reviewed 71a2aec for [NAT.11] epoch 1: approved (delta review over the approved df3cf78 and 0097442).

Reviewer: independent session w-deku-20261008-rev-nat-11.

• 0097442f changes only the CMakeLists blob pin. All 61 active pins match the tree.
• 71a2aec8: the shared require_owned_exports admits exactly the six ArcImageNative ABI 1.1 exports. They match Annex 06 and native/arcimage-abi/exports/windows.def. Other libraries keep the probe-only set, and native.py stage and packages.py inspect both use the definition. Mutation checks on copies fail on a dropped export, an extra export and a windows.def drift.
• The PE exports of the three locally built ArcImageNative.dll copies pass require_owned_exports.
• Local runs passed:
  • all eng unit suites (130, plus stage_integration 47 and tooling 51);
  • design, dependency and reference policy;
  • reconciliation;
  • native and owner provenance;
  • stage_integration verify;
  • naming;
  • the managed runtime-ownership and licence-boundary evaluations (SDK 10.0.400).
• PackageGuards, stage and pack need the reviewed owned CMake 4.3.3 and Ninja 1.13.1, which are not installed locally; installing them would be a download. Hosted CI is authoritative, and hosted native-win-x64 now passes.

Non-blocking: the ADP-07 binding is now recorded in the PR body; secret-scan and dependency-review are hosted only.

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Reviewed a68092e for [NAT.11] epoch 1: approved (delta review over the approved 71a2aec). The reviewer's single material condition, recording the ADP-07 binding of the two new files in the PR and handoff, is met in the PR body and the claim handoff.

Reviewer: independent session w-deku-20261008-rev-nat-11.

What a68092e changes:

• the closed native binding map gains arc_image_open, arc_image_read and arc_image_close, with the single owner src/Native/ArcForges.Native.Image and flags matching ImageAbi.Functional.cs;
• RP-10 gains seven bindings to real ImageReaderTests facts;
• the rules are unchanged and there are no exemptions.

Reproduced locally: every PR-job step that can run on this workstation or in WSL Debian (SDK 10.0.400):

• locked restore and dotnet format;
• clean platform build;
• every test suite; the architecture suite is 134/135, where the one failure reads hosted-only RP-01, RP-08, RP-09 and AT-09 evidence and no longer reports RP-10;
• invariant accounting, exit 0;
• AOT compile-only publishes for win-x64 and linux-x64;
• gitleaks at the pinned digest, from the image already in WSL Docker: 422 commits, no leaks;
• pre-commit;
• every policy job and its unit suites.

Hosted-only: the native vcpkg and owned CMake and Ninja stage, pack, PackageGuards, the architecture evidence combine, and dependency-review.

Non-blocking (follow-ups):

• the latent NUL separator in the ArcForges.Build.Policy RP-10 message corrupts the TRX on any future RP-10 finding;
• the functional NativeAbi category is a local opt-in and is not hosted;
• the mapping precision of some RP-10 rows;
• invariant accounting reports 406 not-yet-implemented (predates NAT.11).

Posted by the coordinator under the 2026-10-08 publication protocol.

[deku2026]

Correction to the 71a2aec review record above: it says "delta review over the approved df3cf78 and 0097442", which is inaccurate. 0097442 (the CMakeLists blob re-pin) was not approved. Its delta review found that hosted run 37892380137 failed on the packaging export set (Owned native export set differs from the admitted ABI), and it withheld approval. 71a2aec fixed that, and the approvals on record are for 9061e47, e8dff23, df3cf78, 71a2aec and a68092e (merged head). Posted by the coordinator under the 2026-10-08 publication protocol.