zenav1-svt

Pure-Rust port of SVT-AV1 v4.2.0 — #![forbid(unsafe_code)], no C in the product library path — with explicit C-reference selection and opt-in HDR-fork/Zen extensions.

It encodes 8/10-bit 4:2:0 stills and animated AVIF, and video in a measured envelope: 8/10-bit 4:2:0, presets -1..13, flat low-delay-P. Outside that envelope an inter frame is refused rather than approximated. Monochrome and alpha are Rust extensions beyond C's envelope.

The support tables below are the answer to "does it do X?" — every row names the gate that backs it, and every gate runs in CI. Remaining work is tracked in issue 21.

• Legacy constructors retain Hybrid3115, the historical patched-C oracle. This is not synonymous with pristine mainline, even with HDR knobs off.
• SvtReference::Mainline420 names pristine v4.2.0. SvtParity(reference) restricts the request to the named C envelope and rejects Zen enhancements. It does not certify every untested combination or erase known divergences.
• Checked native presets include −1 through 13. Effort currently resolves to native buckets; fractional adaptive search is not implemented.
• Grain modeling/denoising/tables/synthesis and named Zen intra-edge/restoration experiments are wired in their documented envelopes. Experiments stay opt-in.
• 4:4:4 chroma ships on a measured decoder-verified envelope (8-bit key AND inter frames, SB64, no superres) as a Zen extension — C refuses it, so the oracle is the decoder, never byte parity. 4:2:2 and 12-bit remain rejected, matching C.

At implementation main 0cbd1279, the latest native workspace gate passed 2631/2631 tests, zero skips. PR #20 uses published archmage/magetypes 0.9.29; 19 explicitly selected ARM SAD/variance tests passed under QEMU. Verification and pre-existing ARM Clippy/MSRV debt. These local checks are not a claim of a new CI run.

The preceding eight-bit landing matrix passed 1100/1100 in its named reference envelope. The four formerly deferred native10 parity cells closed byte-identical on 2026-09-17. See identity status. HDR MODE=ON has a standing 10-bit gate; older 8-bit 48/48 prose is historical, without a corresponding retained standing gate. Per-reference, per-ISA and corpus boundaries matter. No universal C parity or calibrated RD/time routing is claimed.

use svtav1::{avif::AvifEncoder, rgba::RgbaFrame};

let (meta, gif, _) = zengif::decode_gif(&bytes, Default::default(), &zengif::Unstoppable)?;
let frames: Vec<RgbaFrame> = /* full-canvas RGBA + duration_ms per frame */;
let avif = AvifEncoder::new()
    .with_quality(70.0)
    .encode_rgba_animation(&frames, meta.width.into(), meta.height.into())?;
std::fs::write("out.avif", &avif)?;

Runnable end to end, decode included:

cargo run --release --features avif-container --example gif_to_avif -- in.gif out.avif 70

encode_rgba_animation does the BT.601 conversion, the 4:2:0 subsampling, the alpha-plane decision (a plane is written only if some pixel is non-opaque) and the container muxing. The output carries a still poster image and a timed AV1 sequence track, and decodes in avifdec, dav1d and ffmpeg.

MP4 input and true inter-frame AV1 output are not wired yet — see the table below.

The four columns mean exactly this, and the distinction is the point:

A refusal is a deliberate design choice in this port: an out-of-envelope configuration is rejected rather than encoded as a plausible-but-wrong stream. rust/docs/REFUSED-CONFIGS.md is the generated inventory, split into CAPABILITY (debt) and CONTRACT (permanent caller misuse).

Inter frames ship, in a measured envelope: 4:2:0 at 8 and 10 bits, plus monochrome. 8-bit covers presets -1..13; 10-bit covers -1..13 at 256x256 and -1..5 at 128x128 (the measured grid — wider cells are untested, not refused). EncodePipeline's 4:2:0 entry points encode video for every caller inside it. Monochrome inter is decoder-verified on its own gate (tools/mono_inter_gate.sh); monochrome qp0 inter still refuses — no inter WHT residual path exists for it yet.

The guarantee is different from the still one, and the difference is the point. Still images are byte-identical to C. Video is verified against a DECODER — the encoder's own reconstruction must equal aomdec's, frame for frame — because that is the property a wrong stream actually violates, and because the port's inter search does not track C's byte-for-byte on all content. Both claims are measured below; neither is inferred from the other.

4:2:2 and 12-bit are rejected by C SVT v4.2.0 itself, so they are not missing translations — they are alternate-backend work. 4:2:2, 12-bit and fractional adaptive effort are all rejected at the API.

Every gate named above is run in CI (.github/workflows/rust-gates.yml) and asserts one of two things: byte-identity with the C reference, or, where the port deliberately diverges from C's search, reconstruction identical to an independent decoder (dav1d/aomdec). The second is not weaker for the tools it covers — a motion-mode blend depends on neighbour state that is never re-transmitted, so only a decoder comparison can catch a wrong derivation. Gates that could pass vacuously carry an explicit anti-vacuity check and fail if they measured nothing.

The crates are not published to crates.io. Pin a reviewed Git revision:

[dependencies]
svtav1 = { package = "zenav1-svt", git = "https://github.com/imazen/zenav1-svt", rev = "0cbd1279f1e9e70ee62e051e56315e10f8b7f969" }

use svtav1::avif::AvifEncoder;
let pixels = vec![128u8; 16 * 16];
let encoded = AvifEncoder::new().with_quality(80.0).with_speed(6)
    .encode_y8(&pixels, 16, 16, 16).unwrap();
// encoded.data is an AV1 OBU sequence, not an AVIF container.

Use zenavif for RGB/RGBA conversion, AVIF still muxing and backend routing. The optional avif-container feature provides the all-intra animation API. Raw native-u16 inputs are available through EncodePipeline's HBD methods; do not infer a Gray16 zenavif entry point from that raw support.

Read the working guide and Rust rules. From rust/, run cargo nextest run --workspace --locked under the shared heavy-job wrapper. C-oracle tests need the reference/svt-av1 submodule and C build tools; product consumers do not. Mainline and HDR oracle builds are owned by the dev-only zenav1-svt-cref build script. Fresh-machine timing and portability acceptance remains tracked in issue #4.

Package/source map · full policy goal · documentation index and historical records.

The Rust port (rust/, and everything outside the submodule) is dual-licensed AGPL-3.0-only OR a commercial license — the standard Imazen "zen" model (same as zenavif et al.): LICENSE-AGPL3 / LICENSE-COMMERCIAL. Use it under the AGPL, or contact Imazen for a commercial license.

If someone covers Imazen's 2026 AI + server costs, we'll release the port under MIT or the original upstream license.

The SVT-AV1 C tree (the reference/svt-av1 submodule) keeps its upstream licensing: BSD-3-Clause-Clear plus the Alliance for Open Media Patent License 1.0 — see LICENSE.md / PATENTS.md inside the submodule. The Rust port is a derivative work of that BSD-licensed C source; its upstream attribution and patent terms are preserved, and relicensing the derivative is permitted by BSD-3-Clause-Clear.

• SVT-AV1 (Intel / Alliance for Open Media) — the battle-tested C encoder this port is built on
• svt-av1-hdr (juliobbv-p) — the perceptual/HDR feature set ported in fork mode
• rav1d — safe Rust AV1 decoder
• archmage — safe SIMD dispatch via CPU feature tokens