E3-C-C-L1 four-language AI output label

core/aigc_output_label.py

@@ -0,0 +1,620 @@
+# -*- coding: utf-8 -*-
+"""Post-generation DOCX AI-content labeling for SmartPaper.
+
+This module deliberately operates only on an already-rendered DOCX package. It
+must not change the manuscript Markdown, generation prompts, translation logic,
+or academic content. The visible marker is ordinary editable Word text, while
+the implicit marker follows the OOXML custom-property pattern in TC260-PG-20258A.
+"""
+from __future__ import annotations
+
+import hashlib
+import io
+import json
+import os
+import zipfile
+import xml.etree.ElementTree as ET
+from copy import copy
+
+from lxml import etree
+
+
+VISIBLE_LABEL = "AI辅助生成内容"
+VISIBLE_LABELS = {
+    "zh": "AI辅助生成内容",
+    "en": "AI-Assisted Generated Content",
+    "ru": "Контент, созданный с помощью ИИ",
+    "kk": "ЖИ көмегімен жасалған мазмұн",
+}
+
+
+def visible_label_for_language(language_or_filename: str | None = None) -> str:
+    """Return SmartPaper's deterministic reader-facing AIGC marker.
+
+    This is intentionally a fixed product mapping, not a model/translation call.
+    It accepts either a language name/code or the final DOCX filename so the
+    post-generation packaging layer can localize the marker without touching
+    manuscript generation or translation. Unknown inputs retain the frozen
+    Chinese default for backward compatibility.
+    """
+    value = str(language_or_filename or "").strip().casefold()
+    if any(token in value for token in ("english", "paper_english", "_en.", " en ")) or value in {"en", "en-us", "en-gb"}:
+        return VISIBLE_LABELS["en"]
+    if any(token in value for token in ("russian", "рус", "paper_russian", "_ru.")) or value in {"ru", "ru-ru"}:
+        return VISIBLE_LABELS["ru"]
+    if any(token in value for token in ("kazakh", "қазақ", "paper_kazakh", "_kk.")) or value in {"kk", "kk-kz"}:
+        return VISIBLE_LABELS["kk"]
+    if any(token in value for token in ("chinese", "中文", "paper_chinese", "_zh.")) or value in {"zh", "zh-cn", "zh-hans"}:
+        return VISIBLE_LABELS["zh"]
+    return VISIBLE_LABEL
+AIGC_PROPERTY_NAME = "AIGC"
+CONTENT_PRODUCER = "SmartPaper"
+CONTENT_PRODUCER_ENV = "SMARTPAPER_AIGC_CONTENT_PRODUCER"
+
+_W_NS = "http://schemas.openxmlformats.org/wordprocessingml/2006/main"
+_CP_NS = "http://schemas.openxmlformats.org/officeDocument/2006/custom-properties"
+_VT_NS = "http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes"
+_REL_NS = "http://schemas.openxmlformats.org/package/2006/relationships"
+_CT_NS = "http://schemas.openxmlformats.org/package/2006/content-types"
+_CUSTOM_REL_TYPE = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties"
+_CUSTOM_CONTENT_TYPE = "application/vnd.openxmlformats-officedocument.custom-properties+xml"
+_CUSTOM_FMTID = "{D5CDD505-2E9C-101B-9397-08002B2CF9AE}"
+
+
+def _xml(data: bytes) -> etree._Element:
+    parser = etree.XMLParser(resolve_entities=False, no_network=True, remove_blank_text=False)
+    return etree.fromstring(data, parser=parser)
+
+
+def _serialize(root: etree._Element) -> bytes:
+    return etree.tostring(root, xml_declaration=True, encoding="UTF-8", standalone=True)
+
+
+def _paragraph_text(element: etree._Element) -> str:
+    return "".join(element.xpath(".//w:t/text()", namespaces={"w": _W_NS})).strip()
+
+
+def _append_visible_label(document_xml: bytes, label: str) -> bytes:
+    root = _xml(document_xml)
+    body = root.find(f"{{{_W_NS}}}body")
+    if body is None:
+        raise ValueError("DOCX word/document.xml has no w:body")
+
+    content_children = [child for child in body if child.tag != f"{{{_W_NS}}}sectPr"]
+    if content_children:
+        last = content_children[-1]
+        if last.tag == f"{{{_W_NS}}}p":
+            last_text = _paragraph_text(last)
+            if last_text == label:
+                return document_xml
+            # Deterministic relabeling: if a previous SmartPaper language marker
+            # is already the final paragraph, replace it rather than appending a
+            # second marker. Academic manuscript paragraphs are never touched.
+            if last_text in set(VISIBLE_LABELS.values()):
+                body.remove(last)
+
+    paragraph = etree.Element(f"{{{_W_NS}}}p")
+    run = etree.SubElement(paragraph, f"{{{_W_NS}}}r")
+    text = etree.SubElement(run, f"{{{_W_NS}}}t")
+    text.text = label
+
+    section = body.find(f"{{{_W_NS}}}sectPr")
+    if section is None:
+        body.append(paragraph)
+    else:
+        body.insert(body.index(section), paragraph)
+    return _serialize(root)
+
+
+def _content_id(original_docx: bytes) -> str:
+    return "SP-" + hashlib.sha256(original_docx).hexdigest()
+
+
+def _aigc_json(original_docx: bytes, producer: str) -> str:
+    produce_id = _content_id(original_docx)
+    payload = {
+        "Label": "1",
+        "ContentProducer": producer,
+        "ProduceID": produce_id,
+        "ReservedCode1": "",
+        "ContentPropagator": producer,
+        "PropagateID": produce_id,
+        "ReservedCode2": "",
+    }
+    return json.dumps(payload, ensure_ascii=False, separators=(",", ":"))
+
+
+def _upsert_custom_property(existing: bytes | None, value: str) -> bytes:
+    if existing:
+        root = _xml(existing)
+    else:
+        root = etree.Element(
+            f"{{{_CP_NS}}}Properties",
+            nsmap={None: _CP_NS, "vt": _VT_NS},
+        )
+
+    existing_props = root.findall(f"{{{_CP_NS}}}property")
+    for prop in list(existing_props):
+        if prop.get("name") == AIGC_PROPERTY_NAME:
+            root.remove(prop)
+
+    pids: list[int] = []
+    for prop in root.findall(f"{{{_CP_NS}}}property"):
+        try:
+            pids.append(int(prop.get("pid") or "0"))
+        except ValueError:
+            continue
+    pid = max([1, *pids]) + 1
+
+    prop = etree.SubElement(
+        root,
+        f"{{{_CP_NS}}}property",
+        fmtid=_CUSTOM_FMTID,
+        pid=str(pid),
+        name=AIGC_PROPERTY_NAME,
+    )
+    lpwstr = etree.SubElement(prop, f"{{{_VT_NS}}}lpwstr")
+    lpwstr.text = value
+    return _serialize(root)
+
+
+def _ensure_content_type(content_types_xml: bytes) -> bytes:
+    root = _xml(content_types_xml)
+    for override in root.findall(f"{{{_CT_NS}}}Override"):
+        if override.get("PartName") == "/docProps/custom.xml":
+            override.set("ContentType", _CUSTOM_CONTENT_TYPE)
+            return _serialize(root)
+    etree.SubElement(
+        root,
+        f"{{{_CT_NS}}}Override",
+        PartName="/docProps/custom.xml",
+        ContentType=_CUSTOM_CONTENT_TYPE,
+    )
+    return _serialize(root)
+
+
+def _ensure_relationship(rels_xml: bytes) -> bytes:
+    root = _xml(rels_xml)
+    for rel in root.findall(f"{{{_REL_NS}}}Relationship"):
+        if rel.get("Type") == _CUSTOM_REL_TYPE or rel.get("Target") == "docProps/custom.xml":
+            rel.set("Type", _CUSTOM_REL_TYPE)
+            rel.set("Target", "docProps/custom.xml")
+            return _serialize(root)
+
+    used = {rel.get("Id") for rel in root.findall(f"{{{_REL_NS}}}Relationship")}
+    index = 1
+    while f"rId{index}" in used:
+        index += 1
+    etree.SubElement(
+        root,
+        f"{{{_REL_NS}}}Relationship",
+        Id=f"rId{index}",
+        Type=_CUSTOM_REL_TYPE,
+        Target="docProps/custom.xml",
+    )
+    return _serialize(root)
+
+
+def _new_zipinfo(name: str, template: zipfile.ZipInfo | None = None) -> zipfile.ZipInfo:
+    if template is not None:
+        info = copy(template)
+        info.filename = name
+        return info
+    info = zipfile.ZipInfo(filename=name, date_time=(1980, 1, 1, 0, 0, 0))
+    info.compress_type = zipfile.ZIP_DEFLATED
+    return info
+
+
+def apply_aigc_output_label(
+    docx_bytes: bytes,
+    *,
+    visible_label: str = VISIBLE_LABEL,
+    content_producer: str | None = None,
+) -> bytes:
+    """Add visible and implicit AI labels to an already-rendered DOCX.
+
+    The operation is deterministic for the same rendered input and idempotent
+    with respect to the visible/custom-property label. It does not re-render the
+    manuscript through python-docx, which minimizes layout risk.
+    """
+    if not docx_bytes:
+        raise ValueError("DOCX bytes are empty")
+    label = str(visible_label or "").strip()
+    producer = str(
+        content_producer
+        or os.getenv(CONTENT_PRODUCER_ENV)
+        or os.getenv("SMARTPAPER_OPERATOR_NAME")
+        or CONTENT_PRODUCER
+    ).strip()
+    if not label:
+        raise ValueError("visible AI label is empty")
+    if not producer:
+        raise ValueError("AI content producer is empty")
+
+    with zipfile.ZipFile(io.BytesIO(docx_bytes), "r") as source:
+        bad = source.testzip()
+        if bad:
+            raise ValueError(f"source DOCX ZIP is corrupt at {bad}")
+        infos = {info.filename: info for info in source.infolist()}
+        required = {"word/document.xml", "[Content_Types].xml", "_rels/.rels"}
+        missing = required - set(infos)
+        if missing:
+            raise ValueError(f"source DOCX is missing required OOXML parts: {sorted(missing)}")
+        contents = {name: source.read(name) for name in infos}
+
+    contents["word/document.xml"] = _append_visible_label(contents["word/document.xml"], label)
+    contents["[Content_Types].xml"] = _ensure_content_type(contents["[Content_Types].xml"])
+    contents["_rels/.rels"] = _ensure_relationship(contents["_rels/.rels"])
+    contents["docProps/custom.xml"] = _upsert_custom_property(
+        contents.get("docProps/custom.xml"),
+        _aigc_json(docx_bytes, producer),
+    )
+
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as target:
+        for name, info in infos.items():
+            target.writestr(_new_zipinfo(name, info), contents[name])
+        if "docProps/custom.xml" not in infos:
+            template = infos.get("docProps/core.xml") or next(iter(infos.values()), None)
+            target.writestr(_new_zipinfo("docProps/custom.xml", template), contents["docProps/custom.xml"])
+    labeled = buffer.getvalue()
+    validate_aigc_output_label(labeled, expected_visible_label=label)
+    return labeled
+
+
+def read_aigc_metadata(docx_bytes: bytes) -> dict[str, str]:
+    with zipfile.ZipFile(io.BytesIO(docx_bytes), "r") as archive:
+        if "docProps/custom.xml" not in archive.namelist():
+            raise ValueError("DOCX has no docProps/custom.xml AIGC metadata")
+        root = _xml(archive.read("docProps/custom.xml"))
+        matches = [
+            prop for prop in root.findall(f"{{{_CP_NS}}}property")
+            if prop.get("name") == AIGC_PROPERTY_NAME
+        ]
+        if len(matches) != 1:
+            raise ValueError(f"DOCX must contain exactly one AIGC custom property, found {len(matches)}")
+        value = matches[0].find(f"{{{_VT_NS}}}lpwstr")
+        if value is None or not (value.text or "").strip():
+            raise ValueError("AIGC custom property has no lpwstr JSON value")
+        payload = json.loads(value.text)
+    if not isinstance(payload, dict):
+        raise ValueError("AIGC custom property JSON must be an object")
+    return {str(key): str(val) for key, val in payload.items()}
+
+
+def validate_aigc_output_label(docx_bytes: bytes, *, expected_visible_label: str = VISIBLE_LABEL) -> None:
+    with zipfile.ZipFile(io.BytesIO(docx_bytes), "r") as archive:
+        bad = archive.testzip()
+        if bad:
+            raise ValueError(f"labeled DOCX ZIP is corrupt at {bad}")
+        names = set(archive.namelist())
+        required = {"word/document.xml", "docProps/custom.xml", "[Content_Types].xml", "_rels/.rels"}
+        missing = required - names
+        if missing:
+            raise ValueError(f"labeled DOCX is missing required parts: {sorted(missing)}")
+
+        document = _xml(archive.read("word/document.xml"))
+        body = document.find(f"{{{_W_NS}}}body")
+        if body is None:
+            raise ValueError("labeled DOCX has no w:body")
+        content_children = [child for child in body if child.tag != f"{{{_W_NS}}}sectPr"]
+        if not content_children:
+            raise ValueError("labeled DOCX has no body content")
+        last = content_children[-1]
+        if last.tag != f"{{{_W_NS}}}p" or _paragraph_text(last) != expected_visible_label:
+            raise ValueError("visible AI label is not the final editable body paragraph")
+
+        content_types = _xml(archive.read("[Content_Types].xml"))
+        overrides = [
+            item for item in content_types.findall(f"{{{_CT_NS}}}Override")
+            if item.get("PartName") == "/docProps/custom.xml"
+        ]
+        if len(overrides) != 1 or overrides[0].get("ContentType") != _CUSTOM_CONTENT_TYPE:
+            raise ValueError("AIGC custom-property content type is missing or invalid")
+
+        rels = _xml(archive.read("_rels/.rels"))
+        relationships = [
+            rel for rel in rels.findall(f"{{{_REL_NS}}}Relationship")
+            if rel.get("Type") == _CUSTOM_REL_TYPE and rel.get("Target") == "docProps/custom.xml"
+        ]
+        if len(relationships) != 1:
+            raise ValueError("AIGC custom-property package relationship is missing or duplicated")
+
+    payload = read_aigc_metadata(docx_bytes)
+    required_fields = {
+        "Label", "ContentProducer", "ProduceID", "ReservedCode1",
+        "ContentPropagator", "PropagateID", "ReservedCode2",
+    }
+    if set(payload) != required_fields:
+        raise ValueError(f"AIGC metadata fields mismatch: {sorted(payload)}")
+    if payload["Label"] != "1":
+        raise ValueError("AIGC Label must be '1' for generated/synthetic content")
+    if not payload["ContentProducer"] or not payload["ProduceID"]:
+        raise ValueError("AIGC ContentProducer and ProduceID must be nonempty")
+    if payload["ContentPropagator"] != payload["ContentProducer"]:
+        raise ValueError("initial AIGC ContentPropagator must match ContentProducer")
+    if payload["PropagateID"] != payload["ProduceID"]:
+        raise ValueError("initial AIGC PropagateID must match ProduceID")
+
+
+# ---------------------------------------------------------------------------
+# Delivery-First deterministic fallback
+# ---------------------------------------------------------------------------
+# The primary implementation above intentionally uses lxml because it gives
+# strict namespace-aware OOXML handling.  This fallback is deliberately built
+# with Python's standard-library ElementTree + zipfile so a defect in the
+# primary XML path cannot, by itself, prevent delivery of an otherwise valid
+# rendered DOCX.
+
+
+def _et_qn(namespace: str, local: str) -> str:
+    return f"{{{namespace}}}{local}"
+
+
+def _fallback_paragraph_text(element: ET.Element) -> str:
+    values: list[str] = []
+    for item in element.iter(_et_qn(_W_NS, "t")):
+        if item.text:
+            values.append(item.text)
+    return "".join(values).strip()
+
+
+def _fallback_append_visible_label(document_xml: bytes, label: str) -> bytes:
+    root = ET.fromstring(document_xml)
+    body = root.find(_et_qn(_W_NS, "body"))
+    if body is None:
+        raise ValueError("DOCX word/document.xml has no w:body")
+    children = list(body)
+    content = [child for child in children if child.tag != _et_qn(_W_NS, "sectPr")]
+    if content:
+        last = content[-1]
+        if last.tag == _et_qn(_W_NS, "p"):
+            last_text = _fallback_paragraph_text(last)
+            if last_text == label:
+                return document_xml
+            if last_text in set(VISIBLE_LABELS.values()):
+                body.remove(last)
+    paragraph = ET.Element(_et_qn(_W_NS, "p"))
+    run = ET.SubElement(paragraph, _et_qn(_W_NS, "r"))
+    text = ET.SubElement(run, _et_qn(_W_NS, "t"))
+    text.text = label
+    section_index = next(
+        (idx for idx, child in enumerate(children) if child.tag == _et_qn(_W_NS, "sectPr")),
+        None,
+    )
+    if section_index is None:
+        body.append(paragraph)
+    else:
+        body.insert(section_index, paragraph)
+    return ET.tostring(root, encoding="utf-8", xml_declaration=True)
+
+
+def _fallback_upsert_custom_property(existing: bytes | None, value: str) -> bytes:
+    if existing:
+        root = ET.fromstring(existing)
+    else:
+        root = ET.Element(_et_qn(_CP_NS, "Properties"))
+    props = list(root.findall(_et_qn(_CP_NS, "property")))
+    for prop in props:
+        if prop.get("name") == AIGC_PROPERTY_NAME:
+            root.remove(prop)
+    pids: list[int] = []
+    for prop in root.findall(_et_qn(_CP_NS, "property")):
+        try:
+            pids.append(int(prop.get("pid") or "0"))
+        except ValueError:
+            pass
+    prop = ET.SubElement(
+        root,
+        _et_qn(_CP_NS, "property"),
+        {"fmtid": _CUSTOM_FMTID, "pid": str(max([1, *pids]) + 1), "name": AIGC_PROPERTY_NAME},
+    )
+    node = ET.SubElement(prop, _et_qn(_VT_NS, "lpwstr"))
+    node.text = value
+    return ET.tostring(root, encoding="utf-8", xml_declaration=True)
+
+
+def _fallback_ensure_content_type(content_types_xml: bytes) -> bytes:
+    root = ET.fromstring(content_types_xml)
+    matches = [
+        node for node in root.findall(_et_qn(_CT_NS, "Override"))
+        if node.get("PartName") == "/docProps/custom.xml"
+    ]
+    if matches:
+        matches[0].set("ContentType", _CUSTOM_CONTENT_TYPE)
+        for extra in matches[1:]:
+            root.remove(extra)
+    else:
+        ET.SubElement(
+            root,
+            _et_qn(_CT_NS, "Override"),
+            {"PartName": "/docProps/custom.xml", "ContentType": _CUSTOM_CONTENT_TYPE},
+        )
+    return ET.tostring(root, encoding="utf-8", xml_declaration=True)
+
+
+def _fallback_ensure_relationship(rels_xml: bytes) -> bytes:
+    root = ET.fromstring(rels_xml)
+    matches = [
+        node for node in root.findall(_et_qn(_REL_NS, "Relationship"))
+        if node.get("Type") == _CUSTOM_REL_TYPE or node.get("Target") == "docProps/custom.xml"
+    ]
+    if matches:
+        matches[0].set("Type", _CUSTOM_REL_TYPE)
+        matches[0].set("Target", "docProps/custom.xml")
+        for extra in matches[1:]:
+            root.remove(extra)
+    else:
+        used = {node.get("Id") for node in root.findall(_et_qn(_REL_NS, "Relationship"))}
+        index = 1
+        while f"rId{index}" in used:
+            index += 1
+        ET.SubElement(
+            root,
+            _et_qn(_REL_NS, "Relationship"),
+            {"Id": f"rId{index}", "Type": _CUSTOM_REL_TYPE, "Target": "docProps/custom.xml"},
+        )
+    return ET.tostring(root, encoding="utf-8", xml_declaration=True)
+
+
+def apply_aigc_output_label_fallback(
+    docx_bytes: bytes,
+    *,
+    visible_label: str = VISIBLE_LABEL,
+    content_producer: str | None = None,
+) -> bytes:
+    """Independent stdlib-only OOXML fallback for an already-rendered DOCX."""
+    if not docx_bytes:
+        raise ValueError("DOCX bytes are empty")
+    label = str(visible_label or "").strip()
+    producer = str(
+        content_producer
+        or os.getenv(CONTENT_PRODUCER_ENV)
+        or os.getenv("SMARTPAPER_OPERATOR_NAME")
+        or CONTENT_PRODUCER
+    ).strip()
+    if not label or not producer:
+        raise ValueError("AI label/producer is empty")
+    with zipfile.ZipFile(io.BytesIO(docx_bytes), "r") as source:
+        bad = source.testzip()
+        if bad:
+            raise ValueError(f"source DOCX ZIP is corrupt at {bad}")
+        infos = {info.filename: info for info in source.infolist()}
+        required = {"word/document.xml", "[Content_Types].xml", "_rels/.rels"}
+        missing = required - set(infos)
+        if missing:
+            raise ValueError(f"source DOCX is missing required OOXML parts: {sorted(missing)}")
+        contents = {name: source.read(name) for name in infos}
+    contents["word/document.xml"] = _fallback_append_visible_label(contents["word/document.xml"], label)
+    contents["[Content_Types].xml"] = _fallback_ensure_content_type(contents["[Content_Types].xml"])
+    contents["_rels/.rels"] = _fallback_ensure_relationship(contents["_rels/.rels"])
+    contents["docProps/custom.xml"] = _fallback_upsert_custom_property(
+        contents.get("docProps/custom.xml"), _aigc_json(docx_bytes, producer)
+    )
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as target:
+        for name, info in infos.items():
+            target.writestr(_new_zipinfo(name, info), contents[name])
+        if "docProps/custom.xml" not in infos:
+            template = infos.get("docProps/core.xml") or next(iter(infos.values()), None)
+            target.writestr(_new_zipinfo("docProps/custom.xml", template), contents["docProps/custom.xml"])
+    labeled = buffer.getvalue()
+    validate_aigc_output_label_fallback(labeled, expected_visible_label=label)
+    return labeled
+
+
+def validate_aigc_output_label_fallback(
+    docx_bytes: bytes, *, expected_visible_label: str = VISIBLE_LABEL
+) -> None:
+    """Stdlib-only validation paired with the deterministic fallback writer."""
+    with zipfile.ZipFile(io.BytesIO(docx_bytes), "r") as archive:
+        bad = archive.testzip()
+        if bad:
+            raise ValueError(f"labeled DOCX ZIP is corrupt at {bad}")
+        names = set(archive.namelist())
+        required = {"word/document.xml", "docProps/custom.xml", "[Content_Types].xml", "_rels/.rels"}
+        missing = required - names
+        if missing:
+            raise ValueError(f"labeled DOCX is missing required parts: {sorted(missing)}")
+        document = ET.fromstring(archive.read("word/document.xml"))
+        body = document.find(_et_qn(_W_NS, "body"))
+        if body is None:
+            raise ValueError("labeled DOCX has no w:body")
+        content = [child for child in list(body) if child.tag != _et_qn(_W_NS, "sectPr")]
+        if not content or content[-1].tag != _et_qn(_W_NS, "p"):
+            raise ValueError("visible AI label is not the final editable body paragraph")
+        if _fallback_paragraph_text(content[-1]) != expected_visible_label:
+            raise ValueError("visible AI label text mismatch")
+        custom = ET.fromstring(archive.read("docProps/custom.xml"))
+        props = [
+            node for node in custom.findall(_et_qn(_CP_NS, "property"))
+            if node.get("name") == AIGC_PROPERTY_NAME
+        ]
+        if len(props) != 1:
+            raise ValueError(f"DOCX must contain exactly one AIGC custom property, found {len(props)}")
+        value = props[0].find(_et_qn(_VT_NS, "lpwstr"))
+        if value is None or not (value.text or "").strip():
+            raise ValueError("AIGC custom property has no JSON value")
+        payload = json.loads(value.text)
+        content_types = ET.fromstring(archive.read("[Content_Types].xml"))
+        overrides = [
+            node for node in content_types.findall(_et_qn(_CT_NS, "Override"))
+            if node.get("PartName") == "/docProps/custom.xml"
+            and node.get("ContentType") == _CUSTOM_CONTENT_TYPE
+        ]
+        if len(overrides) != 1:
+            raise ValueError("AIGC custom-property content type is missing or duplicated")
+        rels = ET.fromstring(archive.read("_rels/.rels"))
+        relationships = [
+            node for node in rels.findall(_et_qn(_REL_NS, "Relationship"))
+            if node.get("Type") == _CUSTOM_REL_TYPE and node.get("Target") == "docProps/custom.xml"
+        ]
+        if len(relationships) != 1:
+            raise ValueError("AIGC custom-property package relationship is missing or duplicated")
+    required_fields = {
+        "Label", "ContentProducer", "ProduceID", "ReservedCode1",
+        "ContentPropagator", "PropagateID", "ReservedCode2",
+    }
+    if not isinstance(payload, dict) or set(payload) != required_fields:
+        raise ValueError("AIGC metadata fields mismatch")
+    if str(payload.get("Label")) != "1":
+        raise ValueError("AIGC Label must be '1'")
+    if not str(payload.get("ContentProducer") or "") or not str(payload.get("ProduceID") or ""):
+        raise ValueError("AIGC ContentProducer and ProduceID must be nonempty")
+    if payload.get("ContentPropagator") != payload.get("ContentProducer"):
+        raise ValueError("initial AIGC ContentPropagator must match ContentProducer")
+    if payload.get("PropagateID") != payload.get("ProduceID"):
+        raise ValueError("initial AIGC PropagateID must match ProduceID")
+
+
+def ensure_aigc_output_label(
+    docx_bytes: bytes,
+    *,
+    visible_label: str = VISIBLE_LABEL,
+    content_producer: str | None = None,
+) -> bytes:
+    """Primary label path with an independent deterministic fallback.
+
+    A failure in the primary lxml writer/validator is treated as an OUTPUT_BUILD
+    recovery event, not as an immediate delivery failure.  Only if both the
+    primary and the stdlib fallback fail is the error allowed to propagate to
+    the existing safe-DOCX/recovery machinery.
+    """
+    try:
+        labeled = apply_aigc_output_label(
+            docx_bytes, visible_label=visible_label, content_producer=content_producer
+        )
+        validate_aigc_output_label(labeled, expected_visible_label=visible_label)
+        return labeled
+    except Exception as primary_error:
+        try:
+            labeled = apply_aigc_output_label_fallback(
+                docx_bytes, visible_label=visible_label, content_producer=content_producer
+            )
+            validate_aigc_output_label_fallback(labeled, expected_visible_label=visible_label)
+            return labeled
+        except Exception as fallback_error:
+            raise ValueError(
+                "AI output labeling failed in primary and deterministic fallback paths: "
+                f"primary={primary_error}; fallback={fallback_error}"
+            ) from fallback_error
+
+
+def validate_aigc_output_label_resilient(
+    docx_bytes: bytes, *, expected_visible_label: str = VISIBLE_LABEL
+) -> None:
+    """Validate with independent primary/fallback XML implementations."""
+    try:
+        validate_aigc_output_label(docx_bytes, expected_visible_label=expected_visible_label)
+        return
+    except Exception as primary_error:
+        try:
+            validate_aigc_output_label_fallback(
+                docx_bytes, expected_visible_label=expected_visible_label
+            )
+            return
+        except Exception as fallback_error:
+            raise ValueError(
+                "AI output label validation failed in primary and fallback paths: "
+                f"primary={primary_error}; fallback={fallback_error}"
+            ) from fallback_error

core/production_guard.py

@@ -14,6 +14,11 @@ from docx import Document
 from docx.enum.section import WD_ORIENT
 from docx.oxml.ns import qn
 
+from core.aigc_output_label import (
+    ensure_aigc_output_label,
+    validate_aigc_output_label_resilient,
+    visible_label_for_language,
+)
 from utils.docx_builder import DocxBuildError, text_to_docx
 
 
@@ -838,6 +843,11 @@ def _build_zip_bytes(entries: dict[str, bytes]) -> bytes:
     return buffer.getvalue()
 
 
+def _aigc_visible_label_for_docx(filename: str) -> str:
+    """Resolve the fixed reader-facing marker from final DOCX identity only."""
+    return visible_label_for_language(filename)
+
+
 def _validate_zip_bytes(
     zip_bytes: bytes,
     *,
@@ -864,6 +874,12 @@ def _validate_zip_bytes(
             for name in (english_filename, translated_filename):
                 archived_docx = archive.read(name)
                 validate_docx_bytes(archived_docx)
+                try:
+                    validate_aigc_output_label_resilient(
+                        archived_docx, expected_visible_label=_aigc_visible_label_for_docx(name)
+                    )
+                except Exception as exc:
+                    raise OutputValidationError(f"Archived DOCX AI output label invalid: {exc}") from exc
                 if quantitative_manifest:
                     archived_markdown = english_markdown if name == english_filename else translated_markdown
                     validate_quantitative_table_contract(
@@ -904,8 +920,22 @@ def _validated_package_attempt(
     translated_docx = _render_delivery_docx(
         translated_markdown, qualitative_mode=qualitative_mode, safe_mode=safe_mode,
     )
+    # E3-B: label only the already-rendered delivery artifact. Manuscript
+    # Markdown, generation, translation and academic-content gates stay frozen.
+    try:
+        english_label = _aigc_visible_label_for_docx(english_filename)
+        translated_label = _aigc_visible_label_for_docx(translated_filename)
+        english_docx = ensure_aigc_output_label(english_docx, visible_label=english_label)
+        translated_docx = ensure_aigc_output_label(translated_docx, visible_label=translated_label)
+    except Exception as exc:
+        raise OutputValidationError(f"Post-generation AI output labeling failed: {exc}") from exc
     validate_docx_bytes(english_docx)
     validate_docx_bytes(translated_docx)
+    try:
+        validate_aigc_output_label_resilient(english_docx, expected_visible_label=english_label)
+        validate_aigc_output_label_resilient(translated_docx, expected_visible_label=translated_label)
+    except Exception as exc:
+        raise OutputValidationError(f"Post-generation AI output label validation failed: {exc}") from exc
 
     quantitative_manifest = (
         (data_metadata or {}).get("quantitative_table_manifest")
@@ -1088,21 +1118,33 @@ def build_recovery_package(
         raise OutputValidationError("Recovery package requires a materially complete frozen English manuscript.")
     try:
         english_docx = _render_delivery_docx(english, qualitative_mode=False, safe_mode=True)
+        english_label = _aigc_visible_label_for_docx(english_filename)
+        english_docx = ensure_aigc_output_label(english_docx, visible_label=english_label)
         validate_docx_bytes(english_docx)
+        validate_aigc_output_label_resilient(english_docx, expected_visible_label=english_label)
     except Exception:
         english_docx = _plain_recovery_docx(english)
+        english_label = _aigc_visible_label_for_docx(english_filename)
+        english_docx = ensure_aigc_output_label(english_docx, visible_label=english_label)
         validate_docx_bytes(english_docx)
+        validate_aigc_output_label_resilient(english_docx, expected_visible_label=english_label)
 
     entries: dict[str, bytes] = {english_filename: english_docx}
     target = str(translated_markdown or "").strip()
     if len(target) >= 800:
         try:
             target_docx = _render_delivery_docx(target, qualitative_mode=False, safe_mode=True)
+            target_label = _aigc_visible_label_for_docx(translated_filename)
+            target_docx = ensure_aigc_output_label(target_docx, visible_label=target_label)
             validate_docx_bytes(target_docx)
+            validate_aigc_output_label_resilient(target_docx, expected_visible_label=target_label)
         except Exception:
             try:
                 target_docx = _plain_recovery_docx(target)
+                target_label = _aigc_visible_label_for_docx(translated_filename)
+                target_docx = ensure_aigc_output_label(target_docx, visible_label=target_label)
                 validate_docx_bytes(target_docx)
+                validate_aigc_output_label_resilient(target_docx, expected_visible_label=target_label)
             except Exception:
                 target_docx = b""
         if target_docx:
@@ -1127,7 +1169,17 @@ def build_recovery_package(
                 bad = archive.testzip()
                 if bad:
                     raise OutputValidationError(f"Recovery ZIP integrity failed at {bad}.")
-                validate_docx_bytes(archive.read(english_filename))
+                archived_english = archive.read(english_filename)
+                validate_docx_bytes(archived_english)
+                validate_aigc_output_label_resilient(
+                    archived_english, expected_visible_label=_aigc_visible_label_for_docx(english_filename)
+                )
+                if translated_filename in archive.namelist():
+                    archived_target = archive.read(translated_filename)
+                    validate_docx_bytes(archived_target)
+                    validate_aigc_output_label_resilient(
+                        archived_target, expected_visible_label=_aigc_visible_label_for_docx(translated_filename)
+                    )
             return PackageResult(
                 zip_bytes=zip_bytes,
                 file_names=tuple(sorted(entries)),