feat(c2pa-oracle): differential oracle against c2pa-rs, both directions

.gitignore

@@ -12,6 +12,17 @@ target
 # regenerates a redundant local lockfile that should not be committed.
 tooling/*/Cargo.lock
 
+# One deliberate exception. `tooling/c2pa-oracle` resolves a real external dependency tree
+# (`c2pa`, the C2PA reference implementation) that no other manifest in this repository pins, so
+# there is no root lockfile standing behind it: without one of its own, its whole transitive graph
+# re-resolves on every invocation. Two things depend on that resolution being held still —
+# `README.md` cites `c2pa`'s source **by line number**, and
+# `tests/build_configuration.rs` asserts no OpenSSL package reached the graph. The exact `=`
+# version pin in its manifest holds only the direct dependency; the assertion about the *graph*
+# can otherwise only ever inspect the resolution cargo has just written, which is not an
+# assertion. Committing this one lockfile is what makes it one.
+!tooling/c2pa-oracle/Cargo.lock
+
 # The fuzz tier's search state (issues #264, #311). The corpus is a search aid, not the regression
 # record: a saved input is only reproducible while the target's byte-to-input mapping is unchanged,
 # so a crash is minimised and promoted into a NAMED DETERMINISTIC TEST in the crate's own suite

Cargo.toml

@@ -25,6 +25,14 @@ exclude = [
     # pins stable, and because a coverage-guided engine is unbounded and so cannot sit in the
     # `coverage` job, the only gate that runs tests. Run it with `mise run fuzz`.
     "tooling/gamut-fuzz",
+    # Dev-only differential oracle against `c2pa-rs`, the C2PA reference implementation (issue
+    # #447 under the #239 epic). Excluded for the usual reason and one more: `c2pa-rs` is a large
+    # dependency tree carrying signing and verification crypto, and the epic's "no crypto in the
+    # shipped graph" criterion means no shipped crate may ever reach it. Being outside the
+    # workspace also puts it outside `mise run check-release-deps`. Run it with `mise run
+    # test-c2pa`, or `mise run check-c2pa` for the compile-only half. No workflow under `.github/`
+    # calls either task yet, so nothing in CI reaches this crate; wiring them up is issue #541.
+    "tooling/c2pa-oracle",
     "tooling/gamut-iptc-oracle",
     "tooling/zlib-oracle",
     "tooling/libpng-oracle",

mise.toml

@@ -210,6 +210,43 @@ run = "cargo test --manifest-path tooling/gamut-dng-real-conformance/Cargo.toml"
 description = "Compile the real-camera DNG conformance tier (no corpus needed)"
 run = "cargo check --manifest-path tooling/gamut-dng-real-conformance/Cargo.toml --all-targets"
 
+# The C2PA differential oracle (issue #447 under the #239 epic). Like the tier above it is
+# workspace-excluded *and* nothing depends on it, so no per-PR gate reaches it; unlike that tier it
+# needs no corpus and no native toolchain — `c2pa-rs` is a pure-Rust crate built
+# `--no-default-features --features rust_native_crypto`, which is what keeps its vendored OpenSSL
+# out of this repository entirely. It is still kept off `mise run test` because a shipped crate
+# must never gain an edge to it, and the excluded manifest is what enforces that.
+#
+# `--locked` is what makes the committed `tooling/c2pa-oracle/Cargo.lock` load-bearing. Without it
+# cargo silently re-resolves the 307 transitive packages under the pinned `c2pa` (the figure is
+# derived in `tooling/c2pa-oracle/README.md`) and writes the result over the committed file, so the
+# crate's own resolved-graph assertion would be reading a resolution cargo had produced moments
+# earlier. With it, a lockfile that is missing or out of date fails the task instead of being
+# regenerated.
+#
+# That lockfile also records the 15 `gamut-*` crates this one reaches by path (it is workspace-
+# `exclude`d, so the root lockfile does not stand in for it). A release-plz version bump or a
+# dependency change in any of them therefore fails both tasks with "cannot update the lock file …
+# --locked was passed" even though nothing here changed. Refresh with
+# `cargo update --workspace --manifest-path tooling/c2pa-oracle/Cargo.toml` (path entries only; the
+# registry graph under `c2pa` stays put) and commit it — `tooling/c2pa-oracle/README.md`,
+# "Refreshing the lockfile after a gamut crate changes".
+[tasks.test-c2pa]
+description = "Cross-check gamut's C2PA carriage against c2pa-rs, both directions (issue #447)"
+run = "cargo test --locked --manifest-path tooling/c2pa-oracle/Cargo.toml"
+
+# The compile half, shaped after `check-dng-real`: a `gamut-avif` or `gamut-heic` API change can
+# break this crate while every per-PR gate stays green, and `check` catches that in seconds without
+# signing anything.
+#
+# Unlike `check-dng-real`, **neither of these two tasks is called by any workflow in `.github/`.**
+# The crate's whole automated reach today is `fmt-tooling-check`, which `fmt-check` hangs off, so a
+# compile break or a differential regression is caught only when someone runs these by hand.
+# Wiring them up — `check-c2pa` in the per-PR lint lane, `test-c2pa` in extended — is issue #541.
+[tasks.check-c2pa]
+description = "Compile the C2PA differential oracle (no signing, no corpus)"
+run = "cargo check --locked --manifest-path tooling/c2pa-oracle/Cargo.toml --all-targets"
+
 # Doctests only. On stable, `cargo llvm-cov` cannot instrument doctests (that needs nightly), so
 # the coverage gate — which CI uses as its green-test gate — silently skips them. This task is the
 # missing slice: CI's lint lane runs it, reusing the `--all-targets --all-features` build it just