top of page
Both FZ LLC in Dubai

SAVX

specs/SAV1.md

SAV1 — Static Audible Verified X (Brand Profile)

Version: 1.0 (2025-09-18)
Brand 4CC: SAV1 (major or compatible brand in ftyp)
Status: Draft for MP4RA registration
Scope: ISO Base Media File Format (ISOBMFF) profile

1. Overview

SAV1 defines a scroll-native, deterministic visual stream bound to a parametric ultrasonic verification stream that is synthesized at render time and produces signed receipts. Files remain valid ISOBMFF and play on legacy players; SAV-aware players implement verification.

2. Conformance (normative)

To claim SAV1:

  • File SHALL contain ftyp with SAV1 as major_brand or in compatible_brands.

  • File SHALL contain one visual track (video or timed layout; see §3) and one verification track with sample entry savp (§4).

  • The savp sample entry SHALL contain one savC Configuration box (§5).

  • The verification track SHALL refer to the visual track via cdsc or vatt (§6).

  • If content A/V is encrypted (CENC), the savp track SHALL remain in the clear.

  • Timescale of the savp track SHOULD be 1 000 (ms), unless otherwise noted in savC.

3. Visual stream (normative)

  • MAY be a static raster (e.g., a still page encoded as a one-frame H.264/AV1 track) or a deterministic layout stream (external spec to be added).

  • The canonical viewport-hash SHALL be computed over the visible region per §7 during savp sample intervals.

4. Verification stream (normative)

  • Track handler: meta.

  • Sample entry 4CC: savp (see separate savp.md).

  • Each savp access unit (AU) represents exactly one macro-frame (default 1 000 ms). Two consecutive AUs form a superframe (default 2 000 ms).

5. savC Configuration (normative)

savC SHALL declare decoder parameters: version, atom table IDs, lane plan, synthesis base sample rate, window/envelope tables, FEC/CRC schemes, and timing constants (slot/macro/superframe). See savC.md.

6. Track linkage (normative)

  • Implementers SHALL link the savp track to its visual target using cdsc (descriptive) or vatt (viewport-attested; see vatt.md).

  • If both exist, vatt semantics take precedence.

7. Viewport-hash (normative)

  • Compute SHA-256 over a canonicalized render tree of visible blocks (text, images, vector), ordered by (y1, x1).

  • Canonical record (CBOR/UTF-8):
    {type, bbox_norm[4], z, font_id?, glyph_ids_hash?, image_tile_hashes?}.

  • Normalize coordinates to [0,1] in track pixel space; hash image tiles (e.g., 256×256, AVIF/PNG bytes).

  • Truncate to commit_bits from savC (default 64) → ViewportCommit.

8. Receipts (informative)

Players SHOULD emit signed receipts per AU: {ID, UTC, AU_index, ViewportCommit, SNR/CFO/margins, verdict, device_attestation}. No consumer content leaves device.

9. Backward compatibility

Legacy players ignore unknown savp and still render the visual. SAV-aware players synthesize/verify pre-DAC per savp.md.

10. Security & Privacy

  • The verification stream stores parameters, not PCM.

  • Default mode stores receipts only; forensics mode MAY enable dual-custody audio split (outside this profile).

specs/savp.md

savp — SAV Parametric Ultrasonic Verification (Sample Entry / Codec)

Version: 1.0 (2025-09-18)
Sample entry 4CC: savp (in stsd)
Handler: meta
Status: Draft for MP4RA registration

Goal: store procedural synthesis parameters, not audio samples, to reconstruct the bothX® ultrasonic signal deterministically at render time and bind it to the visual viewport.

1. Sample entry format (normative)

Binary layout extends SampleEntry (ISO/IEC 14496-12). After the standard header (data_reference_index), the following boxes SHALL appear:

+-------------------------------+ | SampleEntry ('savp') | | reserved[6], data_ref_index | | (boxes...) | | 'savC' (required) | | 'sinf' (optional, clear) | | other boxes (optional) | +-------------------------------+

  • savC is defined in savC.md.

  • sinf MAY be present for signaling clear-track policy.

2. Track timing (normative)

  • Track timescale: SHOULD be 1 000 (ms base).

  • Each access unit (AU) represents one macro-frame with duration macroframe_ms from savC (default 1 000 ms).

  • Two consecutive AUs comprise a superframe (default 2 000 ms).

  • Within a macro-frame there are slot_count = macroframe_ms / slot_ms slots (default slot 40 ms → 25 slots).

3. Access Unit (AU) payload (normative)

All multi-byte integers are big-endian. AU syntax:

AU() { u8 version; // =1 u8 flags; // bit0: has_viewport_commit, bit1: has_fec, bit2: reserved u16 slot_ms; // e.g., 40 u16 macroframe_ms; // e.g., 1000 u16 atoms_per_slot_max; // sanity cap (e.g., 4) u8 commit_bits; // truncation bits for ViewportCommit (e.g., 64) u8 reserved0; u16 slot_count; // derived, e.g., 25 u16 atom_record_size; // bytes per AtomRecord (see below) u16 fec_scheme_id; // 0=none, 1=RS(28,20), 2=LDPC_kN, etc. u16 crc16_ccitt; // CRC over header fields above (before slots) // Slots for s in 0..slot_count-1 { u8 atom_count; // number of atoms in this slot AtomRecord atoms[atom_count]; } if (flags.bit0) { uN viewport_commit; // N = ceil(commit_bits/8) bytes (big-endian) } if (flags.bit1) { FEC_Trailer fec; // per fec_scheme_id } }

AtomRecord encodes one synthesis atom:

AtomRecord() { u8 lane_index; // 0..(lanes-1); center f from savC u8 atom_type; // enumerated in savC (e.g., U,D,S,H,L,X) i16 df_centiHz; // Δf from lane center in 0.01 Hz u16 dur_ms; // atom duration (e.g., 16) u16 env_id; // envelope table ID (savC) i16 phase_milli; // initial phase in milli-radians }

4. Synthesis semantics (normative)

  • The decoder SHALL synthesize atoms pre-DAC at sample rate synth_fs from savC (default 48 000 Hz) and mix them on an isolated render bus.

  • Lane centers and allowed excursions come from savC.lane_plan (default: 36 lanes across 20.05–22.85 kHz, Δf=80 Hz).

  • Atoms use window/envelope shapes from savC.env_table (default includes Tukey α=0.125).

  • Overlapping atoms in a slot SHALL sum linearly.

5. Integrity & FEC (normative)

  • crc16_ccitt covers AU header (up to, not including, slots).

  • Optional FEC trailer per fec_scheme_id; default 0 (none). Recommended default for superframe payload protection is RS(28,20) at the logical layer (outside AU framing).

6. Viewport binding (normative)

  • If flags.bit0==1, viewport_commit SHALL equal the truncated SHA-256 defined by the SAV1 viewport-hash (§7 of SAV1) for the wall-clock interval spanned by the AU.

7. Decoder behavior (normative)

  • If AU integrity checks fail (CRC/FEC), decoder MAY mark the AU “erased” and rely on temporal redundancy; receipts SHALL report corrections.

  • If lane/pilot lock (from bothX® profile) fails, the AU SHALL be marked Unreadable.

8. Security considerations (informative)

  • savp carries no program audio. Implementations SHOULD keep it clear even when content is encrypted.

specs/savC.md

savC — SAV Configuration Box

Version: 1.0 (2025-09-18)
Box 4CC: savC
Status: Draft for MP4RA registration

1. Placement

savC SHALL appear inside the savp sample entry and configures synthesis, timing, and integrity.

2. Box syntax (normative)

All multi-byte integers are big-endian.

aligned(8) class savC extends FullBox('savC', version=1, flags=0) { u32 synth_fs; // synthesis sample rate in Hz (default 48000) u16 slot_ms; // default 40 u16 macroframe_ms; // default 1000 u16 superframe_ms; // default 2000 u8 lanes; // default 36 u8 commit_bits; // default 64 u16 atoms_per_slot_max; // default 4 u16 fec_scheme_id; // 0=none, 1=RS_28_20, 2=LDPC_kN, ... u16 env_table_id; // envelope table selector u16 atom_table_id; // atom alphabet/version selector u16 lane_plan_id; // maps lane_index -> center frequency u8 reserved0[6]; // variable payload tables follow (length-prefixed): LanePlan lane_plan; EnvelopeTable env_table; AtomTable atom_table; }

2.1 LanePlan (normative)

LanePlan { u16 count; // equals 'lanes' struct { u8 lane_index; // 0..count-1 u32 f_center_milliHz; // lane center in milli-hertz u32 max_excursion_milliHz; // absolute |Δf| allowed } lane[count]; }

Default lane plan: 36 lanes uniformly across 20.05–22.85 kHz (Δf between centers ≈80 Hz), max_excursion 10 Hz.

2.2 EnvelopeTable (normative)

EnvelopeTable { u16 count; struct { u16 env_id; u16 kind; // 0=Tukey, 1=Hann, 2=RaisedCos, ... u16 param0_milli; // e.g., Tukey alpha*1000 u16 param1_milli; // reserved } env[count]; }

Default: include Tukey α=0.125.

2.3 AtomTable (normative)

Defines the alphabet of atom types used by bothX® (e.g., U,D,S,H,L,X), their semantic roles (pilot/payload/control), and any per-type constraints. Exact mapping is versioned here.

AtomTable { u16 count; struct { u8 atom_type; // matches AU.atom_type u8 role; // 0=pilot,1=payload,2=control u16 min_dur_ms; u16 max_dur_ms; } atom[count]; }

3. Semantics (normative)

  • Players SHALL treat savC as immutable for the life of the track.

  • If a player does not recognize env_table_id/atom_table_id/lane_plan_id, it SHALL process the in-box tables; otherwise MAY use cached tables by ID after verifying equality.

4. Versioning

  • Increment FullBox.version on any incompatible change.

  • Additive table entries increment *_id without breaking existing implementations.

specs/vatt.md

vatt — Viewport-Attested Track Reference

Version: 1.0 (2025-09-18)
Track reference 4CC: vatt
Status: Draft for MP4RA registration

1. Purpose

vatt binds a verification track (savp) to the visual track whose viewport content is committed into the acoustic payload and receipts.

2. Semantics (normative)

  • A vatt reference from track A (type savp) to track B (visual) asserts that A’s viewport_commit fields SHALL be computed from B’s rendering during A’s AU intervals.

  • If multiple vatt targets exist, the first SHALL be used; others are ignored.

  • If both vatt and cdsc exist, vatt semantics take precedence.

3. Construction (normative)

  • Implementers SHALL populate the tref box of the savp track with an entry of type vatt listing the track_ID of the visual track.

  • No additional data is carried in vatt beyond the referenced track IDs.

4. Error handling

  • If the referenced visual track is absent or disabled, the verifier SHALL mark AUs Unreadable (viewport binding absent).

5. Backward compatibility

  • Players that do not recognize vatt MAY ignore it; SAV conformance still holds if cdsc is present and used equivalently.

​

Minimal ftyp example (SAV1 major brand)

size type major minor compat brands... 1C ftyp SAV1 00000001 SAV1 isom mp42 Hex: 00 00 00 1C 66 74 79 70 53 41 56 31 00 00 00 01 53 41 56 31 69 73 6F 6D 6D 70 34 32

Viewport-hash pseudocode (normative reference)

# Inputs: render_tree (visible nodes), viewport_rect, commit_bits # Output: N-byte commit where N=ceil(commit_bits/8) def viewport_commit(render_tree, viewport_rect, commit_bits=64): blocks = extract_visible_blocks(render_tree, viewport_rect) recs = [] for b in sorted(blocks, key=lambda n: (n.y1, n.x1)): bbox = normalize_to_viewport(b.bbox, viewport_rect) # four 32-bit fixed Q16.16 if b.type == "text": payload = c14n_text_glyphs(b) # font_id + glyph_ids elif b.type == "image": payload = hash_image_tiles(b) # concat tile digests else: payload = c14n_vector(b) recs.append(encode_record(b.type, bbox, b.z, payload)) h = sha256(concat(recs)).digest() return h[: (commit_bits + 7)//8]

Contact

SAVX@both.works

+971 5649 26565

bottom of page