Is there a signed, supported Windows distribution of python-rapidjson 1.25, or a recommended vendor-supported way to resolve this Smart App Control compatibility issue while keeping Windows protection enabled?

Environment: Windows with Smart App Control enabled; CPython 3.12.14 x64. Exact Windows build has not been collected for this report.

Package: official PyPI python-rapidjson 1.25, CPython 3.12 Windows amd64 wheel.
Release: https://pypi.org/project/python-rapidjson/1.25/
Wheel SHA256: ca7f24b8547937015c38f77b193122fdc663c91645de04b21d4558af84d79e68
Extension: rapidjson.cp312-win_amd64.pyd
Extension SHA256: 19b52fe1a5474ac46353748f93dd29bda2d910a6eafb89081522cd3907b964fa
Bundled companion: msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
Companion SHA256: a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde

Both official package members were retained unchanged in an isolated compatibility directory. A bounded isolated import and JSON compatibility test passed on October 19, 2026. A later attempt on October 20 failed during import before the application tests ran:

ImportError: DLL load failed while importing rapidjson: An Application Control policy has blocked this file.

Windows CodeIntegrity events 3077 and 3033 identify the extension as failing signing-level/code-integrity requirements. Policy ID: 0283ac0f-fff1-49ae-ada1-8a933130cad6, matching the local SmartAppControl example policy. The read-only VerifiedAndReputablePolicyState value is 1. The earlier successful import does not establish current policy admission; the reason for the change is unknown.

We have not disabled protection, changed policies, unblocked or modified binaries, renamed or relocated the rejected extension, or retried it in another permission context. We are not requesting a bypass or instructions to weaken protection. We would appreciate guidance about an appropriately signed official build or other supported resolution.

This request intentionally excludes local usernames and filesystem paths, project source code, account or financial records, credentials, saved chats, screenshots, and binary attachments. The hashes identify publicly distributed package files only.