Transmitted codec payload security

Noema wraps JPEG, CompressAI, TCM, HPCM, and EVC entropy streams in the data-only wire format noema.safe_data_json_base64.v1. The wrapper begins with a fixed Noema magic marker and a versioned JSON envelope. Bytes inside the typed data tree are encoded as canonical base64. The decoder supports only string-keyed dictionaries, lists, tuples, bytes, and finite scalar values; it does not import modules, resolve class names, or construct application objects.

Parsing is bounded before and during tree decoding. The current defaults cap the complete wire payload at 256 MiB, decoded binary content at 128 MiB, each string at 16 MiB, the tree at 1,000,000 values and 64 levels, and integers at 128 decimal digits. Unknown tags, duplicate JSON keys, non-canonical encodings, non-finite numbers, invalid Unicode, and limit violations fail closed.

Legacy pickle payloads are intentionally incompatible. There is no automatic fallback because detecting and then deserializing one would restore arbitrary code execution at the receiver. Existing stored results whose payload_format names a pickle wrapper must be regenerated. The wrapper is part of the transmitted bit count, so regenerated rate measurements can differ from old measurements because canonical JSON and base64 have different framing overhead.

This boundary protects payload decoding, not model execution. Optional third-party codec repositories still supply Python model definitions and native entropy extensions and must be treated as trusted code. Direct TCM and HPCM checkpoint loads use PyTorch’s weights_only=True; EVC delegates checkpoint reading to the upstream repository’s get_state_dict, whose implementation and repository revision remain in the trusted-code boundary.