WebP EXIF as TIFF; reject foreign BMFF meta

Convert prepared EXIF chunk payloads to the raw TIFF byte stream (omit JPEG APP1 Exif\0\0 preamble) and emit WebP EXIF chunks using that TIFF payload. Add adjust_exif_time_patch_slot_for_target to map time-patch offsets for PNG/WebP/JXL/JP2/BMFF targets and rename the PNG helper to build_tiff_exif_payload_from_app1. Implement detection of foreign top-level BMFF meta boxes and fail/decline bounded BMFF edits for such files (reject until OpenMeta can safely merge foreign item/property graphs). Update documentation to reflect the WebP EXIF payload shape and the constrained OpenMeta-managed BMFF edit contract. Add/adjust tests and CMake test helpers (WebP VP8X wrapper, payload checks, and a test asserting rejection of foreign BMFF meta boxes).

Author: ssh4net

README.md

@@ -142,7 +142,9 @@ In practice:
   terms are not part of the public CI dependency story; SDK-backed coverage is
   treated as maintainer or release validation.
 - PNG, WebP, JP2, JXL, bounded BMFF, and EXR all have real first-class
-  transfer entry points.
+  transfer entry points. BMFF file edits are currently limited to
+  OpenMeta-managed metadata-only `meta` boxes; targets with foreign top-level
+  `meta` boxes are rejected instead of risking an unusable HEIF/AVIF result.
 - EXR is still narrower than the container-edit targets: it emits safe string
   header attributes through the transfer core, can materialize a prepared
   `ExrAdapterBatch` for host exporters, and Python can inspect that prepared

docs/development.md

@@ -270,6 +270,8 @@ Current v1 behavior is:
     - `prepare_metadata_for_target(..., TransferTargetFormat::Webp, ...)`
       currently builds `EXIF`, `XMP `, `ICCP`, and bounded `C2PA` RIFF
       metadata chunks from `MetaStore`
+    - WebP `EXIF` chunk payloads contain direct TIFF bytes and intentionally
+      omit the JPEG APP1 `Exif\0\0` preamble
     - `compile_prepared_bundle_webp(...)` and
       `emit_prepared_bundle_webp_compiled(...)` provide the same
       `prepare once -> compile once -> emit many` shape as JPEG/TIFF/JXL
@@ -285,8 +287,7 @@ Current v1 behavior is:
       bytes from prepared bundles, and
       `build_prepared_transfer_package_batch(...)` can materialize those bytes
       into one owned replay batch
-    - full WebP file rewrite/edit and signed C2PA rewrite remain follow-up
-      work
+    - full WebP signed C2PA rewrite remains follow-up work
   - ISO-BMFF metadata-item transfer now uses the same bounded contract for
     `HEIF` / `AVIF` / `CR3` targets:
     - `prepare_metadata_for_target(..., TransferTargetFormat::{Heif,Avif,Cr3}, ...)`
@@ -311,14 +312,16 @@ Current v1 behavior is:
       the reusable item/property-emitter path
     - the shared package-batch persistence/replay layer can own and hand off
       those stable BMFF item and property payload bytes
-    - OpenMeta also supports a bounded append-style BMFF edit path:
-      it preserves existing top-level BMFF boxes, strips prior
-      OpenMeta-authored metadata-only `meta` boxes, and appends one new
-      OpenMeta-authored metadata-only `meta` box carrying the prepared BMFF
-      items/properties
+    - OpenMeta also supports a bounded BMFF edit path for targets without a
+      foreign top-level `meta` box, or with a prior OpenMeta-authored
+      metadata-only `meta` box from the same bounded contract. It preserves
+      non-`meta` top-level BMFF boxes and replaces the OpenMeta-authored
+      metadata-only `meta` box with the prepared BMFF items/properties.
+      Targets with foreign top-level `meta` boxes are rejected until OpenMeta
+      can merge real BMFF item/property graphs safely.
     - CLI/Python `metatransfer` wrappers expose both BMFF summaries and this
       bounded edit path; `--target-heif`, `--target-avif`, and `--target-cr3`
-      now accept `--source-meta <path>` plus `--output <path>` for metadata
+      now accept `--source-meta PATH` plus `--output PATH` for metadata
       transfer onto an existing BMFF target file
     - the same bounded BMFF edit contract now also participates in the core /
       file-helper C2PA signer path:

docs/metadata_backend_matrix.md

@@ -93,6 +93,8 @@ For the public per-target preserve/replace guarantees, see
   - `XMP `
   - `ICCP`
   - bounded `C2PA`
+- The prepared `EXIF` chunk payload is the TIFF byte stream only. It does not
+  include the JPEG APP1 `Exif\0\0` preamble.
 - OpenMeta now has a bounded WebP transfer path on the core transfer API:
   `prepare_metadata_for_target(..., TransferTargetFormat::Webp, ...)`,
   `compile_prepared_bundle_webp(...)`,
@@ -105,14 +107,16 @@ For the public per-target preserve/replace guarantees, see
   `write_prepared_transfer_package(...)` can serialize direct WebP chunk bytes
   from prepared bundles, and the owned package batch/replay path can persist
   or hand off those bytes without keeping the source bundle alive.
-- Full WebP file rewrite/edit and signed C2PA rewrite/re-sign are still
-  outside the current WebP transfer contract.
+- The file edit path rewrites managed metadata chunks and patches existing
+  `VP8X` feature bits. It does not synthesize a missing `VP8X` chunk.
+- Full WebP signed C2PA rewrite/re-sign is still outside the current WebP
+  transfer contract.
 
 ### ISO-BMFF metadata items (HEIF / AVIF / CR3)
 
-- This bounded transfer path is metadata-item/property oriented. OpenMeta now
-  also supports a bounded append-style BMFF metadata edit path over an
-  existing BMFF target file.
+- This bounded transfer path is metadata-item/property oriented. OpenMeta also
+  supports a bounded OpenMeta-managed BMFF metadata edit path over an existing
+  BMFF target file.
 - Current prepared item routes:
   - `bmff:item-exif`
   - `bmff:item-xmp`
@@ -143,21 +147,23 @@ For the public per-target preserve/replace guarantees, see
 - `metatransfer` / `openmeta.transfer_probe(...)` expose BMFF summaries,
   including `bmff_property colr/prof ...`.
 - `metatransfer --target-heif|--target-avif|--target-cr3 --source-meta ... -o ...`
-  now performs bounded metadata-only edit by appending one OpenMeta-authored
-  metadata-only top-level `meta` box and replacing any prior OpenMeta-authored
-  metadata-only `meta` box from the same bounded contract.
+  performs bounded metadata-only edit only for targets with no foreign
+  top-level `meta` box, or with a prior OpenMeta-authored metadata-only `meta`
+  box from the same bounded contract. Foreign top-level `meta` boxes are
+  rejected until OpenMeta can merge real BMFF item/property graphs safely.
 - Embedded-XMP strip mode removes only OpenMeta-authored metadata `meta` boxes.
-  Foreign BMFF XMP item graphs are preserved; recognized foreign XMP `mime`
-  items, including `iinf` version 0/1/2 tables, make strip mode fail
-  explicitly instead of silently claiming removal.
+  Foreign BMFF metadata graphs are not modified; recognized foreign XMP `mime`
+  items, including `iinf` version 0/1/2 tables, make strip mode fail explicitly
+  instead of silently claiming removal.
 - The same bounded BMFF edit contract now also participates in the core /
   file-helper C2PA signer path:
   - sign-request derivation
   - binding-byte materialization
   - signed-payload validation
-  - staged `bmff:item-c2pa` apply before bounded metadata-only edit
+  - staged bmff:item-c2pa apply before bounded metadata-only edit
 - Out of scope for the current BMFF contract:
   - thin CLI/Python signer-input exposure for BMFF
+  - merging or rewriting foreign top-level BMFF meta item/property graphs
   - full BMFF signed rewrite/re-sign beyond the bounded metadata-only edit path
 
 ### EXR (OpenEXR)

docs/metadata_transfer_plan.md

@@ -55,7 +55,7 @@ The first public write-side sync controls are also in place:
 | WebP | Bounded but real | Prepared bundle, compiled emit, bounded chunk rewrite/edit, file-helper roundtrip | Not a general WebP chunk editor |
 | JP2 | Bounded but real | Prepared bundle, compiled emit, bounded box rewrite/edit, file-helper roundtrip | `jp2h` synthesis is still out of scope |
 | JXL | Bounded but real | Prepared bundle, compiled emit, bounded box rewrite/edit, file-helper roundtrip | Still narrower than JPEG/TIFF |
-| HEIF / AVIF / CR3 | Bounded but real | Prepared bundle, compiled emit, bounded BMFF item/property edit, file-helper roundtrip | Not broad BMFF writer parity |
+| HEIF / AVIF / CR3 | Bounded but real | Prepared bundle, compiled emit, bounded OpenMeta-managed BMFF item/property edit, file-helper roundtrip | Not broad BMFF writer parity; foreign top-level `meta` graphs are rejected until merge support exists |
 | EXR | Bounded but real | Prepared bundle, compiled emit, direct backend attribute emit, prepared-bundle to `ExrAdapterBatch` bridge, CLI/Python transfer surface | No file rewrite/edit path yet; current transfer payload is safe string attributes only |
 
 ## What Is Already Implemented
@@ -104,16 +104,17 @@ OpenMeta now has explicit end-to-end read-backed transfer tests for:
 - source JPEG -> WebP edit/apply -> read-back
 - source JPEG -> JP2 edit/apply -> read-back
 - source JPEG -> JXL edit/apply -> read-back
-- source JPEG -> HEIF edit/apply -> read-back
-- source JPEG -> AVIF edit/apply -> read-back
-- source JPEG -> CR3 edit/apply -> read-back
+- source JPEG -> OpenMeta-managed HEIF edit/apply -> read-back
+- source JPEG -> OpenMeta-managed AVIF edit/apply -> read-back
+- source JPEG -> OpenMeta-managed CR3 edit/apply -> read-back
 
 That does not make all targets equally mature, but it does mean the transfer
 core has real roundtrip regression gates across the primary supported export
 families.
 
 The primary writer family is also covered by a deterministic compatibility-dump
-gate for JPEG, TIFF, DNG, PNG, WebP, JP2, JXL, HEIF, AVIF, and CR3. That gate
+gate for JPEG, TIFF, DNG, PNG, WebP, JP2, JXL, and OpenMeta-managed HEIF,
+AVIF, and CR3. That gate
 checks the prepared EXIF/XMP routes, edit/apply status, dual-write XMP
 writeback summary, and decoded metadata dump for the managed source fields.
 Additional compatibility-dump gates cover sidecar-only writeback with explicit
@@ -256,6 +257,8 @@ Implemented as a bounded RIFF metadata target:
 - `ICCP`
 - bounded `C2PA`
 - bounded rewrite/edit for managed metadata chunks
+- `EXIF` chunk payloads use direct TIFF bytes, without the JPEG APP1
+  `Exif\0\0` preamble
 
 ### JP2
 
@@ -284,9 +287,11 @@ Implemented as a bounded BMFF target family:
 - bounded `bmff:item-jumb`
 - bounded `bmff:item-c2pa`
 - bounded `bmff:property-colr-icc`
-- bounded metadata-only `meta` rewrite path
+- bounded OpenMeta-managed metadata-only `meta` rewrite path
 - explicit strip-mode rejection for recognized foreign XMP item graphs,
   including `iinf` version 0/1/2 `mime` entries
+- fail-safe rejection for foreign top-level `meta` boxes until real BMFF
+  item/property merge support exists
 
 ### EXR
 
@@ -782,7 +787,7 @@ embedded/sidecar writeback across the primary writer target family.
 #### 3. Compare-Backed Release Validation
 
 - [x] promote the current primary-target roundtrip checks into explicit release-facing compare gates
-- [x] add compare-backed validation for `TIFF`, `DNG`, `PNG`, `WebP`, `JP2`, `JXL`, and bounded `BMFF` target outputs
+- [x] add compare-backed validation for `TIFF`, `DNG`, `PNG`, `WebP`, `JP2`, `JXL`, and OpenMeta-managed bounded `BMFF` target outputs, plus fail-safe rejection for foreign top-level `meta` BMFF targets
 - [x] cover embedded-only, sidecar-only, and dual-write XMP flows in release-facing compare validation
 - [x] add compare-backed validation for explicit sidecar-base overrides and destination-sidecar cleanup behavior
 - [x] gate the primary writer family on deterministic read-back of managed metadata after edit/apply

docs/sphinx/writer_target_contract.rst

@@ -105,10 +105,10 @@ Target Summary
    * - ``HEIF`` / ``AVIF`` / ``CR3``
      - one OpenMeta-authored metadata-only top-level ``meta`` box with
        Exif/XMP/JUMBF/C2PA items and ``colr`` ICC property
-     - Preserve all non-OpenMeta top-level boxes; replace prior
-       OpenMeta-authored metadata ``meta``; append a new OpenMeta metadata
-       ``meta`` when needed.
-     - Does not rewrite arbitrary existing BMFF scene/item graphs.
+     - Preserve non-``meta`` top-level boxes; replace prior
+       OpenMeta-authored metadata ``meta``; reject foreign top-level ``meta``
+       boxes instead of appending a competing metadata graph.
+     - Does not rewrite or merge arbitrary existing BMFF scene/item graphs.
    * - ``EXR``
      - safe string header attributes through the EXR transfer emitter or
        adapter batch
@@ -201,6 +201,9 @@ existing chunks from the same managed family. Unrelated chunks are preserved.
 When EXIF, XMP, or ICC is present after rewrite, OpenMeta patches the existing
 ``VP8X`` feature flags to match the final metadata state.
 
+Prepared WebP ``EXIF`` chunks carry the TIFF byte stream directly. They do
+not include the JPEG APP1 ``Exif\0\0`` preamble.
+
 The current WebP edit contract requires an existing ``VP8X`` chunk for EXIF,
 XMP, or ICC metadata edits. It does not synthesize ``VP8X``.
 
@@ -237,14 +240,20 @@ encoder-side handoff and is not serialized by the file edit path.
 HEIF / AVIF / CR3
 -----------------
 
-The bounded BMFF edit path preserves all non-OpenMeta top-level boxes as
-source ranges.
+The bounded BMFF edit path preserves non-``meta`` top-level boxes as source
+ranges.
 
 OpenMeta writes one metadata-only top-level ``meta`` box using the public
 bounded contract. That box can contain prepared Exif, XMP, JUMBF, C2PA, and
 ICC ``colr`` property payloads. A prior OpenMeta-authored metadata ``meta``
-box is removed and replaced by the newly prepared box. Foreign ``meta`` boxes
-and normal BMFF scene/item graphs are preserved.
+box is removed and replaced by the newly prepared box.
+
+OpenMeta does not append a second top-level ``meta`` box when the target
+already has a foreign top-level ``meta`` box. Real HEIF/AVIF scene graphs
+commonly use that box for image items and properties; appending a competing
+metadata graph can make the result unusable. Until OpenMeta has a real BMFF
+merge path for foreign item/property graphs, that case is reported as
+unsupported and no edited output is written.
 
 If sidecar-only writeback asks to strip embedded XMP, OpenMeta can remove XMP
 from its own OpenMeta-authored metadata ``meta`` box. It does not strip XMP

docs/writer_target_contract.md

@@ -59,7 +59,7 @@ integration checks.
 | `WebP` | `EXIF`, XMP RIFF chunk, `ICCP`, bounded `C2PA` | Replace matching managed RIFF chunks; preserve unrelated chunks; patch `VP8X` feature bits | EXIF/XMP/ICC edits require an existing `VP8X` chunk |
 | `JP2` | top-level `Exif`, top-level XMP `xml` box, `jp2h/colr` ICC | Replace matching top-level metadata boxes; rewrite `jp2h` only to replace/insert `colr`; preserve unrelated boxes and unrelated `jp2h` children | Does not synthesize `jp2h`; requires one existing `jp2h` for ICC |
 | `JXL` | top-level `Exif`, XMP `xml` box, `jumb`, `c2pa` | Replace matching top-level boxes; preserve signature and non-managed boxes; classify `jumb` as generic JUMBF or C2PA | ICC is encoder handoff only; file edit emits uncompressed prepared metadata boxes |
-| `HEIF` / `AVIF` / `CR3` | one OpenMeta-authored metadata-only top-level `meta` box with Exif/XMP/JUMBF/C2PA items and `colr` ICC property | Preserve all non-OpenMeta top-level boxes; replace prior OpenMeta-authored metadata `meta`; append a new OpenMeta metadata `meta` when needed | Does not rewrite arbitrary existing BMFF scene/item graphs |
+| `HEIF` / `AVIF` / `CR3` | one OpenMeta-authored metadata-only top-level `meta` box with Exif/XMP/JUMBF/C2PA items and `colr` ICC property | Preserve non-`meta` top-level boxes; replace prior OpenMeta-authored metadata `meta`; reject foreign top-level `meta` boxes instead of appending a competing metadata graph | Does not rewrite or merge arbitrary existing BMFF scene/item graphs |
 | `EXR` | safe string header attributes through the EXR transfer emitter or adapter batch | No file rewrite contract today; host applies prepared attributes through its own EXR writer | Attribute-emitter target, not a file edit path |
 
 ## JPEG
@@ -141,6 +141,9 @@ chunks from the same managed family. Unrelated chunks are preserved. When
 EXIF, XMP, or ICC is present after rewrite, OpenMeta patches the existing
 `VP8X` feature flags to match the final metadata state.
 
+Prepared WebP `EXIF` chunks carry the TIFF byte stream directly. They do not
+include the JPEG APP1 `Exif\0\0` preamble.
+
 The current WebP edit contract requires an existing `VP8X` chunk for EXIF,
 XMP, or ICC metadata edits. It does not synthesize `VP8X`.
 
@@ -174,14 +177,20 @@ encoder-side handoff and is not serialized by the file edit path.
 
 ## HEIF / AVIF / CR3
 
-The bounded BMFF edit path preserves all non-OpenMeta top-level boxes as
-source ranges.
+The bounded BMFF edit path preserves non-`meta` top-level boxes as source
+ranges.
 
 OpenMeta writes one metadata-only top-level `meta` box using the public
 bounded contract. That box can contain prepared Exif, XMP, JUMBF, C2PA, and
 ICC `colr` property payloads. A prior OpenMeta-authored metadata `meta` box is
-removed and replaced by the newly prepared box. Foreign `meta` boxes and
-normal BMFF scene/item graphs are preserved.
+removed and replaced by the newly prepared box.
+
+OpenMeta does not append a second top-level `meta` box when the target already
+has a foreign top-level `meta` box. Real HEIF/AVIF scene graphs commonly use
+that box for image items and properties; appending a competing metadata graph
+can make the result unusable. Until OpenMeta has a real BMFF merge path for
+foreign item/property graphs, that case is reported as unsupported and no
+edited output is written.
 
 If sidecar-only writeback asks to strip embedded XMP, OpenMeta can remove XMP
 from its own OpenMeta-authored metadata `meta` box. It does not strip XMP from