# Independent Provenance Review: Xeno-Owned Media Stack

## Review identity

- Component: Xeno-owned compression, raster codecs, metadata/color conversion, and secure SVG renderer
- Replacement milestone: PROPRIETARY-MEDIA-1
- Implementation record path: `ownership/evidence/PROPRIETARY-MEDIA-1/implementation-record.md`
- Candidate revision: `a59066e477c904e077b1aceed8a65fa9c2767535` plus recorded working-tree changes
- Reviewer: pending
- Domain reviewer(s): pending codec, color-management, parser-security, and intellectual-property reviewers
- Review date (UTC): pending
- Reviewer independent of implementation: pending

## Evidence checks

- [ ] The capability matrix predates or is independently reconciled with the implementation.
- [ ] Normative sources, revisions, hashes, and permitted uses are complete.
- [ ] Contributor source-exposure disclosures are complete.
- [ ] No copied implementation source, comments, tests, identifiers, non-normative constants, or distinctive internal structure were found.
- [ ] RFC-derived numeric tables and specification-copying rights have an explicit counsel disposition.
- [ ] Production source, bundles, package, lock, and installed graph have no ambient decoder, canvas, zlib, or hidden fallback.
- [ ] PNG/JPEG/GIF/VP8/VP8L/WebP behavior passes approved independently sourced conformance corpora.
- [ ] SVG geometry, rendering, XML/CSS security, clipping/masking, text policy, and unsupported-feature failures are independently reviewed.
- [ ] Byte, allocation, recursion, frame, CPU, and output limits hold under adversarial review.
- [ ] The approved sustained fuzz-duration gate completes with no unresolved crash, hang, or excessive allocation.
- [ ] Black-box oracle tools and fixtures are classified and proven production-excluded.
- [ ] Release tarball, clean install, CLI integration, and standalone artifacts agree with the ownership inventory.
- [ ] Patent, trademark, specification-license, and public product-language questions have counsel approval.

## Verification summary

| Gate | Evidence | Result | Notes |
| --- | --- | --- | --- |
| Focused media behavior | 62 committed tests | engineering pass | format matrix, metadata, malformed inputs, and ReadImage covered |
| SDK regression | full Node suite | engineering pass | 501 pass, 2 platform skips, 0 failures |
| Linked CLI integration | typechecks, bundle build, full Vitest suite | engineering pass | 163 files; 1,490 pass, 1 skip, 0 failures |
| Type/build | source/test typechecks and tsup build | engineering pass | no type or build failures |
| Normative VP8 generation | pinned RFC source and byte comparison | engineering pass | generated file reproduced exact SHA-256 |
| Runtime package/source exclusion | ownership audit and targeted scan | engineering pass | 823 artifact-inclusive records, 0 violations |
| Independent corpus and sustained fuzz | not yet run | pending | required before capability approval |
| Provenance and legal | implementation record only | pending | independent reviewer and counsel required |

## Decision

- Engineering provenance decision: needs-review
- Capability gate may be marked achieved: no
- Public clean-room/proprietary claim approved by this review: no
- Required follow-up: classify and run approved independent corpora, complete sustained fuzzing, collect contributor disclosures, perform independent source/security/color review, audit release and installed artifacts, reconcile xeno-lib, and attach counsel disposition.
- Reviewer signature/date: pending
- Counsel approval reference: pending