onnx-runtime-capi

The C ABI layer for the ORT 2.0 runtime (see docs/ORT2.md §21). This is Phase 1, Tier 1: a clean, direct extern "C" surface (nxrt_* names) that lets a C caller load a model, build input tensors, run inference, and read outputs back. It is a thin marshalling layer over [onnx_runtime_session] — nothing here is model-, op-, or shape-specific.

Phase 1 deliberately does not reproduce upstream ORT's OrtApi vtable (that is Phase 2's OrtGetApiBase, §21.2). There are no backward-compat shims.

Safety model

Every exported function that dereferences a caller pointer is unsafe-bodied and documents its preconditions. The rules, enforced uniformly:

• Opaque handles ([OrtSession], [OrtValue], [OrtStatus]) are created with [Box::into_raw] and freed with [Box::from_raw] exactly once by the matching nxrt_release_*. After release the caller must drop its copy of the pointer; reusing it is a use-after-free the API cannot detect (the standard C ownership contract). release is null-tolerant, so the idiomatic release(x); x = NULL; makes double-release unreachable.
• Null checks: every incoming handle/pointer is null-checked and turned into an [OrtErrorCode::InvalidArgument] status rather than dereferenced.
• No panics cross the boundary: every body runs inside [std::panic::catch_unwind]; a panic becomes an [OrtErrorCode::Fail] status instead of unwinding into C (which is undefined behavior).
• Status convention: fallible functions return *mut OrtStatus — null on success, an owned status the caller must [nxrt_release_status] on error.