Playground
(Lispex)
KOENRU

Image Format and Safety

The csk.lispex-image/v2 format turns a limited number of source bytes into one PNG, or one ZIP of ordered PNG pages, whose layout is fixed down to the byte. The decoder returns source only after every structural, integrity, parity, and regeneration check succeeds.

How to reason about it

  • The format pins its image, inspection, profile, and codebook tags. It also pins the 1304-pixel width, the Sunlit Amber palette (#172A3A, #2F806F, #D18A43, #FFF1CF), page geometry, fixed-Huffman PNG encoding, stored ZIP grammar, page order, and manifest bytes.
  • Inputs are limited to 1 MiB of source, 16,384 reader nodes, reader depth 256, and 32 pages. Malformed length and offset fields are rejected before unsafe allocation.
  • Inspection exposes format and profile identifiers, page count, exact source length and identity, plus projection, Core, payload, page-set, and per-page commitments.
  • Reed–Solomon parity detects changed payload symbols but performs no repair. A valid payload must also regenerate to exactly the supplied PNG or ZIP bytes.
  • The round-trip laws are decode(encode(source)) = source and encode(decode(image)) = image for every accepted image.

A common mistake

Being fixed down to the byte proves only that the bytes are one exact Lispex Image representation. Source identity, signatures, trust policy, request binding, Native re-execution, and a local gate remain separate boundaries.

Current boundaries

  • Do not infer watermarking, steganography resistance, visual robustness, error correction, confidentiality, authorship, or malicious-code safety from a valid image.

Keep going

The images guide carries the practical commands, and the Vouch overview places an image inside the evidence chain.

Lispex Images · Lispex Vouch overview