[CompleteDotTech]

Current reviewed integration — 2026-10-26

Published head 188f9b91b4498dab6b75a3ccbbf350d09fac58a5 integrates original #211, current main bb5a6810afd06cf57185ffdfe2234e0fdc6e6240, and #206, preserving all 52 overlay paths and 34 historical receipt blobs. Fresh independent source and full-tree review found zero actionable findings; reviewed tree is 3a6a3190b6791a819c84a40b22d86955f3fef9a1 (1,753 leaves, no untouched base leaves dropped). All 30 hosted checks on this head now succeed, including strict JPEG, Model3D, Blender, browser playback, Khronos, 2D compatibility and all three delivery-platform jobs.

Final exact-head COMMENT review records verification and limits. Earlier pending-publication and old-head eligibility text below is historical, superseded by this exact-head result. This is bounded source integration, not broader parent closure, production-art approval, deployment or release acceptance. No such holds are waived.

---

Current-main integration correction (publication pending)

Candidate e9ef226816f747b2790c73168c38606ddbcb00f3 normally merges main dcba9123c4b70fc2caa7b56267920f239fb35c12. The original published 10f6c0b failed hosted Model3D error-boundary tests on all three OSes and canonical source-path assertions on macOS/Windows. Those failures are retained; this is a code correction, not a transient rerun.

Primary and secondary-LOD Model3D imports now share one boundary: texture failures become MODEL3D_MODEL, unavailable strict JPEG verification becomes MODEL3D_DEPENDENCY, and the nested native diagnostic and asset remain available. Existing unrelated native limit codes and the original malformed-image assertion are preserved. OBJ tests assert the complete canonical source set and unchanged digests, including a real POSIX directory alias / Windows junction.

Full committed-source validation: 134 tests passed in 42.413 seconds, zero skips, including real Blender/Khronos/browser integrations, Model3D, codec/texture, contracts, skinning, compatibility and correction validation. Complete scripts/tests/profiles hashes were captured before the entire run and are identical after. Evidence: tests/results/native-texture-integrity-ci-correction-20261024/lod-*. Historical 16c8cea Astra CHANGES_REQUIRED finding (secondary LOD) is retained alongside the correction.

Fresh whole-head independent actual gpt-6-astra review: PASS at e9ef226816f747b2790c73168c38606ddbcb00f3, zero actionable findings. Report SHA-256 ccee3153cb0b34b6787f7ef01cd551d80eacda888cbeeb782d585149a114fc79. Independent 134 tests passed in 46.205 seconds with zero skips; the original two LOD failures and ten additional primary/secondary boundary cases now pass with preserved source hashes. Previous 10f6c0b PASS does not cover this candidate. Hosted checks on the candidate are pending publication; old-head green or red checks are not used as evidence for it. No parent closure is requested.

---

Historical initial implementation evidence (superseded for merge eligibility)

Refs #52, #44 and #139. This completes the bounded native texture-admission change, not those broader import, rigging or asset-library packages; none is closed by this PR.

Native import could accept damaged sources as usable textures. Pillow can supply black pixels for a missing PNG scanline, while its JPEG decoder can recover damaged Huffman entropy without exposing a warning. Checking a header, or even calling verify() followed by load(), did not establish complete source pixels.

The shared rig_import._decode_texture boundary now serves GLB bufferViews, glTF embedded buffers, external files and data URIs, and OBJ/MTL textures:

• PNG: checks all chunk CRCs, IEND, raster parameters, consecutive IDAT, complete zlib checksum/footer and exact filtered-raster length, including Adam7. Inflation uses bounded 64 KiB chunks rather than a retained full raster; Pillow still reconstructs pixels and filters.
• JPEG: invokes pinned simplejpeg==1.9.0 with strict header and pixel decoding, expected source dimensions, scan limits and the remaining aggregate working-memory allowance. Missing or untested verifier installations return RIG_TEXTURE_VERIFIER_UNAVAILABLE, never a permissive fallback.
• Both: enforce encoded, pixel and aggregate decoded-memory limits before pixel allocation; report decode and allocation failures through structured diagnostics; preserve the exact encoded source bytes and MIME. The importer neither repairs nor re-encodes inputs and never changes Pillow's global safety settings. A host's LOAD_TRUNCATED_IMAGES policy fails closed.

The new dependency is confined to optional requirements-rig.txt; ordinary 2D requirements and imports are unchanged. Valid baseline/progressive Gray, RGB and CMYK JPEGs, arithmetic JPEG, packed/indexed/16-bit PNG and Adam7 remain supported. Format validation is distinct from authenticity: arithmetic JPEG permits legal marker padding, so a different valid bitstream cannot be identified as changed without an independently supplied original digest. Source SHA-256 remains the separate identity gate. No visual, rights or human approval is created.

Validation

Author execution used Python 3.12.15, the exact rig-test dependencies and the new codec pin:

• 67 tests passed in 27.925 seconds, zero failures, errors or skips, with actual Khronos, Blender 4.5.3 and browser integrations enabled. Every recorded scripts/tests/profiles hash matched before and after the run.
• Nineteen native-route methods cover actual malformed streams across all five routes, exact budget boundaries, no-allocation rejection, dependency failure, byte-preserving roundtrips and CLI rejection without publishing a run or modifying source files.
• Valid PNG/JPEG GLB/glTF exports pass Khronos with zero errors and warnings. A 16 MiB PNG-raster check stays below 1 MiB temporary traced allocation.
• The standalone codec's 12 tests, six-platform wheel/license evidence and earlier independent review are retained; none substitutes for native-route tests.
• Schema/template checks and authored-file whitespace checks pass. Original raw baseline unittest trailing whitespace is preserved; the cumulative diff is not falsely described as whitespace-clean.

tests/results/native-texture-integrity-20261024/verification.json binds the current source, environment and logs. Earlier 43-test and PNG-only 46-test results remain explicitly historical. The five original and six first-correction failing baseline cases are sensitivity controls, not passing-suite evidence.

Independent actual gpt-6-astra review: PASS at 10f6c0bb4f303a42e32c06e9fc8cb7d4a3791bbb, zero actionable findings. Report SHA-256: c5b13f77e2967879b8c85dfa2999163b7c1c05bfb9911600025212f6c15e54b6. The separate reviewer independently reran 67 tests without skips, 20 actual all-route CLI corruption cases, 105 Adam7 positives and bounded expansion probes. Earlier PNG-only and standalone JPEG reviews were not reused as approval of this integration. The author does not self-approve or merge.

The three-OS codec workflow now runs standalone and actual native-route families with portable unittest discovery and read-only repository permissions. External Khronos/Blender/browser checks remain in the existing Ubuntu interoperability gate. Hosted current-head results are pending publication.

Integration and risk

The reviewed JPEG module is included in this cohesive branch; it does not require another unpublished codec PR. #203, #205 and #202 have already merged. Final current-main reconciliation must preserve their changes and all import-transform/material/texture/JPEG test families, including #204/#206 if they land first. This reviewed head is unchanged until that reconciliation receives renewed review and checks.

Decoding adds bounded work and intentionally rejects recovered inputs and lax host policies that previously passed. The working-memory estimate is not an OS allocator/time sandbox, and existing source-filesystem admission is not newly claimed to be race-free. A normal revert is the rollback, restoring the previous integrity gaps. Broader parent acceptance and production-art approval remain separate.

[CompleteDotTech]

Repository triage review at e9ef226816f747b2790c73168c38606ddbcb00f3.

The texture decoder changes passed 19 native-route tests with one explicit optional validator skip, plus 12 codec tests, in the isolated local codec environment. Current branch is conflicted: integrate with #206 and main without dropping material validation or either codec/texture release-gate family, then rerun the integrated exact head. These focused results are not native Blender/renderer equivalence or completion of the parent import tasks.

This is an evidence-bounded agent COMMENT review, not a native approval or merge authorization. Historical artifacts and review claims remain tied to their original revisions.

[CompleteDotTech]

Exact-head integrated-source review at 188f9b91b4498dab6b75a3ccbbf350d09fac58a5, tree 3a6a3190b6791a819c84a40b22d86955f3fef9a1.

Normal three-parent integration retains prior #211, current main bb5a681 and #206 d932d08. Independently verified all 52 changed paths, all untouched base paths/modes/hashes, 34 historical receipt blobs and the complete 1,753-leaf tree. Current-main tangent/morph corrections, material binding validation, strict texture decoding and all five interoperability test families are preserved. No force overwrite.

Current Linux local evidence: rig suite 151 collected, 145 passed and 6 explicit optional integration skips; Model3D 56/56 passed. Legacy compatibility discovered 801 2D cases without optional 3D imports; this is discovery, not execution of those 801 tests. Fresh independent reviewer found zero actionable findings, independently reran 56 Model3D and 54 interoperability tests (6 optional skips), and passed 9 error-mapping probes.

Blender/browser/Khronos and cross-platform CI were not run locally; natural exact-head CI remains required. Historical receipts remain evidence for their original revisions, not substitute CI for this head. This agent COMMENT review is not native GitHub approval, roadmap completion, rendered-equivalence certification or production-art signoff. No merge performed.

[CompleteDotTech]

Final exact-head verification: all 30 check runs on 188f9b91b4498dab6b75a3ccbbf350d09fac58a5 completed successfully. This includes complete Ubuntu/macOS/Windows public delivery, strict JPEG and Model3D matrices, 2D compatibility, native rigging, actual Blender save/reopen/deformation, Three.js playback, Khronos interoperability and demonstrations.

Runs: 3D PR gates, 3D push gates, public delivery, JPEG, Model3D PR, Model3D push.

Head/tree and main are unchanged from independently reviewed composition; GitHub reports mergeable/clean. No new review findings. Local actual Khronos run additionally passed 56/60 cases, with only 4 Blender/browser skips (those external gates subsequently passed CI). Scope remains partial native import admission, not completion of the parent roadmap or production-art approval. This is an evidence-bounded agent COMMENT, not a formal GitHub approval; root controller owns merge.