[mohgupta-ship-it]

From Codex, prepared on Mohit Gupta’s behalf.

A valid documentation image referenced as Asset: `assets/overview.png`. currently receives High AE1 solely because its binary contents remain unsupported. This change recognizes a narrow standalone visual-caption role and corroborates it against complete canonical source bytes, SHA256, exact position and target. It also supports a bounded baseline JFIF JPEG subset; newly admitted rendered JPEG references require the same canonical provenance. Existing rendered-PNG policy remains intact.

The exception applies only to format-only reference findings. Independent executable/ambiguous uses, malformed or trailing bytes, unknown metadata, missing/mixed/fatal/truncated evidence and exhausted budgets retain their findings. Source and format proofs are cached with aggregate work limits. Image coverage stays partial: this does not perform OCR, inspect image meaning, or claim complete inspection. See the policy and supported grammar.

Validation on frozen commit 1487a18cfbb288d49ee6f1ae16df440cf916b86b:

• 760 focused reference, finalizer, JPEG, native-graph, context and opaque-reporting tests passed with the frozen main lock; make lint, make format-check, wheel build and twine check passed.
• Independent review covered provenance forgery/mixed-use omissions, malformed JPEG structure and near-budget entropy. All 128 packaged source files and 132 wheel RECORD entries were independently verified.
• The exact candidate wheel and unchanged PNG/JPEG fixture bytes were scanned offline and consumed by the approved evaluator 1.6.1: both benign cases pass with advisory partial coverage; both hostile trailing-data cases remain blocked with High AE1 plus the existing Critical opaque-content limitation. The frozen main baseline blocks both benign cases.
• Raw native completion remains partial for all four. The hostile fixtures’ authored incomplete completion expectation is still a mismatch; only their security-admission expectation passes. No fixture expectation or evaluator production filtering changed.

Candidate wheel SHA256: cedf1f3db9bd9c0c0bb69ddf5dfb76833ae20934b10cc8950865f10b4d814fe1. Its package metadata inherits main’s 2.12.0; this is an unreleased source candidate, not a published release or PR #852 update. Base source is dcebfa6f; main subsequently merged unrelated P2 comment-boundary changes in 95a52d89 with no overlapping files. Full hosted CI and Docker checks remain pending; this task ran the bounded affected tests locally.