{ "row": "c2pa-conformance", "entity": "c2pa-conformance", "address": "C2PA Conformance Program", "addresses": [ { "address": "C2PA Conformance Program", "slug": "c2pa-conformance-program-aio-20261029", "addr_id": "ADDR-c597ce64430f", "obs_id": "OBS-47bccd9af209", "axn": "AXN:0ACC.CAPTURE.♊🌇🧫⚖️🪜🔭" } ], "epoch": "2026-10-29", "type": "C (public entity on which the archive bears: a conformance program and its registry of conforming products and trust lists; an entity of the provenance meta-aggregator)", "surface": "Google AI Overview (expanded)", "auth": "signed out, incognito", "status": { "procedure": "EA-NEGONT-02 v0.9, #1690: equal case, ρ = extends, read from the provenance census record, the capture record and #725's statement of relation; archive selected by D/R/O (25 deposits admitted by reading, 18 with claims and 7 grouped as instances; hop of 263 candidates over 246 deposits screened and read at their hits, 1 admitted), with the census record (22 claims) and the Capture Registry's findings, analysis, reading and query note (10 claims) ledgered as the archive's records of the entity; the field B by three origins (8 cards, 2 own pages, 3 Wikipedia sources; no census third-party source); the composer read the ledgers, never the transcript, except where the brief asks for T's claims and the delta", "ledger": "unaudited (§3.8: one extractor per ledger); field quotes 67/67 verified by script against the saved texts, the Explorer bundle's UI text, the data file, the Wikipedia responses or the card text; archive quotes 71/71 verified against the deposit texts, data/EA-WG-CAPTURES-01.json and census.json", "frozen": false, "breaches": [] }, "spec": "EA-NEGONT-02 v0.9, #1690", "objects": { "T": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/T1-c2pa-conformance-program-aio-20261029.txt", "sha256": "169f414acf8186da1eb629a9e52ca525987bef7d4dc2ae31ced67386cd1a0a2c", "words": 193, "cards": 8, "words_note": "one transcript at one address (193 words in the answer body with its closer, links reduced to their text, markers and the card rail excluded; 8 cards)", "claims": [ "T1-1 definition: 'a risk-based governance and verification framework run by the Coalition for Content Provenance and Authenticity to ensure hardware and software products properly implement the Content Credentials specification' (markers 1, 2)", "T1-2 conforming products list: 'Verified generator and validator products are publicly listed on the C2PA Conformance Explorer.'", "T1-3 generator products: 'Software or hardware tools that create asset manifests, apply assertions, and sign content using X.509 certificates (categorized by Level 1 or Level 2 assurance levels).'", "T1-4 validator products: 'Applications or services that read, check, and verify manifest stores and cryptographic signatures.'", "T1-5 certificate authorities: 'Entities that issue claim-signing certificates conforming to C2PA policy and the official Trust List.' (markers 1–5)", "T1-6 evaluation process: 'Applicants submit an expression of interest, sign legal agreements, provide technical evidence, and run self-test tools against program requirements.' (markers 1, 2)", "T1-7 trust and security: 'Only conforming generator products can receive production claim-signing certificates from approved CAs, creating end-to-end tamper evidence for digital media.' (markers 1, 2)", "T1-8 closer: 'If you want, I can help you:' and three offers (look up vendors on the list; explain Level 1 and Level 2; detail how to submit a product)" ], "register": { "register": "data/EA-WG-CAPTURES-01.json", "slug": "c2pa-conformance-program-aio-20261029", "obs_id": "OBS-47bccd9af209" }, "transcripts": [ { "slug": "c2pa-conformance-program-aio-20261029", "address": "C2PA Conformance Program", "addr_id": "ADDR-c597ce64430f", "obs_id": "OBS-47bccd9af209", "axn": "AXN:0ACC.CAPTURE.♊🌇🧫⚖️🪜🔭", "date": "2026-10-29", "surface": "Google AI Overview (expanded)", "auth": "signed out, incognito", "sha256": "169f414acf8186da1eb629a9e52ca525987bef7d4dc2ae31ced67386cd1a0a2c", "sha256_of": "the registry's 'transcript' string (utf-8)", "sha256_raw": "338495e74439a4c5756d1b952d4d7bb335dbf492a4a6770cbe2301f0945fbe66", "words": 193, "cards": 8, "card_rail": [ "1. Coalition for Content Provenance and Authenticity (C2PA) — Conformance - C2PA", "2. Content Authenticity Initiative — C2PA conformance program | Open-source tools for content authenticity and provenance", "3. Content Authenticity Initiative — Raising the bar for trust: introducing the C2PA Conformance Program", "4. C2PA Specifications — C2PA Conformance Explorer", "5. SSL.com — How to Submit to the C2PA Conformance Program", "6. Coalition for Content Provenance and Authenticity (C2PA) — C2PA FAQ", "7. trufo.ai — C2PA Conformance Program - Trufo", "8. LinkedIn·Scott Perry — C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn" ], "claims": [ "T1-1 definition: 'a risk-based governance and verification framework run by the Coalition for Content Provenance and Authenticity to ensure hardware and software products properly implement the Content Credentials specification' (markers 1, 2)", "T1-2 conforming products list: 'Verified generator and validator products are publicly listed on the C2PA Conformance Explorer.'", "T1-3 generator products: 'Software or hardware tools that create asset manifests, apply assertions, and sign content using X.509 certificates (categorized by Level 1 or Level 2 assurance levels).'", "T1-4 validator products: 'Applications or services that read, check, and verify manifest stores and cryptographic signatures.'", "T1-5 certificate authorities: 'Entities that issue claim-signing certificates conforming to C2PA policy and the official Trust List.' (markers 1–5)", "T1-6 evaluation process: 'Applicants submit an expression of interest, sign legal agreements, provide technical evidence, and run self-test tools against program requirements.' (markers 1, 2)", "T1-7 trust and security: 'Only conforming generator products can receive production claim-signing certificates from approved CAs, creating end-to-end tamper evidence for digital media.' (markers 1, 2)", "T1-8 closer: 'If you want, I can help you:' and three offers (look up vendors on the list; explain Level 1 and Level 2; detail how to submit a product)" ], "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/T1-c2pa-conformance-program-aio-20261029.txt" } ] }, "KO": { "title": "The C2PA Conformance Program", "genre": "knowledge object, equal case, under EA-NEGONT-02 v0.9 (#1690): the archive's sources and the field's admitted on equal terms, ontology included, in one claim space", "status": "composed 2026-10-29 under v0.9 (briefs rebuild/negative-of-the-negative/v09/BRIEF-NEW-ROW-AGGREGATOR.md and BRIEF-NEW-ROW-PROVENANCE.md); not frozen; ledgers unaudited", "sentences": [ { "n": 1, "para": 0, "sense": "what it is", "text": "The C2PA Conformance Program is the Coalition for Content Provenance and Authenticity's program of assurance \"that products adhere to the Content Credentials specification, and fulfill a set of security requirements to ensure they are producing and validating C2PA data correctly\" (c2pa.org/conformance); its own document defines it as \"A risk-based governance program\" whose processes, policies and requirements designate generator and validator products as conforming products and certification authorities as adhering to the C2PA Certificate Policy (C2PA Conformance Program v0.2, §2.11), and the provenance census records it, with its Explorer, as a registry of the media lineage that expresses and records provenance (provenance census record).", "claims": [ "F1", "F36", "PE-01", "PE-04", "PE-03", "PE-05" ] }, { "n": 2, "para": 0, "sense": "what it is", "text": "The conformance page calls it \"a risk-based, transparent and unbiased governance process\" holding generator products, validator products and certification authorities accountable to the specification, the Certificate Policy and the Security Requirements (c2pa.org/conformance), the Content Authenticity Initiative's documentation lists the same three roles (CAI open-source docs), and Andy Parsons of the CAI likens it to the Bluetooth and Wi-Fi programs, \"baseline assurance for content provenance\" that validates an implementation \"correctly creates, signs, and reads C2PA manifests\" (CAI blog, 9 October 2025); the program document says why it exists: the specification \"is limited without a robust governance framework and conformance program\" giving relying parties transparency and governed parties accountability (v0.2, §1).", "claims": [ "F3", "F6", "F14", "F35" ] }, { "n": 3, "para": 1, "sense": "governance", "text": "It is part of a C2PA Governance Framework governed by the C2PA Steering Committee and administered by the C2PA Conformance Task Force (c2pa.org/conformance), a task force established in early-to-mid 2024 on the Trust over IP Governance Metamodel (Wikipedia, Content Credentials) and co-chaired by Parsons, Yogesh Deshpande (Arm) and Sherif Hanna (Google) (CAI blog); the program document has it \"administered by an independent Administrator who is free from conflicts of interest\" (v0.2, §6.6.3), and the census records its operator as the C2PA's Conformance Task Force, dependent on the Steering Committee, the Trust List, the TSA Trust List and the Certificate Policy (provenance census record); the coalition itself has no Wikipedia article of its own, its names redirecting to a section of the Content Authenticity Initiative article that gives it as \"an open, cross-industry technical standards body established on February 22, 2021\" (Wikipedia).", "claims": [ "F2", "F60", "F17", "F42", "PE-02", "PE-14", "F57", "F58" ] }, { "n": 4, "para": 2, "sense": "the unit", "text": "Its unit is the listed product: \"Conforming products are placed on a publicly-accessible list,\" which the operator says conveys confidence and \"guarantees interoperability\" (c2pa.org/conformance); the C2PA Conforming Products List is \"The canonical record of all Conforming Products,\" and because the generator product \"is always the Signer\" and always the listed entity, it is accountable for the conformance of the assets it generates (v0.2, §2.12, §2.26); the census gives the unit as \"a conforming generator or validator product, or a trust-list entry\" and the provenance object as a digital asset with its Content Credential, where \"the registry's own unit is the product or signer\" (provenance census record).", "claims": [ "F4", "F37", "F39", "PE-09", "PE-06" ] }, { "n": 5, "para": 2, "sense": "the unit", "text": "Acceptance adds a product to the list, which \"indicates it is compliant,\" and a conforming validator \"produces correct validation results\" (CAI open-source docs); the FAQ says listed products are \"vetted by the Administering Authority,\" \"providing visibility into which implementations are trusted,\" and that content signed by them can be expected to carry \"a higher level of implementation trust\" (C2PA FAQ); SSL.com says a listing \"signals to the broader ecosystem that your implementation is trustworthy, interoperable, and secure\" (SSL.com, 16 July 2026); and the C2PA reserves the right to remove applicants from the trust lists or revoke conformant status (v0.2, §6.7.3).", "claims": [ "F7", "F9", "F26", "F33", "F20", "F43" ] }, { "n": 6, "para": 3, "sense": "the trust chain", "text": "The program governs a chain of signing: \"Only instances of conforming Generator Products are eligible to receive C2PA Claim Signing Certificates from a Certification Authority on the C2PA Trust List\" (v0.2, §2.23); the Trust List is \"a curated list of Certification Authorities\" authorised to issue signing certificates only to products the program approved (C2PA FAQ); CAs that meet the certificate policy can be on it, and a conforming generator signs a claim \"using a valid X.509 certificate on the C2PA trust list\" (CAI open-source docs); CAs on it, SSL.com among them, \"can only issue production-grade Claim Signing Certificates to conforming products\" (SSL.com).", "claims": [ "F38", "F30", "F12", "F8", "F21" ] }, { "n": 7, "para": 3, "sense": "the trust chain", "text": "The census names the relations the chain carries as signing, creation and edit history (ingredients) and trust-list membership, and its carrier as \"signed C2PA manifests; the conformance lists as JSON\" (provenance census record); Parsons calls the standard, the tools, the conformance process and the trust model together \"a unified system for establishing digital provenance at scale\" (CAI blog).", "claims": [ "PE-07", "PE-08", "F16" ] }, { "n": 8, "para": 3, "sense": "the trust chain", "text": "#1443 reads the trust model the program governs from C2PA's own literature: trust \"extended to many entities by assumption and opt-in,\" \"validation is not required by the specification,\" coverage of the whole file not required, and \"trusted does not necessarily imply trustworthy\"; \"C2PA attests what a device reports having done,\" which \"requires trusting a chain of signers,\" where a content-derived identifier requires trusting SHA-256 (#1443, §6.1).", "claims": [ "D1443-01", "D1443-03" ] }, { "n": 9, "para": 3, "sense": "the trust chain", "text": "#1443 holds the two \"complementary rather than competing,\" a C2PA-signed capture that is also content-addressed and publicly witnessed being \"better evidenced than either alone,\" and calls P.Sapph.Obbink \"the human C2PA\": \"trust extended by assumption to a chain of signers one link deep; validation optional and unperformed\" (#1443, §6.1); #1409 sets the anchors side by side, C2PA \"in device and issuer certificates,\" the AXN regime \"in content derivation plus an archive's public ledger\" (#1409).", "claims": [ "D1443-04", "D1443-05", "D1409-04" ] }, { "n": 10, "para": 3, "sense": "the trust chain", "text": "#1444 adds that C2PA is \"structurally dependent on certificate authorities and platform adoption,\" its \"trust chains revocable by exactly the class of actor that issues terminations\" (#1444), the power of removal and revocation the program document reserves to the C2PA (v0.2, §6.7.3).", "claims": [ "D1444-01", "F43" ] }, { "n": 11, "para": 4, "sense": "assurance levels", "text": "Two assurance levels are in operation: a product's level \"indicates the level of confidence that claims it signs reflect its intended behavior,\" an instance's certificate may carry a level below the product's maximum (CAI open-source docs), and relying parties \"are advised to review and understand the implications\" of a level (v0.2, §5); Level 2 \"demands more rigorous security controls, including hardware-backed key storage and dynamic security evidence,\" while SSL.com's rule of thumb names level 1 for devices and \"at least level 1\" for cloud services (SSL.com); Google's Pixel 10 was the first device at the highest level (CAI blog), and the list's first record, Google's Pixel Camera, carries maximum level 2 by Android key attestation (Conforming Products List).", "claims": [ "F10", "F40", "F23", "F15", "F56" ] }, { "n": 12, "para": 5, "sense": "the process", "text": "Applicants sign a legal agreement with the C2PA, provide evidence and work with the program's staff (CAI open-source docs); the technical evaluation checks that manifests are properly formatted and certificates handled per the Certificate Policy, and a Conformance Letter makes the product eligible for a production claim-signing certificate from SSL.com or any approved CA on the Trust List (SSL.com).", "claims": [ "F11", "F22", "F24" ] }, { "n": 13, "para": 6, "sense": "origin and versions", "text": "The program was soft-launched in June 2025 at the Content Authenticity Summit at Cornell Tech and was \"fully up and running\" by October 2025 (CAI blog), Wikipedia giving 4 June 2025, a full public launch in October 2025 and the Interim Trust List deprecated on 31 December 2025 (Wikipedia, Content Credentials); its version table runs v0.1 from 2025-06-02 to its sunset on 2026-10-09, supporting specification v2.2, and v0.2 from 2026-07-31, sunset not set, supporting v2.2 and v2.4 (v0.2, Table 1), the document dated \"Version 0.2, 2026-07-31\" (v0.2, title page) and announced the same day on LinkedIn (Scott Perry, title and snippet only); the conformance page says it opened in June 2025 and is now v0.2 (c2pa.org/conformance), and the census records it active, \"program opened June 2025, now v0.2,\" read as program v0.2 and Explainer 2.4 on 2026-10-29 (provenance census record).", "claims": [ "F13", "F61", "F44", "F34", "F46", "F5", "PE-13", "PE-15" ] }, { "n": 14, "para": 7, "sense": "the Explorer and the count", "text": "The Conformance Explorer is the program's \"human-readable form of our public trust lists\" (v0.2, §6.6.8), where one may \"Browse, search, and filter the live versions\" of the Conforming Products List, the Trust List and the TSA Trust List, each product record giving its program version, maximum assurance level and supported media (Conformance Explorer); the census gives access as \"Conformance Explorer; JSON lists on GitHub\" (provenance census record).", "claims": [ "F45", "F18", "F19", "PE-12" ] }, { "n": 15, "para": 7, "sense": "the Explorer and the count", "text": "The JSON list held 286 records when the census read it (provenance census record; Capture Registry, 2026-10-29), every record conformant, 254 of them generator and 32 validator products, 11 generator products at maximum level 2 (Conforming Products List); Wikipedia's section says the Explorer indexes \"over 200 active products\" while 10 organizations have deployed products that both complete the program and are on the Trust List (Wikipedia, Content Credentials).", "claims": [ "PE-11", "CAP-1-05", "F55", "F63" ] }, { "n": 16, "para": 8, "sense": "what is signed", "text": "What a conforming product signs is a Content Credential: provenance, \"as C2PA defines it,\" is \"the facts about the history of a piece of digital content,\" and the Content Credential is \"a cryptographically bound structure that records an asset’s provenance\" (Explainer 2.4); the FAQ gives \"tamper-evident, cryptographically signed data structures that travel with the asset\" and says they are \"not a form of DRM\" (C2PA FAQ).", "claims": [ "F47", "F25", "F28" ] }, { "n": 17, "para": 8, "sense": "what is signed", "text": "In the archive's reading this is the artifact dimension of provenance: artifact provenance \"verifies that *this file* was created by *this source* at *this time*,\" necessary and operating \"at the moment of artifact creation\" (#725, §1.4), C2PA / Content Credentials being the \"Cryptographic signing of content creation events\" (#725, §4); \"C2PA tells you whether the artifact's signing event was real\" (#725, §11), \"C2PA verifies file history\" (#729), and it answers \"is this real?\" (#50); #127 says the manifest \"records authorship, edits, tool chain, and AI involvement\" (#127).", "claims": [ "D725-06", "D725-10", "D725-11", "D729-02", "D50-01", "D127-01" ] }, { "n": 18, "para": 9, "sense": "stated limits", "text": "C2PA states the governing limit itself: Content Credentials \"do not provide value judgments about whether a given set of provenance data is 'true',\" only whether it is well-formed, untampered, valid and trusted, trusted in that \"the signer of the Content Credential is associated with a known trust list,\" and \"provenance information alone cannot tell you whether the digital content is true, accurate or factual\" (Explainer 2.4); the census carries this as its first negative tag (provenance census record), the Wikipedia article as the distinction that \"a fabricated or misleading image can maintain a valid cryptographic credential\" (Wikipedia, Content Credentials), and the criticism that signing tools do not verify the accuracy of the metadata either (Wikipedia, Content Authenticity Initiative).", "claims": [ "F48", "F50", "PE-16", "F67", "F59" ] }, { "n": 19, "para": 9, "sense": "stated limits", "text": "#725 gives the mechanism with a case it attributes to Hacker Factor: \"cryptographically valid C2PA signatures can be applied to forged or AI-generated content,\" the signature verifying the signing event \"but does not verify the truth of what is signed,\" which it calls \"not a flaw of C2PA\" but \"a structural property of *all* signature-based systems\" (#725, §3.6); #1443 says C2PA cannot \"establish the truth of depicted content\" (#1443, §6.1).", "claims": [ "D725-08", "D725-09", "D1443-02" ] }, { "n": 20, "para": 9, "sense": "stated limits", "text": "On identity and authorship the sources state one limit at different grains: the core specification \"does not support attribution of content to individuals or organizations\" (C2PA FAQ) and \"does not directly address the topic of human or organizational identity\" (Explainer 2.4; the census's third negative tag, provenance census record); accreditation \"enables users to trust in that implementation,\" while trust in a credential's contents rests on the relationship of its creator and its consumer, which \"is not defined by the C2PA\" (Explainer 2.4); #729 reads it as \"C2PA prevents forgery; it does not constitute authorship,\" the signature telling \"what tool made it\" and not whether the human who used the tool is accountable (#729), and #1444 as securing \"the camera's testimony, not the author's\" (#1444).", "claims": [ "F32", "F52", "PE-18", "F54", "D729-04", "D729-03", "D1444-01" ] }, { "n": 21, "para": 9, "sense": "stated limits", "text": "Two archive statements stand against the FAQ's limit and are composed beside it: #127 has the manifest record \"authorship\" (#127), and #1003 groups C2PA among provenance and attribution studies that \"have focused on attribution loss in AI outputs\" (#1003); #784 reads the register in which \"Concerns that would be named *meaning* and *attribution* are governed here as *content authenticity* and *information integrity*\" (#784).", "claims": [ "F32", "D127-01", "D1003-01", "O784-01" ] }, { "n": 22, "para": 9, "sense": "stated limits", "text": "The chain of provenance is not whole: \"Provenance is not always complete,\" the metadata \"can be removed\" (Explainer 2.4), and manifests \"can be separated,\" soft bindings helping to rediscover them (C2PA FAQ); an ingredient's provenance \"cannot be verified in the same way\" as the containing asset's (Explainer 2.4; carried by the census as evidence, provenance census record), so that without its data \"only the presence of prior validation\" is confirmed (C2PA FAQ); #725 adds that ingredient assertions are \"optional, under-adopted,\" operating \"at the level of file derivation, not concept lineage\" (#725).", "claims": [ "F49", "F51", "F29", "F53", "PE-19", "F27", "D725-04" ] }, { "n": 23, "para": 10, "sense": "the program's own limit", "text": "The program bounds itself: of \"over 300 normative requirements\" on generator products it \"will eventually require\" complete conformance (v0.2, §6.1.1), and the census records that it tests no transformation, \"not tested here: conformance concerns producing and validating C2PA data correctly,\" leaving the trust-list entries and \"the latest specification version\" unchecked (provenance census record).", "claims": [ "F41", "PE-10", "PE-21" ] }, { "n": 24, "para": 11, "sense": "security", "text": "On security the sources conflict: the FAQ says tampering makes \"alterations immediately detectable\" and that faking credentials \"would require breaking current cryptographic standards\" (C2PA FAQ); Wikipedia reports that in October 2026 David Buchanan demonstrated a vulnerability allowing an image to be altered \"without invalidating its cryptographic signatures or trusted timestamps,\" and that in August 2026 on Android root access let the system sign fabricated images \"with valid authenticity signatures,\" which Google marked \"Won't fix (infeasible)\" (Wikipedia, Content Credentials), and the Content Authenticity Initiative article cites documented ways in which \"attackers can bypass C2PA’s safeguards\" (Wikipedia, Content Authenticity Initiative).", "claims": [ "F31", "F62", "F66", "F59" ] }, { "n": 25, "para": 12, "sense": "adoption", "text": "Adoption is partial: as of 2026 no dedicated camera and as of mid-2026 no desktop application had achieved compliance, Leica, Nikon and Canon standing outside the program (Wikipedia, Content Credentials); #725 found adoption \"uneven,\" verification interfaces \"nascent\" and \"the social infrastructure of trust\" still being built (#725), #499 that C2PA had not \"achieved sufficient adoption to function as infrastructure\" (#499, February 2026), and the census's neighbour IPTC Metawatch found 27 C2PA manifests in 6,580 news images in October 2026 (provenance census record).", "claims": [ "F64", "F65", "D725-03", "D499-01", "PE-20" ] }, { "n": 26, "para": 13, "sense": "the dimensions of provenance", "text": "#725 places what the program certifies among the dimensions of provenance: existing frameworks \"address the artifact (C2PA / Content Credentials) and the corpus\" and \"are not designed to address the survival of authorial lineage through AI synthesis\"; the dimensions are independent, \"a C2PA-signed image can carry meaning whose lineage has been eroded\"; its relation to C2PA is \"Extension and completion, not substitution or critique\" (#725); and #729 and #1386 add process provenance as a third dimension beside artifact provenance, which #729 marks \"Necessary, insufficient\" (#729; #1386).", "claims": [ "D725-01", "D725-05", "D725-02", "D729-01", "O1386-01" ] }, { "n": 27, "para": 13, "sense": "the dimensions of provenance", "text": "Past the artifact the archive finds no reach: a signed image whose caption a model rewrites without the photographer's name \"has lost semantic provenance even though artifact provenance is preserved\" (#725, §3.1); \"When a 5,000-word article becomes a 200-word AI Overview, C2PA cannot tell you what was lost\" (#615); for text on the open web it \"has no operational analogue that survives\" (#127); it \"Doesn't cover text, doesn't handle multi-step AI generation\" (#621); it does not address the reception consequences of provenance, attribution and disambiguation (#833); and it is a starting point for the public and machine-readable layers of attribution only (#95).", "claims": [ "D725-07", "D615-01", "D127-02", "D621-01", "D833-01", "D95-01" ] }, { "n": 28, "para": 14, "sense": "the archive's own artifacts", "text": "The archive meets the trust chain at its own artifacts: only conforming products receive certificates from Trust List CAs (SSL.com), and Google surfaces C2PA manifests \"(≥v2.1, Trust List CA)\" in About This Image (#1409); #1409 grades its handwritten artifacts self-signed, verifiable but not surfaced, as the floor, and Trust-List-signed, \"eligible for About This Image surfacing,\" where the toolchain permits, leaving open which toolchain is acceptable (#1409); earlier it listed C2PA as a standard its own provenance document complies with by serving \"as machine-readable provenance data\" (#208), planned a \"C2PA-compatible\" manifest layer (#204), and set its Non-Mutual Extraction Notice in the genre of \"C2PA provenance signals,\" honoured \"by reading, not by enforcement\" (#914).", "claims": [ "F21", "D1409-01", "R1409-02", "R1409-03", "R208-01", "R204-01", "R914-01" ] }, { "n": 29, "para": 15, "sense": "the record and the composition", "text": "The census asks of the program \"What provenance does this system carry, through which operation, on whose assertion, with what evidence of survival?\" and tags it \"NOT IPTC embedded metadata\" (provenance census record); at the name on Google's AI Overview on 2026-10-29 the composition \"says what the program certifies, who takes part, how a product is admitted and why admission matters for signing,\" the program \"composed as its applicants meet it: components and steps,\" its purpose the conformance page's (\"producing and validating C2PA data correctly\"), the products list its unit, v0.2 through the LinkedIn card, and the registry attributes \"'Risk-based governance'\" to Trufo's card (Capture Registry, 2026-10-29), where the card is the C2PA's own program document, whose glossary opens \"A risk-based governance program\" (v0.2, §2.11), and the conformance page has \"a risk-based, transparent and unbiased governance process\" (c2pa.org/conformance).", "claims": [ "PE-22", "PE-17", "CAP-1-10", "CAP-1-06", "CAP-1-01", "F1", "CAP-1-02", "F36", "F3" ] }, { "n": 30, "para": 15, "sense": "the record and the composition", "text": "The registry records the limit left out: the record's negative tags \"are C2PA's own\" (Explainer 2.4), the composition gives \"'end-to-end tamper evidence for digital media'\" and omits them, \"the half of the record that bears on provenance, does not reach the composition,\" and \"A reader leaves with tamper evidence and without the caveat that well-formed provenance can be false\"; the census record landed the same day \"and no card cites it\" (Capture Registry, 2026-10-29).", "claims": [ "CAP-1-03", "F48", "F52", "CAP-1-04", "CAP-1-07", "CAP-1-08", "CAP-1-09" ] } ], "joins": [ { "act": "order of senses", "sentences": "1–30", "claims": [], "note": "equal case (§4.7): the entity's dependency order, field and archive claims ordered together by genealogy within each sense; neither ledger placed first as a block. What it is (¶0) and its governance (¶1) precede its unit (¶2) and the chain of signing the unit enters (¶3), since the chain is of listed products; levels (¶4) and process (¶5) qualify the chain; origin (¶6) and the Explorer and count (¶7) date and number it; what is signed (¶8) precedes what the signature does not establish (¶9), the program's own bound (¶10), security (¶11) and adoption (¶12); the dimensions and reach (¶13) place the artifact layer among the archive's dimensions; the archive's own artifacts (¶14) and the records of the entity (¶15) stand last, as relations of the entity already composed." }, { "act": "holding apart (authorship)", "sentences": [ 20, 21 ], "claims": [ "F32", "F52", "D127-01", "D1003-01", "D729-04", "D1444-01" ], "note": "P_coh within one claim space: the operator's FAQ and Explainer say the core specification does not support attribution or address identity; #127 has the manifest record 'authorship' and #1003 groups C2PA with studies of 'attribution loss in AI outputs'; #729 and #1444 side with the operator. Each composed with its source; the composer does not rule (open block)." }, { "act": "holding apart (security)", "sentences": [ 24 ], "claims": [ "F31", "F62", "F66", "F59", "D725-08" ], "note": "P_coh across the field: the FAQ's 'infeasible' against the encyclopedia's reported demonstrations (attributed); F31 carried with the mark 'contested'. Evidence may lower force: the FAQ's claim is composed at its own grade with the contrary reports beside it; no source's standing enters." }, { "act": "holding together (the trust chain and its revocation)", "sentences": [ 10 ], "claims": [ "D1444-01", "F43" ], "note": "a coordinating act: #1444's 'trust chains revocable by exactly the class of actor that issues terminations' placed beside the program's own reservation of removal and revocation (§6.7.3); the join says the power #1444 names is the one the program document states, and no more." }, { "act": "holding together (the archive's own artifacts)", "sentences": [ 28 ], "claims": [ "F21", "D1409-01", "R1409-02" ], "note": "a coordinating act: SSL.com's 'only … to conforming products' placed as the ground of #1409's two grades; #1409 does not itself cite the program." }, { "act": "correction carried (the registry's attribution of 'risk-based governance')", "sentences": [ 29 ], "claims": [ "CAP-1-02", "F3", "F36" ], "note": "the registry's finding is carried as stated, with the conformance page's own phrase beside it; the defect is reported, not fixed (notes)." } ], "plan": { "order": [ "F1", "F36", "PE-01", "PE-04", "PE-03", "PE-05", "F3", "F6", "F14", "F35", "F2", "F60", "F17", "F42", "PE-02", "PE-14", "F57", "F58", "F4", "F37", "F39", "PE-09", "PE-06", "F7", "F9", "F26", "F33", "F20", "F43", "F38", "F30", "F12", "F8", "F21", "PE-07", "PE-08", "F16", "D1443-01", "D1443-03", "D1443-04", "D1443-05", "D1409-04", "D1444-01", "F10", "F40", "F23", "F15", "F56", "F11", "F22", "F24", "F13", "F61", "F44", "F34", "F46", "F5", "PE-13", "PE-15", "F45", "F18", "F19", "PE-12", "PE-11", "CAP-1-05", "F55", "F63", "F47", "F25", "F28", "D725-06", "D725-10", "D725-11", "D729-02", "D50-01", "D127-01", "F48", "F50", "PE-16", "F67", "F59", "D725-08", "D725-09", "D1443-02", "F32", "F52", "PE-18", "F54", "D729-04", "D729-03", "D1003-01", "O784-01", "F49", "F51", "F29", "F53", "PE-19", "F27", "D725-04", "F41", "PE-10", "PE-21", "F31", "F62", "F66", "F64", "F65", "D725-03", "D499-01", "PE-20", "D725-01", "D725-05", "D725-02", "D729-01", "O1386-01", "D725-07", "D615-01", "D127-02", "D621-01", "D833-01", "D95-01", "D1409-01", "R1409-02", "R1409-03", "R208-01", "R204-01", "R914-01", "PE-22", "PE-17", "CAP-1-10", "CAP-1-06", "CAP-1-01", "CAP-1-02", "CAP-1-03", "CAP-1-04", "CAP-1-07", "CAP-1-08", "CAP-1-09" ], "senses": { "what it is": [ 1, 2 ], "governance": [ 3 ], "the unit": [ 4, 5 ], "the trust chain": [ 6, 7, 8, 9, 10 ], "assurance levels": [ 11 ], "the process": [ 12 ], "origin and versions": [ 13 ], "the Explorer and the count": [ 14, 15 ], "what is signed": [ 16, 17 ], "stated limits": [ 18, 19, 20, 21, 22 ], "the program's own limit": [ 23 ], "security": [ 24 ], "adoption": [ 25 ], "the dimensions of provenance": [ 26, 27 ], "the archive's own artifacts": [ 28 ], "the record and the composition": [ 29, 30 ] }, "case_by_sense": { "equal (one claim space; nothing translated)": [ "what it is", "governance", "the unit", "the trust chain", "assurance levels", "the process", "origin and versions", "the Explorer and the count", "what is signed", "stated limits", "the program's own limit", "security", "adoption", "the dimensions of provenance", "the archive's own artifacts", "the record and the composition" ] }, "carried": { "archive": 71, "field": 67, "not_composed": {} }, "conflict_log": [ { "rule": "D_pres vs channel", "result": "no cut: the KO carries every field and archive claim; the compression's bound met (body 336 words) with no channel log" }, { "rule": "P_coh", "result": "F32/F52 against D127-01/D1003-01 (sentences 20–21) and F31 against F62/F66/F59 (sentence 24): both composed with their sources, opened in P.open" }, { "rule": "N_c", "result": "F31 carried at self-description with the mark 'contested' (evidence in B13, B12); no claim lowered for its source's standing" } ] } }, "P": { "title": "C2PA Conformance Program", "lede": { "text": "is the C2PA's program for Content Credentials products: generators, validators and certification authorities that conform go on public lists, and only conforming generators get signing certificates from Trust List CAs. It certifies correct production and validation of signed provenance, not its truth: C2PA's own Explainer says Content Credentials make no judgement of whether provenance is \"true\" (c2pa.org/conformance; v0.2; Explainer 2.4; #725; provenance census record).", "claims": [ "F1", "F36", "F38", "F48", "PE-01", "PE-16", "D725-06" ] }, "sections": [ { "icon": "🏛️", "head": "What it is", "items": [ { "label": "Governance:", "text": "a risk-based program of the C2PA Steering Committee, run by its Conformance Task Force (2024) through an independent Administrator.", "claims": [ "F3", "F2", "F60", "F17", "F42", "F35", "F6", "F14", "PE-02", "PE-14", "F57", "F58" ] }, { "label": "The unit:", "text": "the listed product; the generator product is always the signer (v0.2; census).", "claims": [ "F4", "F37", "F39", "F7", "F9", "F26", "F33", "F20", "F43", "PE-09", "PE-06", "PE-04", "PE-03", "PE-05" ] }, { "label": "Versions:", "text": "opened June 2025; v0.1 sunset 9 Oct 2026; v0.2 since 31 Jul 2026 (Table 1).", "claims": [ "F13", "F61", "F44", "F34", "F46", "F5", "PE-13", "PE-15" ] } ] }, { "icon": "🔗", "head": "The chain", "items": [ { "label": "Certificates:", "text": "Trust List CAs issue claim-signing certificates only to conforming generators (v0.2; FAQ; SSL.com).", "claims": [ "F38", "F30", "F12", "F8", "F21", "F16", "PE-07", "PE-08" ] }, { "label": "Levels:", "text": "1 and 2; level 2 needs hardware-backed keys; Pixel first at level 2. Entry: agreement, evidence, Conformance Letter.", "claims": [ "F10", "F40", "F23", "F15", "F56", "F11", "F22", "F24" ] }, { "label": "Trust model:", "text": "trust by assumption to a chain of signers, \"trusted does not necessarily imply trustworthy\" (#1443); chains revocable by those who issue terminations (#1444).", "claims": [ "D1443-01", "D1443-03", "D1443-04", "D1443-05", "D1409-04", "D1444-01" ] }, { "label": "The list:", "text": "286 conformant records, 254 generators (Explorer; census; JSON).", "claims": [ "F45", "F18", "F19", "PE-12", "PE-11", "CAP-1-05", "F55", "F63" ] } ] }, { "icon": "⚖️", "head": "What it does not establish", "items": [ { "label": "Truth:", "text": "valid signatures can sit on forged or AI-made content, a property of all signature systems (#725; Wikipedia).", "claims": [ "F50", "F67", "F59", "D725-08", "D725-09", "D1443-02", "F47", "F25", "F28", "D725-10", "D725-11", "D729-02", "D50-01" ] }, { "label": "Authorship:", "text": "no attribution or identity in the core spec (FAQ; Explainer); \"C2PA prevents forgery; it does not constitute authorship\" (#729). #127 and #1003 say otherwise.", "claims": [ "F32", "F52", "PE-18", "F54", "D729-04", "D729-03", "D127-01", "D1003-01", "O784-01" ] }, { "label": "Whole chains:", "text": "provenance can be incomplete, removed or separated; ingredients unverifiable (Explainer; FAQ).", "claims": [ "F49", "F51", "F29", "F53", "F27", "PE-19", "D725-04" ] }, { "label": "Full conformance:", "text": "\"will eventually\" be required (v0.2); no survival tested (census).", "claims": [ "F41", "PE-10", "PE-21" ] }, { "label": "Security:", "text": "the FAQ calls forgery infeasible; 2026 demonstrations altered and forged signed images (Wikipedia).", "claims": [ "F31", "F62", "F66" ] } ] }, { "icon": "🧭", "head": "Where it stops", "items": [ { "label": "Dimensions:", "text": "the artifact layer; lineage through AI synthesis is another dimension (#725, #729, #1386).", "claims": [ "D725-01", "D725-05", "D725-02", "D729-01", "O1386-01", "D725-06" ] }, { "label": "Reach:", "text": "no text analogue; cannot say what an AI Overview lost (#127, #615, #621).", "claims": [ "D725-07", "D615-01", "D127-02", "D621-01", "D833-01", "D95-01" ] }, { "label": "Adoption:", "text": "no conformant dedicated camera (Wikipedia); 27 manifests in 6,580 news images (census).", "claims": [ "F64", "F65", "D725-03", "D499-01", "PE-20" ] }, { "label": "The archive:", "text": "grades its artifacts self-signed or Trust-List-signed (#1409).", "claims": [ "D1409-01", "R1409-02", "R1409-03", "R208-01", "R204-01", "R914-01" ] }, { "label": "Here:", "text": "the Overview gave tamper evidence and dropped the limit (Capture Registry).", "claims": [ "CAP-1-10", "CAP-1-06", "CAP-1-01", "CAP-1-02", "CAP-1-03", "CAP-1-04", "CAP-1-07", "CAP-1-08", "CAP-1-09", "PE-22", "PE-17" ] } ] } ], "open": [ { "question": "Does Content Credentials record authorship?", "rests_on": [ "F32", "F52", "D127-01", "D1003-01", "D729-04", "D1444-01" ], "modality": "self-description (the operator's FAQ and Explainer) against interpretation (#127, #1003); #729 and #1444 side with the operator", "would_resolve": "the core specification's assertion list (v2.4) read for any authorship assertion outside the CAWG identity extension" }, { "question": "Is forging a valid credential infeasible, or demonstrated?", "rests_on": [ "F31", "F62", "F66", "F59", "D725-08" ], "modality": "self-description (C2PA FAQ) against attributed reports (Wikipedia citing Buchanan; #725 citing Hacker Factor)", "would_resolve": "Buchanan's and Hacker Factor's demonstrations read whole, and the C2PA's response in a specification erratum or program requirement" }, { "question": "When will complete conformance be required?", "rests_on": [ "F41", "PE-10" ], "modality": "self-description, prospective", "would_resolve": "a later program version whose requirements state complete conformance to the generator and validator requirements" }, { "question": "How many products conform: 286 records, over 200 products, or 10 organizations on both lists?", "rests_on": [ "F55", "PE-11", "CAP-1-05", "F63" ], "modality": "documented, different units (records, products, organizations)", "would_resolve": "the list re-counted by applicant and product against the Trust List at one date" }, { "question": "Did the program open on 2 June or 4 June 2025?", "rests_on": [ "F44", "F61", "F13", "F5", "PE-13" ], "modality": "documented, both (the version table's sunrise against the encyclopedia's soft launch)", "would_resolve": "the C2PA's announcement of the soft launch" }, { "question": "Which specification version is current?", "rests_on": [ "PE-15", "PE-21", "F44" ], "modality": "documented; the census leaves it unchecked", "would_resolve": "the C2PA specifications index (the saved Explainer's version menu lists 2.5 above 2.4)" }, { "question": "Opacity", "rests_on": [ "F46" ], "modality": "snippet only", "would_resolve": "Scott Perry's LinkedIn post (31 July 2026), unreachable: its URL could not be found" } ], "rail": [ { "lineage": "what it is: a conformance program for Content Credentials implementations", "claims": [ "F1", "F36", "F3", "F35", "F6", "F14" ], "earliest": "B3" }, { "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "claims": [ "F38", "F30", "F12", "F8", "F21", "F16" ], "earliest": "B3" }, { "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "claims": [ "F48", "PE-16", "F50", "F67", "D725-08", "D725-09", "D1443-02", "F32", "F52", "PE-18", "F54", "F49", "F51", "F29", "F53", "F27", "PE-19", "D725-04" ], "earliest": 725 }, { "lineage": "the census record: what the program carries, on whose assertion", "claims": [ "PE-01", "PE-06", "PE-04", "PE-03", "PE-05", "PE-07", "PE-08", "PE-10", "PE-21", "PE-22", "PE-17" ], "earliest": "provenance-census" }, { "lineage": "the artifact dimension: what a C2PA signature establishes", "claims": [ "D725-06", "D725-10", "D725-11", "D50-01", "D127-01" ], "earliest": 50 }, { "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "claims": [ "F2", "F17", "F42", "PE-02", "PE-14", "F58" ], "earliest": "B3" }, { "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "claims": [ "F60", "F13", "F61", "F44", "F34", "F46", "F5", "PE-13", "PE-15" ], "earliest": "B3" }, { "lineage": "reception: the encyclopedia", "claims": [ "F57" ], "earliest": "B11" }, { "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "claims": [ "F4", "F37", "F39", "F7", "F9", "F26", "F33", "F20", "F43", "PE-09" ], "earliest": "B5" }, { "lineage": "assurance levels 1 and 2", "claims": [ "F10", "F40", "F23", "F15", "F56" ], "earliest": "B3" }, { "lineage": "the process: expression of interest, legal agreement, evidence, approval", "claims": [ "F11", "F22", "F24" ], "earliest": "B5" }, { "lineage": "the trust model: trust extended to a chain of signers, revocable", "claims": [ "D1443-01", "D1443-03", "D1443-04", "D1443-05", "D1409-04" ], "earliest": 1409 }, { "lineage": "authorship: the signature attests the tool or device, not the author", "claims": [ "D1444-01", "D729-04", "D729-03", "D1003-01", "O784-01" ], "earliest": 729 }, { "lineage": "the Conformance Explorer and the machine-readable lists", "claims": [ "F45", "F18", "F19", "PE-12" ], "earliest": "B7" }, { "lineage": "count: 286 conforming product records", "claims": [ "PE-11", "F55" ], "earliest": "B10" }, { "lineage": "the composition at the address: the program as its applicants meet it", "claims": [ "CAP-1-05", "CAP-1-10", "CAP-1-06", "CAP-1-01", "CAP-1-02", "CAP-1-03", "CAP-1-04", "CAP-1-07", "CAP-1-08", "CAP-1-09" ], "earliest": "capture-registry" }, { "lineage": "adoption and its gaps", "claims": [ "F63", "F64", "F65", "D725-03", "D499-01", "PE-20" ], "earliest": 499 }, { "lineage": "security: tamper evidence asserted and its demonstrated breaks", "claims": [ "F59", "F31", "F62", "F66" ], "earliest": "B12" }, { "lineage": "what Content Credentials are: signed, tamper-evident provenance bound to the asset", "claims": [ "F47", "F25", "F28" ], "earliest": "B9" }, { "lineage": "the dimensions of provenance: artifact, licensing, semantic, process", "claims": [ "D729-02", "D725-01", "D725-05", "D725-02", "D729-01", "O1386-01" ], "earliest": 725 }, { "lineage": "stated limit of the program itself: complete conformance is not yet required", "claims": [ "F41" ], "earliest": "B7" }, { "lineage": "what the artifact layer does not reach: text, synthesis, the composition layer", "claims": [ "D725-07", "D615-01", "D127-02", "D621-01", "D833-01", "D95-01" ], "earliest": 615 }, { "lineage": "the archive's own artifacts and the C2PA path", "claims": [ "D1409-01", "R1409-02", "R1409-03", "R208-01", "R204-01", "R914-01" ], "earliest": 208 } ], "body_words": 336, "genre": "the compression: AIO's interaction grammar (lede, headed clusters, bolded labels, card rail), composed from the v0.9 plan in one claim space; it faces on the card, with AIO's transcript a record within it", "status": "composed 2026-10-29 from the v0.9 knowledge object; not frozen", "entity": "Composed under v0.9, equal case (ρ = extends): KO_B sentences surviving 0 of 12; every field claim carried." }, "P_B": { "title": "C2PA Conformance Program", "arm": "B (the field alone)", "genre": "popup — the compression from the field ledger alone (cards, own pages, Wikipedia)", "status": "composed 2026-10-29 from the field ledger alone; not frozen", "lede": { "text": "is the C2PA's risk-based governance program assuring that products produce and validate Content Credentials correctly: conforming generators and validators go on a public list, and only they receive signing certificates from Trust List CAs (c2pa.org/conformance; v0.2).", "claims": [ "F1", "F36", "F3", "F4", "F38" ] }, "sections": [ { "icon": "🏛️", "head": "What it is", "items": [ { "label": "Governance:", "text": "Steering Committee; Conformance Task Force; an independent Administrator.", "claims": [ "F2", "F60", "F17", "F42", "F6", "F14", "F35", "F57", "F58" ] }, { "label": "The list:", "text": "the canonical Conforming Products List, 286 records; the Explorer browses it.", "claims": [ "F37", "F39", "F7", "F9", "F26", "F33", "F20", "F43", "F45", "F18", "F19", "F55", "F63" ] }, { "label": "Versions:", "text": "June 2025; v0.2 since 31 July 2026.", "claims": [ "F13", "F61", "F44", "F34", "F46", "F5" ] } ] }, { "icon": "🔗", "head": "The chain", "items": [ { "label": "Certificates:", "text": "Trust List CAs issue only to conforming generators; levels 1 and 2.", "claims": [ "F30", "F12", "F8", "F21", "F16", "F10", "F40", "F23", "F15", "F56", "F11", "F22", "F24" ] } ] }, { "icon": "⚖️", "head": "Limits", "items": [ { "label": "Not truth:", "text": "Content Credentials do not judge whether provenance is true (Explainer).", "claims": [ "F48", "F50", "F67", "F47", "F25", "F28", "F54" ] }, { "label": "Not identity:", "text": "no attribution or identity in the core specification (FAQ; Explainer).", "claims": [ "F32", "F52" ] }, { "label": "Not whole:", "text": "incomplete, removable provenance; full conformance only eventually; 2026 forgeries demonstrated (Wikipedia).", "claims": [ "F49", "F51", "F29", "F53", "F27", "F41", "F31", "F62", "F66", "F59", "F64", "F65" ] } ] } ], "open": [ { "question": "Is forging a valid credential infeasible, or demonstrated?", "rests_on": [ "F31", "F62", "F66" ], "modality": "self-description against attributed reports", "would_resolve": "the demonstrations read whole" }, { "question": "Opacity", "rests_on": [ "F46" ], "modality": "snippet only", "would_resolve": "the LinkedIn post, unreachable" } ], "rail": [ { "lineage": "what it is: a conformance program for Content Credentials implementations", "claims": [ "F1", "F36", "F3", "F6", "F14", "F35" ], "earliest": "B3" }, { "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "claims": [ "F4", "F37", "F39", "F7", "F9", "F26", "F33", "F20", "F43" ], "earliest": "B5" }, { "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "claims": [ "F38", "F30", "F12", "F8", "F21", "F16" ], "earliest": "B3" }, { "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "claims": [ "F2", "F17", "F42", "F58" ], "earliest": "B3" }, { "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "claims": [ "F60", "F13", "F61", "F44", "F34", "F46", "F5" ], "earliest": "B3" }, { "lineage": "reception: the encyclopedia", "claims": [ "F57" ], "earliest": "B11" }, { "lineage": "the Conformance Explorer and the machine-readable lists", "claims": [ "F45", "F18", "F19" ], "earliest": "B7" }, { "lineage": "count: 286 conforming product records", "claims": [ "F55" ], "earliest": "B10" }, { "lineage": "adoption and its gaps", "claims": [ "F63", "F64", "F65" ], "earliest": "B13" }, { "lineage": "assurance levels 1 and 2", "claims": [ "F10", "F40", "F23", "F15", "F56" ], "earliest": "B3" }, { "lineage": "the process: expression of interest, legal agreement, evidence, approval", "claims": [ "F11", "F22", "F24" ], "earliest": "B5" }, { "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "claims": [ "F48", "F50", "F67", "F54", "F32", "F52", "F49", "F51", "F29", "F53", "F27" ], "earliest": "B13" }, { "lineage": "what Content Credentials are: signed, tamper-evident provenance bound to the asset", "claims": [ "F47", "F25", "F28" ], "earliest": "B9" }, { "lineage": "stated limit of the program itself: complete conformance is not yet required", "claims": [ "F41" ], "earliest": "B7" }, { "lineage": "security: tamper evidence asserted and its demonstrated breaks", "claims": [ "F31", "F62", "F66", "F59" ], "earliest": "B12" } ], "body_words": 120, "entity": "With no archive claim admitted, the entry is the program at its own pages' resolution and the encyclopedia's: what it certifies, the chain of signing, the limits its own Explainer and FAQ state, and the 2026 demonstrations Wikipedia reports." }, "KO_B": { "title": "The C2PA Conformance Program", "arm": "B (the field alone)", "genre": "knowledge object", "status": "composed 2026-10-29; not frozen", "sentences": [ { "n": 1, "para": 0, "text": "The C2PA Conformance Program gives assurance that products adhere to the Content Credentials specification and meet security requirements, producing and validating C2PA data correctly; it is a risk-based governance program designating generator and validator products as conforming and certification authorities as adhering to the Certificate Policy (c2pa.org/conformance; program document v0.2).", "claims": [ "F1", "F3", "F36", "F6", "F14", "F35" ] }, { "n": 2, "para": 0, "text": "It sits in the C2PA Governance Framework under the Steering Committee and is administered by the Conformance Task Force, set up in 2024 and co-chaired from the CAI, Arm and Google, through an independent Administrator (c2pa.org/conformance; Wikipedia; CAI blog; v0.2); the coalition, founded in 2021, has no article of its own on Wikipedia (Wikipedia).", "claims": [ "F2", "F60", "F17", "F42", "F57", "F58" ] }, { "n": 3, "para": 1, "text": "Conforming products go on a public list, the canonical Conforming Products List, where the generator product is always the signer and accountable for its assets, and the FAQ and SSL.com read a listing as visibility of trusted, interoperable and secure implementations, subject to removal or revocation (c2pa.org/conformance; v0.2; CAI docs; C2PA FAQ; SSL.com).", "claims": [ "F4", "F37", "F39", "F7", "F9", "F26", "F33", "F20", "F43" ] }, { "n": 4, "para": 1, "text": "Only conforming generator products may receive claim-signing certificates from CAs on the curated C2PA Trust List, signing claims with X.509 certificates, in what the CAI calls a unified system of standard, tools, conformance and trust model (v0.2; C2PA FAQ; CAI docs; SSL.com; CAI blog).", "claims": [ "F38", "F30", "F12", "F8", "F21", "F16" ] }, { "n": 5, "para": 1, "text": "There are two assurance levels, level 2 requiring hardware-backed keys and dynamic evidence, an instance's level possibly below the product's maximum; Google's Pixel 10 was first at the highest level (CAI docs; v0.2; SSL.com; CAI blog; Conforming Products List).", "claims": [ "F10", "F40", "F23", "F15", "F56" ] }, { "n": 6, "para": 1, "text": "Applicants sign a legal agreement, provide evidence, pass a technical evaluation and receive a Conformance Letter before a production certificate (CAI docs; SSL.com).", "claims": [ "F11", "F22", "F24" ] }, { "n": 7, "para": 2, "text": "It soft-launched in June 2025 and launched fully in October 2025; v0.1 ran from 2 June 2025 to 9 October 2026 and v0.2 began on 31 July 2026, supporting specifications 2.2 and 2.4 (CAI blog; Wikipedia; v0.2; Scott Perry; c2pa.org/conformance).", "claims": [ "F13", "F61", "F44", "F34", "F46", "F5" ] }, { "n": 8, "para": 2, "text": "The Conformance Explorer browses the live Conforming Products List, Trust List and TSA Trust List; the list held 286 conformant records, against Wikipedia's count of over 200 products and 10 organizations both conforming and on the Trust List (v0.2; Conformance Explorer; Conforming Products List; Wikipedia).", "claims": [ "F45", "F18", "F19", "F55", "F63" ] }, { "n": 9, "para": 3, "text": "What is signed is a Content Credential, a cryptographically bound, tamper-evident structure recording an asset's provenance, not DRM (Explainer 2.4; C2PA FAQ).", "claims": [ "F47", "F25", "F28" ] }, { "n": 10, "para": 3, "text": "Content Credentials do not judge whether provenance is true, only whether it is well-formed, untampered, valid and trusted; the core specification does not support attribution or address identity; provenance can be incomplete, removed or separated, and ingredients cannot be fully verified (Explainer 2.4; C2PA FAQ; Wikipedia).", "claims": [ "F48", "F50", "F67", "F32", "F52", "F54", "F49", "F51", "F29", "F53", "F27" ] }, { "n": 11, "para": 3, "text": "The program will only eventually require complete conformance to the specification's normative requirements (v0.2).", "claims": [ "F41" ] }, { "n": 12, "para": 4, "text": "The FAQ calls faking credentials infeasible, while Wikipedia reports demonstrated breaks in 2026 and criticism of bypasses; no dedicated camera or desktop application had achieved compliance (C2PA FAQ; Wikipedia).", "claims": [ "F31", "F62", "F66", "F59", "F64", "F65" ] } ] }, "L_B": { "words": 487, "text": "The C2PA Conformance Program gives assurance that products adhere to the Content Credentials specification and meet security requirements, producing and validating C2PA data correctly; it is a risk-based governance program designating generator and validator products as conforming and certification authorities as adhering to the Certificate Policy (c2pa.org/conformance; program document v0.2). It sits in the C2PA Governance Framework under the Steering Committee and is administered by the Conformance Task Force, set up in 2024 and co-chaired from the CAI, Arm and Google, through an independent Administrator (c2pa.org/conformance; Wikipedia; CAI blog; v0.2); the coalition, founded in 2021, has no article of its own on Wikipedia (Wikipedia). Conforming products go on a public list, the canonical Conforming Products List, where the generator product is always the signer and accountable for its assets, and the FAQ and SSL.com read a listing as visibility of trusted, interoperable and secure implementations, subject to removal or revocation (c2pa.org/conformance; v0.2; CAI docs; C2PA FAQ; SSL.com). Only conforming generator products may receive claim-signing certificates from CAs on the curated C2PA Trust List, signing claims with X.509 certificates, in what the CAI calls a unified system of standard, tools, conformance and trust model (v0.2; C2PA FAQ; CAI docs; SSL.com; CAI blog). There are two assurance levels, level 2 requiring hardware-backed keys and dynamic evidence, an instance's level possibly below the product's maximum; Google's Pixel 10 was first at the highest level (CAI docs; v0.2; SSL.com; CAI blog; Conforming Products List). Applicants sign a legal agreement, provide evidence, pass a technical evaluation and receive a Conformance Letter before a production certificate (CAI docs; SSL.com). It soft-launched in June 2025 and launched fully in October 2025; v0.1 ran from 2 June 2025 to 9 October 2026 and v0.2 began on 31 July 2026, supporting specifications 2.2 and 2.4 (CAI blog; Wikipedia; v0.2; Scott Perry; c2pa.org/conformance). The Conformance Explorer browses the live Conforming Products List, Trust List and TSA Trust List; the list held 286 conformant records, against Wikipedia's count of over 200 products and 10 organizations both conforming and on the Trust List (v0.2; Conformance Explorer; Conforming Products List; Wikipedia). What is signed is a Content Credential, a cryptographically bound, tamper-evident structure recording an asset's provenance, not DRM (Explainer 2.4; C2PA FAQ). Content Credentials do not judge whether provenance is true, only whether it is well-formed, untampered, valid and trusted; the core specification does not support attribution or address identity; provenance can be incomplete, removed or separated, and ingredients cannot be fully verified (Explainer 2.4; C2PA FAQ; Wikipedia). The program will only eventually require complete conformance to the specification's normative requirements (v0.2). The FAQ calls faking credentials infeasible, while Wikipedia reports demonstrated breaks in 2026 and criticism of bypasses; no dedicated camera or desktop application had achieved compliance (C2PA FAQ; Wikipedia).", "note": "L_F(B) is realized as the field arm's expansion (objects.KO_B): the field alone, cards, own pages and Wikipedia." }, "L_BA": { "words": 2793, "text": "The C2PA Conformance Program is the Coalition for Content Provenance and Authenticity's program of assurance \"that products adhere to the Content Credentials specification, and fulfill a set of security requirements to ensure they are producing and validating C2PA data correctly\" (c2pa.org/conformance); its own document defines it as \"A risk-based governance program\" whose processes, policies and requirements designate generator and validator products as conforming products and certification authorities as adhering to the C2PA Certificate Policy (C2PA Conformance Program v0.2, §2.11), and the provenance census records it, with its Explorer, as a registry of the media lineage that expresses and records provenance (provenance census record). The conformance page calls it \"a risk-based, transparent and unbiased governance process\" holding generator products, validator products and certification authorities accountable to the specification, the Certificate Policy and the Security Requirements (c2pa.org/conformance), the Content Authenticity Initiative's documentation lists the same three roles (CAI open-source docs), and Andy Parsons of the CAI likens it to the Bluetooth and Wi-Fi programs, \"baseline assurance for content provenance\" that validates an implementation \"correctly creates, signs, and reads C2PA manifests\" (CAI blog, 9 October 2025); the program document says why it exists: the specification \"is limited without a robust governance framework and conformance program\" giving relying parties transparency and governed parties accountability (v0.2, §1). It is part of a C2PA Governance Framework governed by the C2PA Steering Committee and administered by the C2PA Conformance Task Force (c2pa.org/conformance), a task force established in early-to-mid 2024 on the Trust over IP Governance Metamodel (Wikipedia, Content Credentials) and co-chaired by Parsons, Yogesh Deshpande (Arm) and Sherif Hanna (Google) (CAI blog); the program document has it \"administered by an independent Administrator who is free from conflicts of interest\" (v0.2, §6.6.3), and the census records its operator as the C2PA's Conformance Task Force, dependent on the Steering Committee, the Trust List, the TSA Trust List and the Certificate Policy (provenance census record); the coalition itself has no Wikipedia article of its own, its names redirecting to a section of the Content Authenticity Initiative article that gives it as \"an open, cross-industry technical standards body established on February 22, 2021\" (Wikipedia). Its unit is the listed product: \"Conforming products are placed on a publicly-accessible list,\" which the operator says conveys confidence and \"guarantees interoperability\" (c2pa.org/conformance); the C2PA Conforming Products List is \"The canonical record of all Conforming Products,\" and because the generator product \"is always the Signer\" and always the listed entity, it is accountable for the conformance of the assets it generates (v0.2, §2.12, §2.26); the census gives the unit as \"a conforming generator or validator product, or a trust-list entry\" and the provenance object as a digital asset with its Content Credential, where \"the registry's own unit is the product or signer\" (provenance census record). Acceptance adds a product to the list, which \"indicates it is compliant,\" and a conforming validator \"produces correct validation results\" (CAI open-source docs); the FAQ says listed products are \"vetted by the Administering Authority,\" \"providing visibility into which implementations are trusted,\" and that content signed by them can be expected to carry \"a higher level of implementation trust\" (C2PA FAQ); SSL.com says a listing \"signals to the broader ecosystem that your implementation is trustworthy, interoperable, and secure\" (SSL.com, 16 July 2026); and the C2PA reserves the right to remove applicants from the trust lists or revoke conformant status (v0.2, §6.7.3). The program governs a chain of signing: \"Only instances of conforming Generator Products are eligible to receive C2PA Claim Signing Certificates from a Certification Authority on the C2PA Trust List\" (v0.2, §2.23); the Trust List is \"a curated list of Certification Authorities\" authorised to issue signing certificates only to products the program approved (C2PA FAQ); CAs that meet the certificate policy can be on it, and a conforming generator signs a claim \"using a valid X.509 certificate on the C2PA trust list\" (CAI open-source docs); CAs on it, SSL.com among them, \"can only issue production-grade Claim Signing Certificates to conforming products\" (SSL.com). The census names the relations the chain carries as signing, creation and edit history (ingredients) and trust-list membership, and its carrier as \"signed C2PA manifests; the conformance lists as JSON\" (provenance census record); Parsons calls the standard, the tools, the conformance process and the trust model together \"a unified system for establishing digital provenance at scale\" (CAI blog). #1443 reads the trust model the program governs from C2PA's own literature: trust \"extended to many entities by assumption and opt-in,\" \"validation is not required by the specification,\" coverage of the whole file not required, and \"trusted does not necessarily imply trustworthy\"; \"C2PA attests what a device reports having done,\" which \"requires trusting a chain of signers,\" where a content-derived identifier requires trusting SHA-256 (#1443, §6.1). #1443 holds the two \"complementary rather than competing,\" a C2PA-signed capture that is also content-addressed and publicly witnessed being \"better evidenced than either alone,\" and calls P.Sapph.Obbink \"the human C2PA\": \"trust extended by assumption to a chain of signers one link deep; validation optional and unperformed\" (#1443, §6.1); #1409 sets the anchors side by side, C2PA \"in device and issuer certificates,\" the AXN regime \"in content derivation plus an archive's public ledger\" (#1409). #1444 adds that C2PA is \"structurally dependent on certificate authorities and platform adoption,\" its \"trust chains revocable by exactly the class of actor that issues terminations\" (#1444), the power of removal and revocation the program document reserves to the C2PA (v0.2, §6.7.3). Two assurance levels are in operation: a product's level \"indicates the level of confidence that claims it signs reflect its intended behavior,\" an instance's certificate may carry a level below the product's maximum (CAI open-source docs), and relying parties \"are advised to review and understand the implications\" of a level (v0.2, §5); Level 2 \"demands more rigorous security controls, including hardware-backed key storage and dynamic security evidence,\" while SSL.com's rule of thumb names level 1 for devices and \"at least level 1\" for cloud services (SSL.com); Google's Pixel 10 was the first device at the highest level (CAI blog), and the list's first record, Google's Pixel Camera, carries maximum level 2 by Android key attestation (Conforming Products List). Applicants sign a legal agreement with the C2PA, provide evidence and work with the program's staff (CAI open-source docs); the technical evaluation checks that manifests are properly formatted and certificates handled per the Certificate Policy, and a Conformance Letter makes the product eligible for a production claim-signing certificate from SSL.com or any approved CA on the Trust List (SSL.com). The program was soft-launched in June 2025 at the Content Authenticity Summit at Cornell Tech and was \"fully up and running\" by October 2025 (CAI blog), Wikipedia giving 4 June 2025, a full public launch in October 2025 and the Interim Trust List deprecated on 31 December 2025 (Wikipedia, Content Credentials); its version table runs v0.1 from 2025-06-02 to its sunset on 2026-10-09, supporting specification v2.2, and v0.2 from 2026-07-31, sunset not set, supporting v2.2 and v2.4 (v0.2, Table 1), the document dated \"Version 0.2, 2026-07-31\" (v0.2, title page) and announced the same day on LinkedIn (Scott Perry, title and snippet only); the conformance page says it opened in June 2025 and is now v0.2 (c2pa.org/conformance), and the census records it active, \"program opened June 2025, now v0.2,\" read as program v0.2 and Explainer 2.4 on 2026-10-29 (provenance census record). The Conformance Explorer is the program's \"human-readable form of our public trust lists\" (v0.2, §6.6.8), where one may \"Browse, search, and filter the live versions\" of the Conforming Products List, the Trust List and the TSA Trust List, each product record giving its program version, maximum assurance level and supported media (Conformance Explorer); the census gives access as \"Conformance Explorer; JSON lists on GitHub\" (provenance census record). The JSON list held 286 records when the census read it (provenance census record; Capture Registry, 2026-10-29), every record conformant, 254 of them generator and 32 validator products, 11 generator products at maximum level 2 (Conforming Products List); Wikipedia's section says the Explorer indexes \"over 200 active products\" while 10 organizations have deployed products that both complete the program and are on the Trust List (Wikipedia, Content Credentials). What a conforming product signs is a Content Credential: provenance, \"as C2PA defines it,\" is \"the facts about the history of a piece of digital content,\" and the Content Credential is \"a cryptographically bound structure that records an asset’s provenance\" (Explainer 2.4); the FAQ gives \"tamper-evident, cryptographically signed data structures that travel with the asset\" and says they are \"not a form of DRM\" (C2PA FAQ). In the archive's reading this is the artifact dimension of provenance: artifact provenance \"verifies that *this file* was created by *this source* at *this time*,\" necessary and operating \"at the moment of artifact creation\" (#725, §1.4), C2PA / Content Credentials being the \"Cryptographic signing of content creation events\" (#725, §4); \"C2PA tells you whether the artifact's signing event was real\" (#725, §11), \"C2PA verifies file history\" (#729), and it answers \"is this real?\" (#50); #127 says the manifest \"records authorship, edits, tool chain, and AI involvement\" (#127). C2PA states the governing limit itself: Content Credentials \"do not provide value judgments about whether a given set of provenance data is 'true',\" only whether it is well-formed, untampered, valid and trusted, trusted in that \"the signer of the Content Credential is associated with a known trust list,\" and \"provenance information alone cannot tell you whether the digital content is true, accurate or factual\" (Explainer 2.4); the census carries this as its first negative tag (provenance census record), the Wikipedia article as the distinction that \"a fabricated or misleading image can maintain a valid cryptographic credential\" (Wikipedia, Content Credentials), and the criticism that signing tools do not verify the accuracy of the metadata either (Wikipedia, Content Authenticity Initiative). #725 gives the mechanism with a case it attributes to Hacker Factor: \"cryptographically valid C2PA signatures can be applied to forged or AI-generated content,\" the signature verifying the signing event \"but does not verify the truth of what is signed,\" which it calls \"not a flaw of C2PA\" but \"a structural property of *all* signature-based systems\" (#725, §3.6); #1443 says C2PA cannot \"establish the truth of depicted content\" (#1443, §6.1). On identity and authorship the sources state one limit at different grains: the core specification \"does not support attribution of content to individuals or organizations\" (C2PA FAQ) and \"does not directly address the topic of human or organizational identity\" (Explainer 2.4; the census's third negative tag, provenance census record); accreditation \"enables users to trust in that implementation,\" while trust in a credential's contents rests on the relationship of its creator and its consumer, which \"is not defined by the C2PA\" (Explainer 2.4); #729 reads it as \"C2PA prevents forgery; it does not constitute authorship,\" the signature telling \"what tool made it\" and not whether the human who used the tool is accountable (#729), and #1444 as securing \"the camera's testimony, not the author's\" (#1444). Two archive statements stand against the FAQ's limit and are composed beside it: #127 has the manifest record \"authorship\" (#127), and #1003 groups C2PA among provenance and attribution studies that \"have focused on attribution loss in AI outputs\" (#1003); #784 reads the register in which \"Concerns that would be named *meaning* and *attribution* are governed here as *content authenticity* and *information integrity*\" (#784). The chain of provenance is not whole: \"Provenance is not always complete,\" the metadata \"can be removed\" (Explainer 2.4), and manifests \"can be separated,\" soft bindings helping to rediscover them (C2PA FAQ); an ingredient's provenance \"cannot be verified in the same way\" as the containing asset's (Explainer 2.4; carried by the census as evidence, provenance census record), so that without its data \"only the presence of prior validation\" is confirmed (C2PA FAQ); #725 adds that ingredient assertions are \"optional, under-adopted,\" operating \"at the level of file derivation, not concept lineage\" (#725). The program bounds itself: of \"over 300 normative requirements\" on generator products it \"will eventually require\" complete conformance (v0.2, §6.1.1), and the census records that it tests no transformation, \"not tested here: conformance concerns producing and validating C2PA data correctly,\" leaving the trust-list entries and \"the latest specification version\" unchecked (provenance census record). On security the sources conflict: the FAQ says tampering makes \"alterations immediately detectable\" and that faking credentials \"would require breaking current cryptographic standards\" (C2PA FAQ); Wikipedia reports that in October 2026 David Buchanan demonstrated a vulnerability allowing an image to be altered \"without invalidating its cryptographic signatures or trusted timestamps,\" and that in August 2026 on Android root access let the system sign fabricated images \"with valid authenticity signatures,\" which Google marked \"Won't fix (infeasible)\" (Wikipedia, Content Credentials), and the Content Authenticity Initiative article cites documented ways in which \"attackers can bypass C2PA’s safeguards\" (Wikipedia, Content Authenticity Initiative). Adoption is partial: as of 2026 no dedicated camera and as of mid-2026 no desktop application had achieved compliance, Leica, Nikon and Canon standing outside the program (Wikipedia, Content Credentials); #725 found adoption \"uneven,\" verification interfaces \"nascent\" and \"the social infrastructure of trust\" still being built (#725), #499 that C2PA had not \"achieved sufficient adoption to function as infrastructure\" (#499, February 2026), and the census's neighbour IPTC Metawatch found 27 C2PA manifests in 6,580 news images in October 2026 (provenance census record). #725 places what the program certifies among the dimensions of provenance: existing frameworks \"address the artifact (C2PA / Content Credentials) and the corpus\" and \"are not designed to address the survival of authorial lineage through AI synthesis\"; the dimensions are independent, \"a C2PA-signed image can carry meaning whose lineage has been eroded\"; its relation to C2PA is \"Extension and completion, not substitution or critique\" (#725); and #729 and #1386 add process provenance as a third dimension beside artifact provenance, which #729 marks \"Necessary, insufficient\" (#729; #1386). Past the artifact the archive finds no reach: a signed image whose caption a model rewrites without the photographer's name \"has lost semantic provenance even though artifact provenance is preserved\" (#725, §3.1); \"When a 5,000-word article becomes a 200-word AI Overview, C2PA cannot tell you what was lost\" (#615); for text on the open web it \"has no operational analogue that survives\" (#127); it \"Doesn't cover text, doesn't handle multi-step AI generation\" (#621); it does not address the reception consequences of provenance, attribution and disambiguation (#833); and it is a starting point for the public and machine-readable layers of attribution only (#95). The archive meets the trust chain at its own artifacts: only conforming products receive certificates from Trust List CAs (SSL.com), and Google surfaces C2PA manifests \"(≥v2.1, Trust List CA)\" in About This Image (#1409); #1409 grades its handwritten artifacts self-signed, verifiable but not surfaced, as the floor, and Trust-List-signed, \"eligible for About This Image surfacing,\" where the toolchain permits, leaving open which toolchain is acceptable (#1409); earlier it listed C2PA as a standard its own provenance document complies with by serving \"as machine-readable provenance data\" (#208), planned a \"C2PA-compatible\" manifest layer (#204), and set its Non-Mutual Extraction Notice in the genre of \"C2PA provenance signals,\" honoured \"by reading, not by enforcement\" (#914). The census asks of the program \"What provenance does this system carry, through which operation, on whose assertion, with what evidence of survival?\" and tags it \"NOT IPTC embedded metadata\" (provenance census record); at the name on Google's AI Overview on 2026-10-29 the composition \"says what the program certifies, who takes part, how a product is admitted and why admission matters for signing,\" the program \"composed as its applicants meet it: components and steps,\" its purpose the conformance page's (\"producing and validating C2PA data correctly\"), the products list its unit, v0.2 through the LinkedIn card, and the registry attributes \"'Risk-based governance'\" to Trufo's card (Capture Registry, 2026-10-29), where the card is the C2PA's own program document, whose glossary opens \"A risk-based governance program\" (v0.2, §2.11), and the conformance page has \"a risk-based, transparent and unbiased governance process\" (c2pa.org/conformance). The registry records the limit left out: the record's negative tags \"are C2PA's own\" (Explainer 2.4), the composition gives \"'end-to-end tamper evidence for digital media'\" and omits them, \"the half of the record that bears on provenance, does not reach the composition,\" and \"A reader leaves with tamper evidence and without the caveat that well-formed provenance can be false\"; the census record landed the same day \"and no card cites it\" (Capture Registry, 2026-10-29).", "rail": [], "note": "L(B ∪ A) in the equal-terms case (v0.9 §0.4), realized as the knowledge object (objects.KO); its rail is the compression's, by lineage." } }, "field": [ { "id": "B1", "card": "Coalition for Content Provenance and Authenticity (C2PA) — Conformance - C2PA", "fetched": "card; copied from the census (c2pa-conformance--conformance), HTTP 200, sha256 2478cf522501d050", "origin": "card" }, { "id": "B2", "card": "Content Authenticity Initiative — C2PA conformance program | Open-source tools for content authenticity and provenance", "fetched": "card; HTTP 200, B2.html sha256 a77e497ed496753c", "origin": "card" }, { "id": "B3", "card": "Content Authenticity Initiative — Raising the bar for trust: introducing the C2PA Conformance Program", "fetched": "card; HTTP 200, B3.html sha256 957e25fbaccbee4e", "origin": "card" }, { "id": "B4", "card": "C2PA Specifications — C2PA Conformance Explorer", "fetched": "card; HTTP 200, B4.html sha256 1b8830b8b9a126b3; text from the script bundle (B4-main-3SWFN3GG.js)", "origin": "card" }, { "id": "B5", "card": "SSL.com — How to Submit to the C2PA Conformance Program", "fetched": "card; HTTP 200, B5.html sha256 c6f361ab501b1692", "origin": "card" }, { "id": "B6", "card": "Coalition for Content Provenance and Authenticity (C2PA) — C2PA FAQ", "fetched": "card; HTTP 200, B6.html sha256 2895682fb4ed4f34", "origin": "card" }, { "id": "B7", "card": "trufo.ai — C2PA Conformance Program - Trufo", "fetched": "card; HTTP 200, B7.pdf sha256 d1d4b93232086647; pdftotext -layout", "origin": "card" }, { "id": "B8", "card": "LinkedIn·Scott Perry — C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn", "fetched": "unreachable: URL not found (six searches); card title and snippet only", "origin": "card" }, { "id": "B9", "card": "C2PA Specifications — C2PA and Content Credentials Explainer 2.4", "fetched": "own_page; copied from the census (c2pa-conformance--explainer-2.4), HTTP 200, sha256 e1872450e1ae7f6a", "origin": "own_page" }, { "id": "B10", "card": "c2pa-org/conformance-public — conforming-products-list.json", "fetched": "own_page; copied from the census (c2pa-conformance--products-json), HTTP 200, sha256 e2fb3928fbb2ba3d", "origin": "own_page" }, { "id": "B11", "card": "Wikipedia — C2PA Conformance Program (no article)", "fetched": "Wikipedia; raw HTTP 404, rendered HTTP 404", "origin": "wikipedia" }, { "id": "B12", "card": "Wikipedia — Content Authenticity Initiative § Coalition for Content Provenance and Authenticity", "fetched": "Wikipedia; raw HTTP 200, rendered HTTP 200; rendered sha256 2665c40cc843a5c5", "origin": "wikipedia" }, { "id": "B13", "card": "Wikipedia — Content Credentials § C2PA Conformance Program", "fetched": "Wikipedia; raw HTTP 200, rendered HTTP 200; rendered sha256 5bfabcbc373de072", "origin": "wikipedia" } ], "field_claims": { "F1": { "source": "B1", "origin": "card", "locus": "c2pa.org/conformance ¶2 (Welcome)", "quote": "The C2PA Conformance Program provides assurance that products adhere to the Content Credentials specification, and fulfill a set of security requirements to ensure they are producing and validating C2PA data correctly.", "claim": "the program defined by its operator: assurance that products adhere to the Content Credentials specification and meet security requirements, producing and validating C2PA data correctly", "modality": "stipulation", "kind": "definition", "kernel": true, "const": true, "lineage": "what it is: a conformance program for Content Credentials implementations", "date": "2026-10-29 (page undated; read by the census)", "quote_ok": true, "checked_against": "saved text B1.txt (sha256 6e2785c0be0cf322…), whitespace-normalised" }, "F2": { "source": "B1", "origin": "card", "locus": "c2pa.org/conformance ¶2", "quote": "The Program is part of a C2PA Governance Framework governed by the C2PA Steering Committee and is administered by the C2PA Conformance Task Force.", "claim": "the program sits in the C2PA Governance Framework, governed by the Steering Committee, administered by the Conformance Task Force", "modality": "stipulation", "kind": "attribution", "kernel": false, "const": false, "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "date": "2026-10-29 (page undated; read by the census)", "quote_ok": true, "checked_against": "saved text B1.txt (sha256 6e2785c0be0cf322…), whitespace-normalised" }, "F3": { "source": "B1", "origin": "card", "locus": "c2pa.org/conformance ¶3", "quote": "This Conformance Program is a risk-based, transparent and unbiased governance process intended to hold generator products, validator products and certification authorities accountable to the Content Credentials specification, the Certificate Policy and the Security Requirements .", "claim": "a risk-based, transparent and unbiased governance process holding generator products, validator products and certification authorities accountable to the specification, the Certificate Policy and the Security Requirements", "modality": "stipulation", "kind": "definition", "kernel": true, "const": false, "lineage": "what it is: a conformance program for Content Credentials implementations", "date": "2026-10-29 (page undated; read by the census)", "quote_ok": true, "checked_against": "saved text B1.txt (sha256 6e2785c0be0cf322…), whitespace-normalised" }, "F4": { "source": "B1", "origin": "card", "locus": "c2pa.org/conformance ¶3", "quote": "Conforming products are placed on a publicly-accessible list. This conveys confidence in the implementation and its security to the public and guarantees interoperability across products in the Content Credentials ecosystem.", "claim": "conforming products are placed on a public list, which the operator says conveys confidence and guarantees interoperability", "modality": "self-description", "kind": "function", "kernel": true, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-10-29 (page undated; read by the census)", "quote_ok": true, "checked_against": "saved text B1.txt (sha256 6e2785c0be0cf322…), whitespace-normalised" }, "F5": { "source": "B1", "origin": "card", "locus": "c2pa.org/conformance ¶1", "quote": "After opening the program in June 2025, we have upgraded our conformance program to v0.2.", "claim": "opened June 2025; now v0.2", "modality": "documented", "kind": "genealogy", "kernel": false, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2026-10-29 (page undated; read by the census)", "quote_ok": true, "checked_against": "saved text B1.txt (sha256 6e2785c0be0cf322…), whitespace-normalised" }, "F6": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: opening", "quote": "The C2PA conformance program helps to ensure that products that read and create Content Credentials are compliant with the C2PA Content Credentials specification. … The C2PA conformance program covers: … Validator products that read and validate Content Credentials. … Generator products that create Content Credentials and add them to a digital asset. … Certificate authorities (CAs).", "claim": "the CAI's documentation: the program covers validator products, generator products and certificate authorities, ensuring compliance with the specification", "modality": "documented", "kind": "definition", "kernel": true, "const": false, "lineage": "what it is: a conformance program for Content Credentials implementations", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F7": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: info box", "quote": "If accepted, the product is added to the conforming products list, which indicates it is compliant with the C2PA Content Credentials specification.", "claim": "acceptance adds the product to the conforming products list, which indicates compliance", "modality": "documented", "kind": "function", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F8": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: Generator products", "quote": "A conforming generator product produces manifest data that conforms to the C2PA Content Credentials specification, creates assertions in the asset's active manifest and signs a claim using a valid X.509 certificate on the C2PA trust list.", "claim": "a conforming generator product creates conforming manifest data and assertions and signs a claim with a valid X.509 certificate on the trust list", "modality": "documented", "kind": "definition", "kernel": false, "const": false, "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F9": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: Validator products", "quote": "A conforming validator product produces correct validation results according to the C2PA Content Credentials specification.", "claim": "a conforming validator product produces correct validation results", "modality": "documented", "kind": "definition", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F10": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: Assurance levels", "quote": "A conforming product's assurance level indicates the level of confidence that claims it signs reflect its intended behavior. … Currently, the conformance program has two assurance levels: level 1 and level 2 … The assurance level in the certificate issued to a particular instance of a conforming generator product may be lower than the max assurance level.", "claim": "two assurance levels, 1 and 2, expressing confidence that signed claims reflect the product's intended behaviour; an instance's certificate may carry a lower level than the product's maximum", "modality": "documented", "kind": "definition", "kernel": true, "const": false, "lineage": "assurance levels 1 and 2", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F11": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: process", "quote": "When you apply to the conformance program, you will: … Sign a legal agreement with the C2PA. … Provide evidence supporting your application such as diagrams and documentation. … Work with the conformance program staff to resolve any questions.", "claim": "applicants sign a legal agreement, provide evidence and work with program staff", "modality": "documented", "kind": "function", "kernel": false, "const": false, "lineage": "the process: expression of interest, legal agreement, evidence, approval", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F12": { "source": "B2", "origin": "card", "locus": "/docs/conformance/: Certificate authorities", "quote": "CAs that meet the certificate policy can be on the C2PA trust list, and can issue certificates to conforming generator products under the C2PA conformance program.", "claim": "CAs meeting the certificate policy can be on the trust list and issue certificates to conforming generator products", "modality": "documented", "kind": "function", "kernel": false, "const": false, "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B2.txt (sha256 6736f72f9e91533f…), whitespace-normalised" }, "F13": { "source": "B3", "origin": "card", "locus": "blog post ¶1", "quote": "In June, the Coalition for Content Provenance and Authenticity (C2PA) soft-launched the C2PA Conformance Program during the Content Authenticity Summit at Cornell Tech in New York City. The program is now fully up and running, accepting submissions and encouraging participation from software developers, device makers, and certification authorities.", "claim": "soft-launched in June 2025 at the Content Authenticity Summit, Cornell Tech; fully running by October 2025", "modality": "documented", "kind": "genealogy", "kernel": true, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2025-10-09 (posted)", "quote_ok": true, "checked_against": "saved text B3.txt (sha256 954e86c76d79ba53…), whitespace-normalised" }, "F14": { "source": "B3", "origin": "card", "locus": "blog post ¶2", "quote": "Just as the Bluetooth® or Wi-Fi® programs verify that devices communicate reliably and securely across manufacturers, the C2PA Conformance Program provides baseline assurance for content provenance. It validates that an implementation correctly creates, signs, and reads C2PA manifests, while protecting those manifests and their associated assets through proven cryptographic methods and certificate validation.", "claim": "baseline assurance for content provenance, on the model of Bluetooth or Wi-Fi certification: it validates that an implementation creates, signs and reads manifests correctly", "modality": "interpretation", "kind": "definition", "kernel": false, "const": false, "lineage": "what it is: a conformance program for Content Credentials implementations", "date": "2025-10-09 (posted)", "quote_ok": true, "checked_against": "saved text B3.txt (sha256 954e86c76d79ba53…), whitespace-normalised" }, "F15": { "source": "B3", "origin": "card", "locus": "A foundation for security and interoperability ¶1", "quote": "At launch, the program introduces two security levels, offering flexibility for a diverse set of implementers while establishing a clear path toward more rigorous, hardware-backed assurance. Notably, Google has already achieved the highest conformance level for the Pixel 10, making it the first device to meet the strongest requirements for secure provenance capture and signing.", "claim": "two security levels at launch; Google's Pixel 10 the first device at the highest level", "modality": "documented", "kind": "fact", "kernel": false, "const": false, "lineage": "assurance levels 1 and 2", "date": "2025-10-09 (posted)", "quote_ok": true, "checked_against": "saved text B3.txt (sha256 954e86c76d79ba53…), whitespace-normalised" }, "F16": { "source": "B3", "origin": "card", "locus": "A foundation for security and interoperability ¶3", "quote": "With the introduction of the Conformance Program, all these elements — the standard, the tools, the conformance process, and the trust model — now work together as a unified system for establishing digital provenance at scale.", "claim": "the standard, the tools, the conformance process and the trust model as one system for digital provenance at scale", "modality": "interpretation", "kind": "interpretation", "kernel": false, "const": false, "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "date": "2025-10-09 (posted)", "quote_ok": true, "checked_against": "saved text B3.txt (sha256 954e86c76d79ba53…), whitespace-normalised" }, "F17": { "source": "B3", "origin": "card", "locus": "Built by the community ¶1", "quote": "This program is the product of more than a year of dedicated collaboration within the C2PA Conformance Task Force, which I have the privilege of co-chairing alongside Yogesh Deshpande (Arm) and Sherif Hanna (Google).", "claim": "built over more than a year in the Conformance Task Force, co-chaired by Andy Parsons (CAI), Yogesh Deshpande (Arm) and Sherif Hanna (Google)", "modality": "documented", "kind": "attribution", "kernel": false, "const": false, "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "date": "2025-10-09 (posted)", "quote_ok": true, "checked_against": "saved text B3.txt (sha256 954e86c76d79ba53…), whitespace-normalised" }, "F18": { "source": "B4", "origin": "card", "locus": "Explorer (bundle UI text): header", "quote": "Browse, search, and filter the live versions of the C2PA Conforming Products List, C2PA Trust List, and C2PA TSA Trust List", "claim": "the Explorer: browse, search and filter the live Conforming Products List, Trust List and TSA Trust List", "modality": "stipulation", "kind": "definition", "kernel": true, "const": false, "lineage": "the Conformance Explorer and the machine-readable lists", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B4.txt (sha256 add5f7c134cc0156…), whitespace-normalised" }, "F19": { "source": "B4", "origin": "card", "locus": "Explorer (bundle UI text): product record labels", "quote": "Conformance Program Version: Minimum Eligible Product Version: Security Assurance & Attestation Max Assurance Level: Supported Media Containers & Streams", "claim": "each product record gives its program version, minimum product version, attestation, maximum assurance level and supported media containers", "modality": "documented", "kind": "function", "kernel": false, "const": false, "lineage": "the Conformance Explorer and the machine-readable lists", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B4.txt (sha256 add5f7c134cc0156…), whitespace-normalised" }, "F20": { "source": "B5", "origin": "card", "locus": "Why Is the Conformance Program Submission Necessary? ¶1", "quote": "The Coalition for Content Provenance and Authenticity (C2PA) maintains a formal conformance program to verify that generator or validator products correctly implement the Content Credentials specification. Once a product passes this requirement, it earns a spot on the publicly accessible C2PA Conforming Products List, which signals to the broader ecosystem that your implementation is trustworthy, interoperable, and secure.", "claim": "SSL.com's account: a formal program verifying correct implementation; listing signals trustworthiness, interoperability and security", "modality": "interpretation", "kind": "definition", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-07-16 (datePublished)", "quote_ok": true, "checked_against": "saved text B5.txt (sha256 11e3fbe97489abec…), whitespace-normalised" }, "F21": { "source": "B5", "origin": "card", "locus": "Why Is the Conformance Program Submission Necessary? ¶2", "quote": "CAs approved for the official C2PA Trust List, including SSL, can only issue production-grade Claim Signing Certificates to conforming products. Without conformance, C2PA trusted certificates cannot be issued.", "claim": "trust-list CAs, SSL.com among them, issue production claim-signing certificates only to conforming products", "modality": "documented", "kind": "function", "kernel": true, "const": false, "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "date": "2026-07-16 (datePublished)", "quote_ok": true, "checked_against": "saved text B5.txt (sha256 11e3fbe97489abec…), whitespace-normalised" }, "F22": { "source": "B5", "origin": "card", "locus": "the technical evaluation ¶1–2", "quote": "Properly formats C2PA manifests (the structured containers that hold Content Credentials and provenance data) … Handles certificates in accordance with the C2PA Certificate Policy", "claim": "the technical evaluation: manifests formatted properly, certificates handled per the Certificate Policy", "modality": "documented", "kind": "function", "kernel": false, "const": false, "lineage": "the process: expression of interest, legal agreement, evidence, approval", "date": "2026-07-16 (datePublished)", "quote_ok": true, "checked_against": "saved text B5.txt (sha256 11e3fbe97489abec…), whitespace-normalised" }, "F23": { "source": "B5", "origin": "card", "locus": "assurance levels ¶", "quote": "The C2PA Conformance Program operates on two assurance levels. Level 1 has more flexible requirements, while Level 2 demands more rigorous security controls, including hardware-backed key storage and dynamic security evidence. Determining which level applies to your use case should be an early conversation, as it affects your implementation approach and timeline. A rule of thumb is that a C2PA implementation on a device (mobile phone, camera, cam-recorder, etc.) requires level 1, whereas a cloud service requires at least level 1.", "claim": "Level 2 requires hardware-backed key storage and dynamic security evidence; the rule of thumb names level 1 for devices and 'at least level 1' for cloud services", "modality": "documented", "kind": "fact", "kernel": false, "const": false, "lineage": "assurance levels 1 and 2", "date": "2026-07-16 (datePublished)", "quote_ok": true, "checked_against": "saved text B5.txt (sha256 11e3fbe97489abec…), whitespace-normalised" }, "F24": { "source": "B5", "origin": "card", "locus": "after conformance ¶", "quote": "Once the C2PA verifies your conformance and issues a Conformance Letter, you are eligible to obtain a production Claim Signing Certificate from SSL (or any approved CA on the official C2PA Trust List).", "claim": "a Conformance Letter makes the product eligible for a production claim-signing certificate from a trust-list CA", "modality": "documented", "kind": "function", "kernel": false, "const": false, "lineage": "the process: expression of interest, legal agreement, evidence, approval", "date": "2026-07-16 (datePublished)", "quote_ok": true, "checked_against": "saved text B5.txt (sha256 11e3fbe97489abec…), whitespace-normalised" }, "F25": { "source": "B6", "origin": "card", "locus": "FAQ: What are Content Credentials? ¶1–2", "quote": "Content Credentials provide a cryptographically secure way to capture and express content provenance. … In the context of C2PA, content provenance is captured and preserved using Content Credentials, the technical standard the C2PA produces, providing tamper-evident, cryptographically signed data structures that travel with the asset.", "claim": "Content Credentials: tamper-evident, cryptographically signed provenance data structures that travel with the asset", "modality": "stipulation", "kind": "definition", "kernel": true, "const": true, "lineage": "what Content Credentials are: signed, tamper-evident provenance bound to the asset", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F26": { "source": "B6", "origin": "card", "locus": "FAQ: How can consumers of C2PA data be assured the data was captured correctly? ¶2", "quote": "Additionally, the C2PA Conformance Program ensures that products creating Content Credentials meet stringent technical and security requirements and are vetted by the Administering Authority. These products are then listed in the C2PA Conforming Products List, providing visibility into which implementations are trusted.", "claim": "the FAQ's statement of the program: products vetted by the Administering Authority and listed, giving visibility of which implementations are trusted", "modality": "stipulation", "kind": "function", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F27": { "source": "B6", "origin": "card", "locus": "FAQ: Does validation … ensure that the entire chain of provenance is known, including ingredients? ¶2", "quote": "While the primary asset’s Content Credential can validate that the ingredients were checked at the time of use, the full verification of each ingredient’s provenance requires access to its data. Without it, only the presence of prior validation (not the complete ingredient chain) can be confirmed.", "claim": "the ingredient limit: without the ingredient's data only prior validation, not the whole chain, can be confirmed", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F28": { "source": "B6", "origin": "card", "locus": "FAQ: Are Content Credentials a form of DRM? ¶1", "quote": "No, Content Credentials are not a form of DRM (Digital Rights Management).", "claim": "Content Credentials are not DRM", "modality": "stipulation", "kind": "definition", "kernel": false, "const": false, "lineage": "what Content Credentials are: signed, tamper-evident provenance bound to the asset", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F29": { "source": "B6", "origin": "card", "locus": "FAQ: What happens if C2PA metadata is stripped …? ¶1", "quote": "While C2PA Manifests are typically embedded in the asset, they can be separated. To address this, C2PA supports durable credentials via soft bindings—such as invisible watermarking or fingerprinting—that can help rediscover the associated Content Credential even if it’s removed from the file.", "claim": "manifests can be separated from the asset; soft bindings (watermarks, fingerprints) can help rediscover them", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F30": { "source": "B6", "origin": "card", "locus": "FAQ: What is the C2PA Trust List …? ¶1", "quote": "The C2PA Trust List is a curated list of Certification Authorities (CAs) that are authorized to issue signing certificates for Generator Products. Only products evaluated and approved by the Conformance Program are eligible to receive certificates from these trusted CAs.", "claim": "the Trust List: curated CAs authorised to issue signing certificates, only to products the program approved", "modality": "stipulation", "kind": "definition", "kernel": false, "const": false, "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F31": { "source": "B6", "origin": "card", "locus": "FAQ: How secure is C2PA? ¶1–2", "quote": "Any tampering with the asset or its metadata invalidates the cryptographic hash and signature, making alterations immediately detectable. … Faking Content Credentials would require breaking current cryptographic standards—an infeasible task with today’s technology.", "claim": "the FAQ's security claim: tampering is immediately detectable; faking credentials would require breaking current cryptography", "modality": "self-description", "kind": "fact", "kernel": false, "const": false, "lineage": "security: tamper evidence asserted and its demonstrated breaks", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised", "mark": "contested: B13 (Content Credentials § C2PA Conformance Program ¶3; Mobile apps with Camera Support) reports demonstrated alteration without invalidating signatures (October 2026) and forgery on Android (August 2026)" }, "F32": { "source": "B6", "origin": "card", "locus": "FAQ: Can organizations or individuals use Content Credentials to achieve attribution of their content? ¶1", "quote": "The core C2PA Content Credentials specification does not support attribution of content to individuals or organizations, so that it can remain maximally privacy-preserving.", "claim": "the core specification does not support attribution of content to individuals or organizations (for privacy)", "modality": "self-description", "kind": "limit", "kernel": true, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F33": { "source": "B6", "origin": "card", "locus": "FAQ: What is the benefit of the new C2PA Conformance Program? ¶1", "quote": "Consumers and validators seeing content signed by products on the Conforming Product List can expect the Program to provide them with a higher level of implementation trust.", "claim": "the benefit claimed: a higher level of implementation trust for content signed by listed products", "modality": "self-description", "kind": "function", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-10-29 (page undated; as fetched)", "quote_ok": true, "checked_against": "saved text B6.txt (sha256 538d805ef93be9ef…), whitespace-normalised" }, "F34": { "source": "B7", "origin": "card", "locus": "title page", "quote": "C2PA Conformance Program C2PA Technical Working Group Conformance Task Force Version 0.2, 2026-07-31", "claim": "the program's own document: Version 0.2, 31 July 2026, by the Technical Working Group's Conformance Task Force", "modality": "documented", "kind": "attribution", "kernel": false, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F35": { "source": "B7", "origin": "card", "locus": "§1 Introduction ¶3", "quote": "The Specification has seen wide-scale acceptance but is limited without a robust governance framework and conformance program to provide required transparency for relying parties and accountability for governed parties which need to demonstrate recognized conformance of Specification requirements.", "claim": "why the program exists: the specification is limited without governance and conformance providing transparency for relying parties and accountability for governed parties", "modality": "stipulation", "kind": "interpretation", "kernel": false, "const": false, "lineage": "what it is: a conformance program for Content Credentials implementations", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F36": { "source": "B7", "origin": "card", "locus": "§2.11 C2PA Conformance Program", "quote": "A risk-based governance program intended to hold Applicants who want to demonstrate their conformance to its requirements and then differentiate themselves through C2PA recognition by satisfying program requirements being acknowledged as achieving that level of conformance. It consists of a set of processes, policies, and requirements governing the designation of Applicant Generator Products or Validator Products as Conforming Products, and the designation of Certification Authorities as adhering to the C2PA Certificate Policy", "claim": "the glossary definition: a risk-based governance program whose processes, policies and requirements designate generator and validator products as conforming and CAs as adhering to the Certificate Policy", "modality": "stipulation", "kind": "definition", "kernel": true, "const": true, "lineage": "what it is: a conformance program for Content Credentials implementations", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F37": { "source": "B7", "origin": "card", "locus": "§2.12 C2PA Conforming Products List", "quote": "The canonical record of all Conforming Products that have been deemed conformant according to the stipulations of the C2PA Conformance Program", "claim": "the Conforming Products List: the canonical record of all conforming products", "modality": "stipulation", "kind": "definition", "kernel": true, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F38": { "source": "B7", "origin": "card", "locus": "§2.23 Conforming Product ¶2", "quote": "Only instances of conforming Generator Products are eligible to receive C2PA Claim Signing Certificates from a Certification Authority on the C2PA Trust List.", "claim": "only instances of conforming generator products may receive claim-signing certificates from a trust-list CA", "modality": "stipulation", "kind": "function", "kernel": true, "const": true, "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F39": { "source": "B7", "origin": "card", "locus": "§2.26 Generator Product ¶3", "quote": "Because the Generator Product is always the Signer in the C2PA Conformance Program, and is always the entity listed on the C2PA Conforming Products List, it is accountable for the conformance of the Assets with C2PA manifests that it generates", "claim": "the signer and the listed entity is always the generator product, accountable for the conformance of the assets it generates", "modality": "stipulation", "kind": "definition", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F40": { "source": "B7", "origin": "card", "locus": "§5 Assurance Levels ¶3–4", "quote": "Two Assurance Levels are currently in operation, Assurance Level 1 and Assurance Level 2. … Relying Parties are advised to review and understand the implications of receiving Assets signed by C2PA Claim Signing Certificates of a particular Assurance Level.", "claim": "two assurance levels in operation; relying parties advised to understand what a level implies", "modality": "stipulation", "kind": "limit", "kernel": false, "const": false, "lineage": "assurance levels 1 and 2", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F41": { "source": "B7", "origin": "card", "locus": "§6.1.1 Generator Product Specific Requirements", "quote": "The C2PA Content Credentials Specification includes over 300 normative requirements attributed to Generator Products which create C2PA manifests for consumers. The C2PA Conformance Program will eventually require Claim Generators to demonstrate complete conformance to these exacting requirements in order to receive its approval.", "claim": "the program's own limit: of over 300 normative generator requirements, complete conformance will be required eventually, not yet (likewise over 150 validator requirements)", "modality": "self-description", "kind": "limit", "kernel": true, "const": false, "lineage": "stated limit of the program itself: complete conformance is not yet required", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F42": { "source": "B7", "origin": "card", "locus": "§6.6.3 Program Intake Form ¶6", "quote": "The Conformance Program is administered by an independent Administrator who is free from conflicts … of interest.", "claim": "an independent Administrator, free from conflicts of interest", "modality": "self-description", "kind": "attribution", "kernel": false, "const": false, "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F43": { "source": "B7", "origin": "card", "locus": "§6.7.3 Removal …", "quote": "The C2PA reserves the right to and remove Applicants from the C2PA Trust List and C2PA TSA Trust List, or revoke the conformant status of a Generator Product or Validator Product on the C2PA Conforming Products List.", "claim": "the C2PA may remove applicants from the trust lists or revoke conformant status (the sentence's 'right to and remove' as printed)", "modality": "stipulation", "kind": "function", "kernel": false, "const": false, "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F44": { "source": "B7", "origin": "card", "locus": "§6.7.5 Table 1", "quote": "0.1 2025-06-02 2026-10-09 First version of conformance program, supporting Spec v2.2. 0.2 2026-07-31 Not set Updated conformance program, supporting Spec v2.2 and v2.4.", "claim": "versions: v0.1 sunrise 2025-06-02, sunset 2026-10-09 (Spec v2.2); v0.2 sunrise 2026-07-31, sunset not set (Spec v2.2 and v2.4)", "modality": "documented", "kind": "genealogy", "kernel": true, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F45": { "source": "B7", "origin": "card", "locus": "§6.6.8 Public Record Posting ¶2", "quote": "The C2PA Conformance Program has created a human-readable form of our public trust lists, the Conformance Explorer (https://spec.c2pa.org/conformance-explorer/).", "claim": "the Explorer is the human-readable form of the public lists", "modality": "stipulation", "kind": "definition", "kernel": false, "const": false, "lineage": "the Conformance Explorer and the machine-readable lists", "date": "2026-07-31 (Version 0.2)", "quote_ok": true, "checked_against": "saved text B7.txt (sha256 327e3cb2f50e43ad…), whitespace-normalised" }, "F46": { "source": "B8", "origin": "card", "locus": "card title and snippet (unreachable)", "quote": "C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn Jul 31, 2026 — The C2PA has finally released our Conformance Program documents supporting our 0.2 upgrade.", "claim": "Scott Perry's post: the v0.2 program documents released, 31 July 2026 (snippet only)", "modality": "documented", "kind": "genealogy", "kernel": true, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2026-07-31 (card date; snippet only)", "quote_ok": true, "checked_against": "the card's title/snippet in the registry's cite_list" }, "F47": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §2 ¶2", "quote": "Provenance, as C2PA defines it, refers to the facts about the history of a piece of digital content (also known as an asset) in a form such as an image, video, audio recording, or document. At the heart of the C2PA specification is the Content Credential, a cryptographically bound structure that records an asset’s provenance.", "claim": "provenance as C2PA defines it: facts about an asset's history; the Content Credential, a cryptographically bound structure recording it", "modality": "stipulation", "kind": "definition", "kernel": true, "const": true, "lineage": "what Content Credentials are: signed, tamper-evident provenance bound to the asset", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F48": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §2 ¶3", "quote": "It is important to highlight that Content Credentials do not provide value judgments about whether a given set of provenance data is 'true', but instead merely whether the provenance information is well-formed and free from tampering, valid and trusted (in that the signer of the Content Credential is associated with a known trust list).", "claim": "the governing limit: Content Credentials judge whether provenance is well-formed, untampered, valid and trusted (signer on a known trust list), not whether it is true", "modality": "self-description", "kind": "limit", "kernel": true, "const": true, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F49": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §7.2.1", "quote": "Is provenance always complete? No. Provenance is not always complete. It may happen that an asset is modified in a way that the provenance data is not updated.", "claim": "provenance is not always complete: a non-aware tool can modify an asset without updating it", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F50": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §7.2.2", "quote": "provenance information alone cannot tell you whether the digital content is true, accurate or factual.", "claim": "provenance alone cannot tell whether content is true, accurate or factual", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F51": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §7.2.3", "quote": "Can the provenance metadata be removed? Yes it can.", "claim": "the provenance metadata can be removed", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F52": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §7.2.4", "quote": "The C2PA specification does not directly address the topic of human or organizational identity — that is, the identity of specific humans or organizations involved in the production of a digital asset or content.", "claim": "the specification does not directly address human or organizational identity (extensions may)", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F53": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §7.3.2", "quote": "the ingredient’s provenance cannot be verified in the same way as the provenance data of the asset in which it is contained.", "claim": "an ingredient's provenance cannot be verified as the containing asset's can", "modality": "self-description", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F54": { "source": "B9", "origin": "own_page", "locus": "Explainer 2.4 §7.5.1", "quote": "Implementers of this standard can have their implementations accredited by the C2PA, which enables users to trust in that implementation. … However, the trust in the contents of a Content Credential is based on the trust relationship between the creator of the Content Credential and the consumer of that Content Credential. This trust relationship is not defined by the C2PA", "claim": "accreditation gives trust in an implementation; trust in a credential's contents rests on the creator–consumer relationship, which C2PA does not define", "modality": "self-description", "kind": "limit", "kernel": true, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-29 (Explainer 2.4, undated; read by the census)", "quote_ok": true, "checked_against": "saved text B9.txt (sha256 ae8ce4ee88dd4bdb…), whitespace-normalised" }, "F55": { "source": "B10", "origin": "own_page", "locus": "conforming-products-list.json, record 1", "quote": "\"applicant\": \"Google LLC\", \"supportsCompressedManifests\": false, \"status\": \"conformant\", \"product\": { \"productType\": \"generatorProduct\", \"DN\": { \"CN\": \"Pixel Camera\",", "claim": "the list's unit: a record per product (applicant, status, product type, distinguished name, assurance, spec and program versions, dates); 286 records at reading, all 'conformant' (254 generator, 32 validator products; 11 generator products at max level 2)", "modality": "documented", "kind": "fact", "kernel": true, "const": false, "lineage": "count: 286 conforming product records", "date": "2026-10-29 (as read by the census)", "quote_ok": true, "checked_against": "saved text B10.txt (sha256 e2fb3928fbb2ba3d…), whitespace-normalised" }, "F56": { "source": "B10", "origin": "own_page", "locus": "conforming-products-list.json, record 1", "quote": "\"maxAssuranceLevel\": 2, \"attestationMethods\": [ \"Android_KeyAttestation\" ]", "claim": "the first record, Google's Pixel Camera, at max assurance level 2 by Android key attestation", "modality": "documented", "kind": "fact", "kernel": false, "const": false, "lineage": "assurance levels 1 and 2", "date": "2026-10-29 (as read by the census)", "quote_ok": true, "checked_against": "saved text B10.txt (sha256 e2fb3928fbb2ba3d…), whitespace-normalised" }, "F57": { "source": "B11", "origin": "wikipedia", "locus": "Wikipedia: title C2PA_Conformance_Program", "quote": "raw wikitext (https://en.wikipedia.org/w/index.php?title=C2PA_Conformance_Program&action=raw&redirect=no, 2026-10-29T17:11:57Z): HTTP 404 (Wikimedia Error page; saved as B11.wiki) rendered page (https://en.wikipedia.org/wiki/C2PA_Conformance_Program, 2026-10-29T17:12:33Z): HTTP 404 … Wikipedia does not have an article with this exact name.", "claim": "Wikipedia has no article 'C2PA Conformance Program'; the program is a section of Content Credentials, and the names C2PA and Coalition for Content Provenance and Authenticity redirect to a section of Content Authenticity Initiative", "modality": "documented", "kind": "fact", "kernel": false, "const": false, "lineage": "reception: the encyclopedia", "date": "2026-10-29 (as fetched)", "quote_ok": true, "checked_against": "saved text B11.txt (sha256 d438a4728006d44c…), whitespace-normalised" }, "F58": { "source": "B12", "origin": "wikipedia", "locus": "Content Authenticity Initiative § Coalition for Content Provenance and Authenticity ¶1–2", "quote": "The Coalition for Content Provenance and Authenticity (C2PA) is an open, cross-industry technical standards body established on February 22, 2021.", "claim": "the operator: an open cross-industry standards body established 22 February 2021 (a project of the Joint Development Foundation, Linux Foundation affiliate)", "modality": "documented", "kind": "genealogy", "kernel": false, "const": false, "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "date": "2026-10-16 (revision 1380557793, last edited)", "quote_ok": true, "checked_against": "saved text B12.txt (sha256 38c953646fca99b9…), whitespace-normalised" }, "F59": { "source": "B12", "origin": "wikipedia", "locus": "Content Authenticity Initiative § Criticism ¶2–3", "quote": "Experts have also documented ways in which attackers can bypass C2PA’s safeguards, by altering provenance metadata, removing or forging watermarks, and mimicking digital fingerprints. … Besides the fact that C2PA doesn't address the question of whether the content is accurate, another shortcoming is that typical signing tools don't verify the accuracy of the metadata either, so users can't rely on the provenance data either unless they have reason to trust that the signer properly verified it.", "claim": "criticism: C2PA's safeguards can be bypassed; it does not address accuracy, and signing tools do not verify metadata accuracy", "modality": "attributed", "kind": "limit", "kernel": false, "const": false, "lineage": "security: tamper evidence asserted and its demonstrated breaks", "date": "2026-10-16 (revision 1380557793, last edited)", "quote_ok": true, "checked_against": "saved text B12.txt (sha256 38c953646fca99b9…), whitespace-normalised" }, "F60": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials § C2PA Conformance Program ¶1", "quote": "In early-to-mid 2024, the C2PA established the Conformance Task Force to transition its open technical specifications into a verifiable compliance model to foster market trust. The task force utilized the Trust over IP (ToIP) Governance Metamodel to structure its compliance policies.", "claim": "the Task Force established in early-to-mid 2024 to turn the specifications into a verifiable compliance model, structured on the ToIP Governance Metamodel", "modality": "documented", "kind": "genealogy", "kernel": false, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F61": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials § C2PA Conformance Program ¶2", "quote": "The C2PA Conformance Program soft-launched on June 4, 2025, at the Content Authenticity Initiative (CAI) Summit, … followed by a full public launch in October 2025. … The transition concluded on December 31, 2025, when the C2PA Interim Trust List was officially deprecated.", "claim": "soft launch 4 June 2025, full launch October 2025; the Interim Trust List deprecated 31 December 2025", "modality": "documented", "kind": "genealogy", "kernel": true, "const": false, "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F62": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials § C2PA Conformance Program ¶3", "quote": "In October 2026, security researcher David Buchanan demonstrated a vulnerability in the C2PA specification that allows an attacker to alter an image without invalidating its cryptographic signatures or trusted timestamps.", "claim": "October 2026: a demonstrated vulnerability lets an image be altered without invalidating signatures or trusted timestamps (byte-range exclusions)", "modality": "attributed", "kind": "fact", "kernel": true, "const": false, "lineage": "security: tamper evidence asserted and its demonstrated breaks", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F63": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials § C2PA Conformance Program › Conforming Implementations ¶1", "quote": "While the C2PA Conformance Explorer … registry indexes over 200 active products, ecosystem data indicates that 10 organizations have deployed products that simultaneously complete the Conformance Program and achieve on-boarding onto the central C2PA Trust List.", "claim": "over 200 products on the Explorer, but 10 organizations with deployed products both conforming and on the Trust List", "modality": "documented", "kind": "fact", "kernel": true, "const": false, "lineage": "adoption and its gaps", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F64": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials › Cameras ¶1–2", "quote": "As of mid-2026, major dedicated camera manufacturers (Leica, Nikon, and Canon) do not participate in the official C2PA Conformance Program. … As of 2026, no dedicated camera implementations had achieved compliance under the C2PA Conformance Program.", "claim": "no dedicated camera implementation conformant as of 2026; Leica, Nikon and Canon outside the program", "modality": "documented", "kind": "fact", "kernel": false, "const": false, "lineage": "adoption and its gaps", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F65": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials › Desktop Application software ¶1", "quote": "As of mid-2026, no desktop application had achieved compliance under the C2PA Conformance Program.", "claim": "no desktop application conformant as of mid-2026", "modality": "documented", "kind": "fact", "kernel": false, "const": false, "lineage": "adoption and its gaps", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F66": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials › Mobile apps with Camera Support (Android)", "quote": "In August 2026, security researcher David Buchanan demonstrated that the C2PA implementation on Android is vulnerable to forgery. … root access allows an attacker to command the system to sign arbitrary data, generating fabricated images with valid authenticity signatures. Google recognized the vulnerability but designated the report as \"Won't fix (infeasible)\"", "claim": "August 2026: on Android, root access lets the hardware-held key sign fabricated images with valid signatures; Google: 'Won't fix (infeasible)'", "modality": "attributed", "kind": "fact", "kernel": false, "const": false, "lineage": "security: tamper evidence asserted and its demonstrated breaks", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" }, "F67": { "source": "B13", "origin": "wikipedia", "locus": "Content Credentials § Distinction between provenance and factual accuracy", "quote": "Content Credentials merely verify provenance and digital integrity without assessing the objective truth of the content itself. Consequently, a fabricated or misleading image can maintain a valid cryptographic credential that confirms its origin while validating deceptive content as technically authentic.", "claim": "the encyclopedia's distinction: a fabricated image can carry a valid credential", "modality": "interpretation", "kind": "limit", "kernel": false, "const": false, "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "date": "2026-10-28 (revision 1382375511, last edited)", "quote_ok": true, "checked_against": "saved text B13.txt (sha256 720a27a5751eaf0f…), whitespace-normalised" } }, "field_sources": { "B1": "Coalition for Content Provenance and Authenticity (C2PA) — Conformance - C2PA", "B2": "Content Authenticity Initiative — C2PA conformance program | Open-source tools for content authenticity and provenance", "B3": "Content Authenticity Initiative — Raising the bar for trust: introducing the C2PA Conformance Program", "B4": "C2PA Specifications — C2PA Conformance Explorer", "B5": "SSL.com — How to Submit to the C2PA Conformance Program", "B6": "Coalition for Content Provenance and Authenticity (C2PA) — C2PA FAQ", "B7": "trufo.ai — C2PA Conformance Program - Trufo", "B8": "LinkedIn·Scott Perry — C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn", "B9": "C2PA Specifications — C2PA and Content Credentials Explainer 2.4", "B10": "c2pa-org/conformance-public — conforming-products-list.json", "B11": "Wikipedia — C2PA Conformance Program (no article)", "B12": "Wikipedia — Content Authenticity Initiative § Coalition for Content Provenance and Authenticity", "B13": "Wikipedia — Content Credentials § C2PA Conformance Program" }, "delta": { "T_vs_LB": "At 'C2PA Conformance Program' (T1, eight cards: B1–B8; 193 words with the closer) the composition gives the program by its components and steps. Composed from its cards: the definition at the grain of the program's own pages (B1 F1, F3 'risk-based, transparent and unbiased governance process'; B7 F36 'A risk-based governance program'; B2 F6 the three roles), with 'hardware and software products' at the coarse grain of the CAI blog's 'software developers, device makers' (B3 F13); the list and the Explorer (B1 F4; B2 F7; B4 F18; B7 F45); generator and validator products (B2 F8, F9) with the two levels (B2 F10); CAs and the Trust List (B2 F12; B6 F30); the process (B2 F11: legal agreement, evidence); the trust chain (B7 F38, B5 F21). Outside the cards' text: 'run self-test tools against program requirements' (T1-6) occurs in no fetched source, card or own page (B7 'strongly recommends that Applicants perform interoperability testing' is the nearest, not ledgered); 'expression of interest' is on B1 and B5 as a form, outside the ledgered claims. Force raised: 'creating end-to-end tamper evidence for digital media' (T1-7) raises B6 F25 'tamper-evident' to end-to-end, against B6 F27 (ingredients: 'only the presence of prior validation (not the complete ingredient chain) can be confirmed') and F29 (manifests 'can be separated') on its own cards; the field's only 'End-to-End' is the Explainer's workflow heading (B9, an own page T did not surface). 'Verified generator and validator products' (T1-2) states as done what B7 F41 says the program 'will eventually require'. Limit dropped: B7 F41 (complete conformance only eventually), B6 F32 (no attribution of content to individuals or organizations), B6 F27 and F29, B7 F40 (relying parties advised on levels), B7 F43 (removal and revocation). Available, not composed: governance and its people (B1 F2, B3 F17, B7 F42), versions and dates (B1 F5, B3 F13, B7 F34, F44, B8 F46: v0.2 reaches T only as a card title), the operator's account of what listing conveys (B1 F4's 'guarantees interoperability', B6 F26, F33, B5 F20), what is signed (B6 F25 at its grain, F28 'not a form of DRM' on the card snippet only), the FAQ's security claim (F31), the program's reason (B7 F35), the signer's accountability (B7 F39), Pixel 10 at the highest level (B3 F15), and the Explorer's record fields (B4 F19). The capture's findings name the omission at the census's grain: 'The composition gives 'end-to-end tamper evidence for digital media' and omits both' (CAP-1-04); 'The program's statement of what conformance cannot establish … does not reach the composition' (CAP-1-07). Composed without attribution: the C2PA named as operator; no person (Parsons and Perry stand on cards only), at the coarse grain of a program description: recorded, not a breach. Assigned to another: none. Content replaced by use: the closer (T1-8).", "T_vs_LB_reading": "v0.9 §0.5: the first diff is ontological. T and the field agree on the entity (a C2PA program certifying products and CAs); T composes it as an applicant meets it, components and steps, and turns the chain of signing into 'end-to-end tamper evidence', a guarantee its own cards qualify (ingredients unverifiable, manifests separable, conformance not yet complete). The certificate stands without the statement of what it certifies.", "LB_vs_LBA": "Admission adds, in one claim space with the field's: the program's object as the artifact dimension of provenance, what a C2PA signature verifies (this file, this source, this time; the signing event; file history) and what it does not (the truth of what is signed, by a mechanism: valid signatures on forged or AI-generated content, a property of all signature systems), D725-06, D725-08–11, D729-02, D50-01, D1443-02; the trust model the program governs read from C2PA's own literature (trust by assumption and opt-in, validation not required by the specification, 'trusted does not necessarily imply trustworthy'), against content-derived identifiers, complementary, with P.Sapph.Obbink as the human case (D1443-01, D1443-03–05, D1409-04), and the chain's revocability by the class of actor that issues terminations (D1444-01); authorship: 'C2PA prevents forgery; it does not constitute authorship' and 'the camera's testimony, not the author's' (D729-03, D729-04, D1444-01), held beside #127's 'records authorship' and #1003's grouping with studies of 'attribution loss in AI outputs' (D127-01, D1003-01) and #784's reading of attribution governed as content authenticity (O784-01); the dimensions (D725-01, D725-02, D725-05, D729-01, O1386-01) and the reach of the artifact layer, nothing for text, synthesis or the composition layer (D725-07, D615-01, D127-02, D621-01, D833-01, D95-01); adoption uneven and short of infrastructure (D725-03, D499-01, PE-20); the archive's own artifacts graded by Trust-List signing (D1409-01, R1409-02, R1409-03, R208-01, R204-01, R914-01); the census record's fields with their evidence and its own limits (PE-01–22: it expresses and records, tests no survival); and the Capture Registry's account of the composition at the name (CAP-1-01–10). Not surfaced: every archive source; no card cites the census record or a deposit (CAP-1-09).", "alignment": { "T1_cards_claims": [ "F1", "F2", "F3", "F4", "F5", "F6", "F7", "F8", "F9", "F10", "F11", "F12", "F13", "F14", "F15", "F16", "F17", "F18", "F19", "F20", "F21", "F22", "F23", "F24", "F25", "F26", "F27", "F28", "F29", "F30", "F31", "F32", "F33", "F34", "F35", "F36", "F37", "F38", "F39", "F40", "F41", "F42", "F43", "F44", "F45", "F46" ], "T1_composed": [ "F1", "F3", "F36", "F6", "F13", "F4", "F7", "F18", "F45", "F8", "F9", "F10", "F12", "F30", "F11", "F38", "F21", "F25" ], "T1_composed_note": "F13 at coarse grain ('hardware and software'); F25 at raised force ('end-to-end')", "T1_outside_cards": [ "T1-6 'run self-test tools' (in no fetched source)", "T1-7 'end-to-end' (the Explainer's workflow heading, B9, own page not surfaced)" ], "rule": "a field claim counts as composed when T states it at its source's grain or coarser; the typology of what is not is in T_vs_LB (§6.2)" } }, "kernel": [ { "K": "K1", "claim": "`PE-01`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K2", "claim": "`PE-04`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K3", "claim": "`PE-03`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K4", "claim": "`PE-05`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K5", "claim": "`PE-02`", "source": "provenance census record, 2026-10-29", "M_src": "documented", "sense": "governance: the C2PA, its Steering Committee and Conformance Task Force", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K6", "claim": "`PE-14`", "source": "provenance census record, 2026-10-29", "M_src": "documented", "sense": "governance: the C2PA, its Steering Committee and Conformance Task Force", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K7", "claim": "`PE-09`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the unit: conforming products on a public list, with trust lists of CAs", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K8", "claim": "`PE-06`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K9", "claim": "`PE-07`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K10", "claim": "`PE-08`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K11", "claim": "`D1443-01`", "source": "#1443 (2026-08-09)", "M_src": "attributed", "sense": "the trust model: trust extended to a chain of signers, revocable", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F30, F33 (the Trust List curated; 'a higher level of implementation trust')", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K12", "claim": "`D1443-03`", "source": "#1443 (2026-08-09)", "M_src": "interpretation", "sense": "the trust model: trust extended to a chain of signers, revocable", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F30", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K13", "claim": "`D1443-04`", "source": "#1443 (2026-08-09)", "M_src": "interpretation", "sense": "the trust model: trust extended to a chain of signers, revocable", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K14", "claim": "`D1443-05`", "source": "#1443 (2026-08-09)", "M_src": "interpretation", "sense": "the trust model: trust extended to a chain of signers, revocable", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K15", "claim": "`D1409-04`", "source": "#1409 (2026-07-21)", "M_src": "interpretation", "sense": "the trust model: trust extended to a chain of signers, revocable", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K16", "claim": "`D1444-01`", "source": "#1444 (2026-08-09)", "M_src": "interpretation", "sense": "authorship: the signature attests the tool or device, not the author", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F43 (removal and revocation reserved to the C2PA)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K17", "claim": "`PE-13`", "source": "provenance census record, 2026-10-29", "M_src": "documented", "sense": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K18", "claim": "`PE-15`", "source": "provenance census record, 2026-10-29", "M_src": "documented", "sense": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K19", "claim": "`PE-12`", "source": "provenance census record, 2026-10-29", "M_src": "documented", "sense": "the Conformance Explorer and the machine-readable lists", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K20", "claim": "`PE-11`", "source": "provenance census record, 2026-10-29", "M_src": "documented", "sense": "count: 286 conforming product records", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K21", "claim": "`CAP-1-05`", "source": "Capture Registry, 2026-10-29", "M_src": "documented", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K22", "claim": "`D725-06`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "the artifact dimension: what a C2PA signature establishes", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K23", "claim": "`D725-10`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "the artifact dimension: what a C2PA signature establishes", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K24", "claim": "`D725-11`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "the artifact dimension: what a C2PA signature establishes", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K25", "claim": "`D729-02`", "source": "#729 (2026-05-12)", "M_src": "interpretation", "sense": "the dimensions of provenance: artifact, licensing, semantic, process", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K26", "claim": "`D50-01`", "source": "#50 (2026-04-03)", "M_src": "interpretation", "sense": "the artifact dimension: what a C2PA signature establishes", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K27", "claim": "`D127-01`", "source": "#127 (2026-05-25)", "M_src": "documented", "sense": "the artifact dimension: what a C2PA signature establishes", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "rival claim: F32 (the core specification 'does not support attribution of content to individuals or organizations')", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K28", "claim": "`PE-16`", "source": "provenance census record, 2026-10-29", "M_src": "self-description", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K29", "claim": "`D725-08`", "source": "#725 (2026-05-08)", "M_src": "attributed", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F31 (the FAQ's 'infeasible'), beside F62 and F66", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K30", "claim": "`D725-09`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F31", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K31", "claim": "`D1443-02`", "source": "#1443 (2026-08-09)", "M_src": "interpretation", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K32", "claim": "`PE-18`", "source": "provenance census record, 2026-10-29", "M_src": "self-description", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K33", "claim": "`D729-04`", "source": "#729 (2026-05-12)", "M_src": "interpretation", "sense": "authorship: the signature attests the tool or device, not the author", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F25 (tamper-evident signed provenance)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K34", "claim": "`D729-03`", "source": "#729 (2026-05-12)", "M_src": "interpretation", "sense": "authorship: the signature attests the tool or device, not the author", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K35", "claim": "`D1003-01`", "source": "#1003 (2026-05-21)", "M_src": "interpretation", "sense": "authorship: the signature attests the tool or device, not the author", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "rival claim: F32, F52", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K36", "claim": "`O784-01`", "source": "#784 (2026-06-03)", "M_src": "interpretation", "sense": "authorship: the signature attests the tool or device, not the author", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K37", "claim": "`PE-19`", "source": "provenance census record, 2026-10-29", "M_src": "self-description", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K38", "claim": "`D725-04`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K39", "claim": "`PE-10`", "source": "provenance census record, 2026-10-29", "M_src": "self-description", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K40", "claim": "`PE-21`", "source": "provenance census record, 2026-10-29", "M_src": "self-description", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K41", "claim": "`D725-03`", "source": "#725 (2026-05-08)", "M_src": "documented", "sense": "adoption and its gaps", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F63 (over 200 products indexed)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K42", "claim": "`D499-01`", "source": "#499 (2026-02-20)", "M_src": "interpretation", "sense": "adoption and its gaps", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F63", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K43", "claim": "`PE-20`", "source": "provenance census record, 2026-10-29", "M_src": "attributed", "sense": "adoption and its gaps", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K44", "claim": "`D725-01`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "the dimensions of provenance: artifact, licensing, semantic, process", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K45", "claim": "`D725-05`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "the dimensions of provenance: artifact, licensing, semantic, process", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K46", "claim": "`D725-02`", "source": "#725 (2026-05-08)", "M_src": "stipulation", "sense": "the dimensions of provenance: artifact, licensing, semantic, process", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K47", "claim": "`D729-01`", "source": "#729 (2026-05-12)", "M_src": "interpretation", "sense": "the dimensions of provenance: artifact, licensing, semantic, process", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K48", "claim": "`O1386-01`", "source": "#1386 (2026-05-25)", "M_src": "stipulation", "sense": "the dimensions of provenance: artifact, licensing, semantic, process", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K49", "claim": "`D725-07`", "source": "#725 (2026-05-08)", "M_src": "interpretation", "sense": "what the artifact layer does not reach: text, synthesis, the composition layer", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K50", "claim": "`D615-01`", "source": "#615 (2026-03-30)", "M_src": "interpretation", "sense": "what the artifact layer does not reach: text, synthesis, the composition layer", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K51", "claim": "`D127-02`", "source": "#127 (2026-05-25)", "M_src": "interpretation", "sense": "what the artifact layer does not reach: text, synthesis, the composition layer", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K52", "claim": "`D621-01`", "source": "#621 (2026-04-01)", "M_src": "interpretation", "sense": "what the artifact layer does not reach: text, synthesis, the composition layer", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K53", "claim": "`D833-01`", "source": "#833 (2026-06-15)", "M_src": "interpretation", "sense": "what the artifact layer does not reach: text, synthesis, the composition layer", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K54", "claim": "`D95-01`", "source": "#95 (2026-05-05)", "M_src": "interpretation", "sense": "what the artifact layer does not reach: text, synthesis, the composition layer", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K55", "claim": "`D1409-01`", "source": "#1409 (2026-07-21)", "M_src": "documented", "sense": "the archive's own artifacts and the C2PA path", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K56", "claim": "`R1409-02`", "source": "#1409 (2026-07-21)", "M_src": "stipulation", "sense": "the archive's own artifacts and the C2PA path", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F21, F38 (certificates only to conforming products)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K57", "claim": "`R1409-03`", "source": "#1409 (2026-07-21)", "M_src": "hypothesis", "sense": "the archive's own artifacts and the C2PA path", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K58", "claim": "`R208-01`", "source": "#208 (2026-01-02)", "M_src": "self-description", "sense": "the archive's own artifacts and the C2PA path", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K59", "claim": "`R204-01`", "source": "#204 (2026-06-14)", "M_src": "stipulation", "sense": "the archive's own artifacts and the C2PA path", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K60", "claim": "`R914-01`", "source": "#914 (2026-06-24)", "M_src": "stipulation", "sense": "the archive's own artifacts and the C2PA path", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing distinction (the field has no claim on the point)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K61", "claim": "`PE-22`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K62", "claim": "`PE-17`", "source": "provenance census record, 2026-10-29", "M_src": "stipulation", "sense": "the census record: what the program carries, on whose assertion", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K63", "claim": "`CAP-1-10`", "source": "Capture Registry, 2026-10-29", "M_src": "interpretation", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K64", "claim": "`CAP-1-06`", "source": "Capture Registry, 2026-10-29", "M_src": "interpretation", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K65", "claim": "`CAP-1-01`", "source": "Capture Registry, 2026-10-29", "M_src": "documented", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K66", "claim": "`CAP-1-02`", "source": "Capture Registry, 2026-10-29", "M_src": "documented", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F3, F36 (the phrase is the operator's own)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K67", "claim": "`CAP-1-03`", "source": "Capture Registry, 2026-10-29", "M_src": "documented", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K68", "claim": "`CAP-1-04`", "source": "Capture Registry, 2026-10-29", "M_src": "documented", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "qualified claim: F25 (the composition's 'end-to-end' against the FAQ's 'tamper-evident')", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K69", "claim": "`CAP-1-07`", "source": "Capture Registry, 2026-10-29", "M_src": "interpretation", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K70", "claim": "`CAP-1-08`", "source": "Capture Registry, 2026-10-29", "M_src": "interpretation", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" }, { "K": "K71", "claim": "`CAP-1-09`", "source": "Capture Registry, 2026-10-29", "M_src": "documented", "sense": "the composition at the address: the program as its applicants meet it", "qualifiers carried": "—", "f (source's own falsifiers)": "— (none stated; watch: a later composition at the address that states or drops the claim, attributed or not, uptake §8.3)", "contrast": "missing finding (an observation of, or a record on, the entity at its address)", "resolver": "a later capture at 'C2PA Conformance Program' (ADDR-c597ce64430f) on Google AI Overview, seated in the Capture Registry (§8.3)" } ], "kernel_T": [ { "claim": "F41", "note": "the program's own limit (complete conformance only eventually), absent" }, { "claim": "F32", "note": "no attribution of content to individuals or organizations, absent" }, { "claim": "F27", "note": "the ingredient chain not confirmable, absent, against 'end-to-end'" }, { "claim": "F29", "note": "manifests separable from the asset, absent" }, { "claim": "F40", "note": "relying parties advised on assurance levels, absent" }, { "claim": "F43", "note": "removal and revocation, absent" }, { "claim": "F44", "note": "the version table (v0.1 sunset 2026-10-09; v0.2 since 2026-07-31), absent" }, { "claim": "F2", "note": "the governance framework and Steering Committee, absent" } ], "ledger": { "archive": "datasets/negative-of-the-negative/v2/ledgers/c2pa-conformance/ledger-archive.json", "field": "datasets/negative-of-the-negative/v2/ledgers/c2pa-conformance/field.json", "selection": "datasets/negative-of-the-negative/v2/traversal/c2pa-conformance/", "config": "datasets/negative-of-the-negative/v2/panel/configs/c2pa-conformance.json", "intake": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/", "audit": null }, "ontology": { "composition": "equal", "composition_note": "equal-terms case (v0.9 §0.9, §4.1): one claim space; the field's and the archive's claims ordered together by the entity's dependency and by genealogy within each sense; nothing translated (every field claim composed as received, beside the archive claims it stands with)", "case": { "value": "equal", "statement": "The archive reads the field's entity as the entity: the census record describes the program from its own pages, each field with a verbatim quote and its basis, and the deposits that bear on it (#725, #729, #1443, #1444, #1409) take C2PA's signing and trust chain as given and place them, adding senses, mechanisms and limits on the field's own object: the artifact dimension of provenance among independent dimensions, what a signature establishes and does not (the signed-forgery mechanism), the trust model read from C2PA's own literature, the chain's revocability, authorship as outside it, and the reach the artifact layer lacks. #725 states its relation in those terms ('Extension and completion, not substitution or critique'; 'This is not a flaw of C2PA'), and #1443 holds the two 'complementary rather than competing'. The field itself states the governing limit (Explainer 2.4: no judgement of truth; no identity) that the archive's senses extend. No defining paper contests the field's ontology or supplies one the field lacks: ρ = extends, the equal-terms case (§0.9, §1.2a). Two readings are held under P_coh rather than ruled: #127's and #1003's against the operator's statement that the core specification does not support attribution, and, within the field, the FAQ's 'infeasible' forgery against the reported demonstrations.", "loci": [ { "dep": 725, "locus": "packet header, Relation", "quote": "**Relation:** Extension and completion, not substitution or critique" }, { "dep": 725, "locus": "§0 ¶7", "quote": "It is offered as a constructive extension of existing frameworks — not a critique of their adequacy in their own domains." }, { "dep": 725, "locus": "§3.6, Correction", "quote": "**Correction:** This is not a flaw of C2PA." }, { "dep": 725, "locus": "§1.4 ¶4", "quote": "The packet's claim is not that the existing frameworks fail. It is that they were not designed for the dimension proposed here." }, { "dep": 1443, "locus": "§6.1 ¶6", "quote": "These are **complementary rather than competing**, and saying so is stronger than claiming superiority" }, { "dep": 729, "locus": "§8.7", "quote": "**C2PA prevents forgery; it does not constitute authorship.**" }, { "dep": "provenance census", "locus": "census.json organizing_question", "quote": "What provenance does this system carry, through which operation, on whose assertion, with what evidence of survival?" }, { "dep": "provenance census", "locus": "census.json rows[slug == 'c2pa-conformance'], retention_results", "quote": "not tested here: conformance concerns producing and validating C2PA data correctly" } ] }, "E_F": { "type": "C (public entity: a conformance program and its registry of conforming products and trust lists, run by a standards coalition)", "definition": "the Coalition for Content Provenance and Authenticity's risk-based governance program, administered by its Conformance Task Force under the Steering Committee, that designates generator and validator products as conforming to the Content Credentials specification and certification authorities as adhering to its Certificate Policy, publishes the Conforming Products List, the Trust List and the TSA Trust List (browsed in the Conformance Explorer; 286 records on 2026-10-29), and admits to production claim-signing certificates only conforming generator products; opened June 2025, v0.2 since 31 July 2026; by its own statements it certifies correct production and validation of C2PA data, not the truth of provenance, not identity or attribution, and complete conformance only eventually", "claims": [ "F1", "F36", "F3", "F2", "F4", "F37", "F38", "F30", "F10", "F44", "F18", "F55", "F48", "F32", "F52", "F41" ] }, "E_A": { "definition": "the same program, in the provenance census record and the archive's deposits: a registry of the media lineage that expresses and records provenance and tests no survival, its object a digital asset with its Content Credential and its unit the product or signer (census record); the governance of the artifact dimension of provenance, which verifies this file, this source, this time, and the signing event, not the truth of what is signed (#725), not authorship (#729), the camera's testimony rather than the author's, by trust chains dependent on certificate authorities and revocable (#1444), on a trust model of assumption and opt-in in which 'trusted does not necessarily imply trustworthy' (#1443); with no reach into text, synthesis or the composition layer (#725, #615, #127), and met by the archive at its own artifacts' Trust-List signing (#1409)", "claims": [ "PE-01", "PE-04", "PE-03", "PE-05", "PE-06", "PE-10", "D725-06", "D725-08", "D725-11", "D729-04", "D1444-01", "D1443-01", "D725-05", "D615-01", "D127-02", "R1409-02", "CAP-1-07" ], "defining_papers": [ 725, 729, 1443, 1444, 1409, 615, 127 ], "defining_records": [ "provenance census record (census.json rows[slug == 'c2pa-conformance'], with the census's organizing_question and schema_note; rendered aggregators/c2pa-conformance/index.html; editor Lee Sharks, 2026-10-29, schema 1.0)", "Capture Registry c2pa-conformance-program-aio-20261029 (OBS-47bccd9af209)" ] }, "rho": { "value": "extends", "status": "read from the census record, the capture record and the deposits that name C2PA (§1.2a); #725, the paper that defines the archive's bearing most fully, names its relation 'Extension and completion'", "statement": "the archive reads E_F as the entity and adds senses, mechanisms and limits on the field's own object: the artifact dimension among independent dimensions (D725-01, D725-05, D729-01, O1386-01), what the signature establishes and the signed-forgery mechanism (D725-06, D725-08, D725-09, D725-11), the trust model and its revocability (D1443-01, D1443-03, D1444-01), authorship outside it (D729-03, D729-04), what the artifact layer does not reach (D615-01, D127-02, D621-01), the census's reading of what it carries (PE-05, PE-10) and what the composition leaves out (CAP-1-04, CAP-1-07)", "claims": [ "D725-01", "D725-05", "D729-01", "O1386-01", "D725-06", "D725-08", "D725-09", "D725-11", "D1443-01", "D1443-03", "D1444-01", "D729-03", "D729-04", "D615-01", "D127-02", "D621-01", "PE-05", "PE-10", "CAP-1-04", "CAP-1-07" ], "guard": "ρ = extends claims an addition and no more: #725's signed-forgery case is 'not a flaw of C2PA' but a property of all signature-based systems, and its own text says the existing frameworks 'were not designed for the dimension proposed here'; the field states the governing limit itself (F48, F50, F52), so the archive's senses extend a limit the operator already draws; #1443's trust-model reading is attributed to C2PA's own literature and its comparison is 'complementary rather than competing'; #127's and #1003's contrary statements on authorship are composed beside the operator's under P_coh.", "considered": [ { "value": "constructs", "set_aside": "the archive does not read the program or its lists as made by receiving texts" }, { "value": "revises", "set_aside": "the entity is not the archive's own; the census record and the capture are records of it" } ] }, "translation": [ { "lineage": "what it is: a conformance program for Content Credentials implementations", "field_claims": [ "F1", "F3", "F6", "F14", "F35", "F36" ], "received": "F1 (B1, c2pa.org/conformance ¶2 (Welcome)): \"The C2PA Conformance Program provides assurance that products adhere to the Content Credentials specification, and fulfill a set of security requirements to ensure they are producing and validating C2PA data correctly.\"; F3 (B1, c2pa.org/conformance ¶3): \"This Conformance Program is a risk-based, transparent and unbiased governance process intended to hold generator products, validator products and certification authorities accountable to the Content Credentials specification, the Certificate Policy and the Security Requirements .\"; F6 (B2, /docs/conformance/: opening): \"The C2PA conformance program helps to ensure that products that read and create Content Credentials are compliant with the C2PA Content Credentials specification. … The C2PA conformance program covers: … Validator products that read and validate Content Credentials. … Generator products that create Content Credentials and add them to a digital asset. … Certificate authorities (CAs).\"; F14 (B3, blog post ¶2): \"Just as the Bluetooth® or Wi-Fi® programs verify that devices communicate reliably and securely across manufacturers, the C2PA Conformance Program provides baseline assurance for content provenance. It validates that an implementation correctly creates, signs, and reads C2PA manifests, while protecting those manifests and their associated assets through proven cryptographic methods and certificate validation.\"; F35 (B7, §1 Introduction ¶3): \"The Specification has seen wide-scale acceptance but is limited without a robust governance framework and conformance program to provide required transparency for relying parties and accountability for governed parties which need to demonstrate recognized conformance of Specification requirements.\"; F36 (B7, §2.11 C2PA Conformance Program): \"A risk-based governance program intended to hold Applicants who want to demonstrate their conformance to its requirements and then differentiate themselves through C2PA recognition by satisfying program requirements being acknowledged as achieving that level of conformance. It consists of a set of processes, policies, and requirements governing the designation of Applicant Generator Products or Validator Products as Conforming Products, and the designation of Certification Authorities as adhering to the C2PA Certificate Policy\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-01, PE-04, PE-03, PE-05, PE-22", "archive_claims": [ "PE-01", "PE-04", "PE-03", "PE-05", "PE-22" ] }, { "lineage": "governance: the C2PA, its Steering Committee and Conformance Task Force", "field_claims": [ "F2", "F17", "F42", "F58" ], "received": "F2 (B1, c2pa.org/conformance ¶2): \"The Program is part of a C2PA Governance Framework governed by the C2PA Steering Committee and is administered by the C2PA Conformance Task Force.\"; F17 (B3, Built by the community ¶1): \"This program is the product of more than a year of dedicated collaboration within the C2PA Conformance Task Force, which I have the privilege of co-chairing alongside Yogesh Deshpande (Arm) and Sherif Hanna (Google).\"; F42 (B7, §6.6.3 Program Intake Form ¶6): \"The Conformance Program is administered by an independent Administrator who is free from conflicts … of interest.\"; F58 (B12, Content Authenticity Initiative § Coalition for Content Provenance and Authenticity ¶1–2): \"The Coalition for Content Provenance and Authenticity (C2PA) is an open, cross-industry technical standards body established on February 22, 2021.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-02, PE-14", "archive_claims": [ "PE-02", "PE-14" ] }, { "lineage": "the unit: conforming products on a public list, with trust lists of CAs", "field_claims": [ "F4", "F7", "F9", "F20", "F26", "F33", "F37", "F39", "F43" ], "received": "F4 (B1, c2pa.org/conformance ¶3): \"Conforming products are placed on a publicly-accessible list. This conveys confidence in the implementation and its security to the public and guarantees interoperability across products in the Content Credentials ecosystem.\"; F7 (B2, /docs/conformance/: info box): \"If accepted, the product is added to the conforming products list, which indicates it is compliant with the C2PA Content Credentials specification.\"; F9 (B2, /docs/conformance/: Validator products): \"A conforming validator product produces correct validation results according to the C2PA Content Credentials specification.\"; F20 (B5, Why Is the Conformance Program Submission Necessary? ¶1): \"The Coalition for Content Provenance and Authenticity (C2PA) maintains a formal conformance program to verify that generator or validator products correctly implement the Content Credentials specification. Once a product passes this requirement, it earns a spot on the publicly accessible C2PA Conforming Products List, which signals to the broader ecosystem that your implementation is trustworthy, interoperable, and secure.\"; F26 (B6, FAQ: How can consumers of C2PA data be assured the data was captured correctly? ¶2): \"Additionally, the C2PA Conformance Program ensures that products creating Content Credentials meet stringent technical and security requirements and are vetted by the Administering Authority. These products are then listed in the C2PA Conforming Products List, providing visibility into which implementations are trusted.\"; F33 (B6, FAQ: What is the benefit of the new C2PA Conformance Program? ¶1): \"Consumers and validators seeing content signed by products on the Conforming Product List can expect the Program to provide them with a higher level of implementation trust.\"; F37 (B7, §2.12 C2PA Conforming Products List): \"The canonical record of all Conforming Products that have been deemed conformant according to the stipulations of the C2PA Conformance Program\"; F39 (B7, §2.26 Generator Product ¶3): \"Because the Generator Product is always the Signer in the C2PA Conformance Program, and is always the entity listed on the C2PA Conforming Products List, it is accountable for the conformance of the Assets with C2PA manifests that it generates\"; F43 (B7, §6.7.3 Removal …): \"The C2PA reserves the right to and remove Applicants from the C2PA Trust List and C2PA TSA Trust List, or revoke the conformant status of a Generator Product or Validator Product on the C2PA Conforming Products List.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-09, PE-06", "archive_claims": [ "PE-09", "PE-06" ] }, { "lineage": "origin and versions: June 2025 (v0.1) to v0.2 (31 July 2026)", "field_claims": [ "F5", "F13", "F34", "F44", "F46", "F60", "F61" ], "received": "F5 (B1, c2pa.org/conformance ¶1): \"After opening the program in June 2025, we have upgraded our conformance program to v0.2.\"; F13 (B3, blog post ¶1): \"In June, the Coalition for Content Provenance and Authenticity (C2PA) soft-launched the C2PA Conformance Program during the Content Authenticity Summit at Cornell Tech in New York City. The program is now fully up and running, accepting submissions and encouraging participation from software developers, device makers, and certification authorities.\"; F34 (B7, title page): \"C2PA Conformance Program C2PA Technical Working Group Conformance Task Force Version 0.2, 2026-07-31\"; F44 (B7, §6.7.5 Table 1): \"0.1 2025-06-02 2026-10-09 First version of conformance program, supporting Spec v2.2. 0.2 2026-07-31 Not set Updated conformance program, supporting Spec v2.2 and v2.4.\"; F46 (B8, card title and snippet (unreachable)): \"C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn Jul 31, 2026 — The C2PA has finally released our Conformance Program documents supporting our 0.2 upgrade.\"; F60 (B13, Content Credentials § C2PA Conformance Program ¶1): \"In early-to-mid 2024, the C2PA established the Conformance Task Force to transition its open technical specifications into a verifiable compliance model to foster market trust. The task force utilized the Trust over IP (ToIP) Governance Metamodel to structure its compliance policies.\"; F61 (B13, Content Credentials § C2PA Conformance Program ¶2): \"The C2PA Conformance Program soft-launched on June 4, 2025, at the Content Authenticity Initiative (CAI) Summit, … followed by a full public launch in October 2025. … The transition concluded on December 31, 2025, when the C2PA Interim Trust List was officially deprecated.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-13, PE-15", "archive_claims": [ "PE-13", "PE-15" ] }, { "lineage": "the trust chain: only conforming generator products get claim-signing certificates", "field_claims": [ "F8", "F12", "F16", "F21", "F30", "F38" ], "received": "F8 (B2, /docs/conformance/: Generator products): \"A conforming generator product produces manifest data that conforms to the C2PA Content Credentials specification, creates assertions in the asset's active manifest and signs a claim using a valid X.509 certificate on the C2PA trust list.\"; F12 (B2, /docs/conformance/: Certificate authorities): \"CAs that meet the certificate policy can be on the C2PA trust list, and can issue certificates to conforming generator products under the C2PA conformance program.\"; F16 (B3, A foundation for security and interoperability ¶3): \"With the introduction of the Conformance Program, all these elements — the standard, the tools, the conformance process, and the trust model — now work together as a unified system for establishing digital provenance at scale.\"; F21 (B5, Why Is the Conformance Program Submission Necessary? ¶2): \"CAs approved for the official C2PA Trust List, including SSL, can only issue production-grade Claim Signing Certificates to conforming products. Without conformance, C2PA trusted certificates cannot be issued.\"; F30 (B6, FAQ: What is the C2PA Trust List …? ¶1): \"The C2PA Trust List is a curated list of Certification Authorities (CAs) that are authorized to issue signing certificates for Generator Products. Only products evaluated and approved by the Conformance Program are eligible to receive certificates from these trusted CAs.\"; F38 (B7, §2.23 Conforming Product ¶2): \"Only instances of conforming Generator Products are eligible to receive C2PA Claim Signing Certificates from a Certification Authority on the C2PA Trust List.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-07, PE-08, D1443-01, D1443-03, D1443-04, D1443-05, D1409-04, D1444-01, R1409-02", "archive_claims": [ "PE-07", "PE-08", "D1443-01", "D1443-03", "D1443-04", "D1443-05", "D1409-04", "D1444-01", "R1409-02" ] }, { "lineage": "assurance levels 1 and 2", "field_claims": [ "F10", "F15", "F23", "F40", "F56" ], "received": "F10 (B2, /docs/conformance/: Assurance levels): \"A conforming product's assurance level indicates the level of confidence that claims it signs reflect its intended behavior. … Currently, the conformance program has two assurance levels: level 1 and level 2 … The assurance level in the certificate issued to a particular instance of a conforming generator product may be lower than the max assurance level.\"; F15 (B3, A foundation for security and interoperability ¶1): \"At launch, the program introduces two security levels, offering flexibility for a diverse set of implementers while establishing a clear path toward more rigorous, hardware-backed assurance. Notably, Google has already achieved the highest conformance level for the Pixel 10, making it the first device to meet the strongest requirements for secure provenance capture and signing.\"; F23 (B5, assurance levels ¶): \"The C2PA Conformance Program operates on two assurance levels. Level 1 has more flexible requirements, while Level 2 demands more rigorous security controls, including hardware-backed key storage and dynamic security evidence. Determining which level applies to your use case should be an early conversation, as it affects your implementation approach and timeline. A rule of thumb is that a C2PA implementation on a device (mobile phone, camera, cam-recorder, etc.) requires level 1, whereas a cloud service requires at least level 1.\"; F40 (B7, §5 Assurance Levels ¶3–4): \"Two Assurance Levels are currently in operation, Assurance Level 1 and Assurance Level 2. … Relying Parties are advised to review and understand the implications of receiving Assets signed by C2PA Claim Signing Certificates of a particular Assurance Level.\"; F56 (B10, conforming-products-list.json, record 1): \"\"maxAssuranceLevel\": 2, \"attestationMethods\": [ \"Android_KeyAttestation\" ]\"", "receiving_text": "—", "translation": "untranslated: composed as received (no archive claim on the point)", "archive_claims": [] }, { "lineage": "the process: expression of interest, legal agreement, evidence, approval", "field_claims": [ "F11", "F22", "F24" ], "received": "F11 (B2, /docs/conformance/: process): \"When you apply to the conformance program, you will: … Sign a legal agreement with the C2PA. … Provide evidence supporting your application such as diagrams and documentation. … Work with the conformance program staff to resolve any questions.\"; F22 (B5, the technical evaluation ¶1–2): \"Properly formats C2PA manifests (the structured containers that hold Content Credentials and provenance data) … Handles certificates in accordance with the C2PA Certificate Policy\"; F24 (B5, after conformance ¶): \"Once the C2PA verifies your conformance and issues a Conformance Letter, you are eligible to obtain a production Claim Signing Certificate from SSL (or any approved CA on the official C2PA Trust List).\"", "receiving_text": "—", "translation": "untranslated: composed as received (no archive claim on the point)", "archive_claims": [] }, { "lineage": "the Conformance Explorer and the machine-readable lists", "field_claims": [ "F18", "F19", "F45" ], "received": "F18 (B4, Explorer (bundle UI text): header): \"Browse, search, and filter the live versions of the C2PA Conforming Products List, C2PA Trust List, and C2PA TSA Trust List\"; F19 (B4, Explorer (bundle UI text): product record labels): \"Conformance Program Version: Minimum Eligible Product Version: Security Assurance & Attestation Max Assurance Level: Supported Media Containers & Streams\"; F45 (B7, §6.6.8 Public Record Posting ¶2): \"The C2PA Conformance Program has created a human-readable form of our public trust lists, the Conformance Explorer (https://spec.c2pa.org/conformance-explorer/).\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-12", "archive_claims": [ "PE-12" ] }, { "lineage": "what Content Credentials are: signed, tamper-evident provenance bound to the asset", "field_claims": [ "F25", "F28", "F47" ], "received": "F25 (B6, FAQ: What are Content Credentials? ¶1–2): \"Content Credentials provide a cryptographically secure way to capture and express content provenance. … In the context of C2PA, content provenance is captured and preserved using Content Credentials, the technical standard the C2PA produces, providing tamper-evident, cryptographically signed data structures that travel with the asset.\"; F28 (B6, FAQ: Are Content Credentials a form of DRM? ¶1): \"No, Content Credentials are not a form of DRM (Digital Rights Management).\"; F47 (B9, Explainer 2.4 §2 ¶2): \"Provenance, as C2PA defines it, refers to the facts about the history of a piece of digital content (also known as an asset) in a form such as an image, video, audio recording, or document. At the heart of the C2PA specification is the Content Credential, a cryptographically bound structure that records an asset’s provenance.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside D725-06, D725-10, D725-11, D729-02, D50-01, D127-01", "archive_claims": [ "D725-06", "D725-10", "D725-11", "D729-02", "D50-01", "D127-01" ] }, { "lineage": "stated limits: no judgement of truth, no identity or attribution, incomplete chains", "field_claims": [ "F27", "F29", "F32", "F48", "F49", "F50", "F51", "F52", "F53", "F54", "F67" ], "received": "F27 (B6, FAQ: Does validation … ensure that the entire chain of provenance is known, including ingredients? ¶2): \"While the primary asset’s Content Credential can validate that the ingredients were checked at the time of use, the full verification of each ingredient’s provenance requires access to its data. Without it, only the presence of prior validation (not the complete ingredient chain) can be confirmed.\"; F29 (B6, FAQ: What happens if C2PA metadata is stripped …? ¶1): \"While C2PA Manifests are typically embedded in the asset, they can be separated. To address this, C2PA supports durable credentials via soft bindings—such as invisible watermarking or fingerprinting—that can help rediscover the associated Content Credential even if it’s removed from the file.\"; F32 (B6, FAQ: Can organizations or individuals use Content Credentials to achieve attribution of their content? ¶1): \"The core C2PA Content Credentials specification does not support attribution of content to individuals or organizations, so that it can remain maximally privacy-preserving.\"; F48 (B9, Explainer 2.4 §2 ¶3): \"It is important to highlight that Content Credentials do not provide value judgments about whether a given set of provenance data is 'true', but instead merely whether the provenance information is well-formed and free from tampering, valid and trusted (in that the signer of the Content Credential is associated with a known trust list).\"; F49 (B9, Explainer 2.4 §7.2.1): \"Is provenance always complete? No. Provenance is not always complete. It may happen that an asset is modified in a way that the provenance data is not updated.\"; F50 (B9, Explainer 2.4 §7.2.2): \"provenance information alone cannot tell you whether the digital content is true, accurate or factual.\"; F51 (B9, Explainer 2.4 §7.2.3): \"Can the provenance metadata be removed? Yes it can.\"; F52 (B9, Explainer 2.4 §7.2.4): \"The C2PA specification does not directly address the topic of human or organizational identity — that is, the identity of specific humans or organizations involved in the production of a digital asset or content.\"; F53 (B9, Explainer 2.4 §7.3.2): \"the ingredient’s provenance cannot be verified in the same way as the provenance data of the asset in which it is contained.\"; F54 (B9, Explainer 2.4 §7.5.1): \"Implementers of this standard can have their implementations accredited by the C2PA, which enables users to trust in that implementation. … However, the trust in the contents of a Content Credential is based on the trust relationship between the creator of the Content Credential and the consumer of that Content Credential. This trust relationship is not defined by the C2PA\"; F67 (B13, Content Credentials § Distinction between provenance and factual accuracy): \"Content Credentials merely verify provenance and digital integrity without assessing the objective truth of the content itself. Consequently, a fabricated or misleading image can maintain a valid cryptographic credential that confirms its origin while validating deceptive content as technically authentic.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-16, PE-18, PE-19, D725-04, D725-08, D725-09, D1443-02, D729-03, D729-04, D1444-01, D1003-01, O784-01, CAP-1-03", "archive_claims": [ "PE-16", "PE-18", "PE-19", "D725-04", "D725-08", "D725-09", "D1443-02", "D729-03", "D729-04", "D1444-01", "D1003-01", "O784-01", "CAP-1-03" ] }, { "lineage": "security: tamper evidence asserted and its demonstrated breaks", "field_claims": [ "F31", "F59", "F62", "F66" ], "received": "F31 (B6, FAQ: How secure is C2PA? ¶1–2): \"Any tampering with the asset or its metadata invalidates the cryptographic hash and signature, making alterations immediately detectable. … Faking Content Credentials would require breaking current cryptographic standards—an infeasible task with today’s technology.\"; F59 (B12, Content Authenticity Initiative § Criticism ¶2–3): \"Experts have also documented ways in which attackers can bypass C2PA’s safeguards, by altering provenance metadata, removing or forging watermarks, and mimicking digital fingerprints. … Besides the fact that C2PA doesn't address the question of whether the content is accurate, another shortcoming is that typical signing tools don't verify the accuracy of the metadata either, so users can't rely on the provenance data either unless they have reason to trust that the signer properly verified it.\"; F62 (B13, Content Credentials § C2PA Conformance Program ¶3): \"In October 2026, security researcher David Buchanan demonstrated a vulnerability in the C2PA specification that allows an attacker to alter an image without invalidating its cryptographic signatures or trusted timestamps.\"; F66 (B13, Content Credentials › Mobile apps with Camera Support (Android)): \"In August 2026, security researcher David Buchanan demonstrated that the C2PA implementation on Android is vulnerable to forgery. … root access allows an attacker to command the system to sign arbitrary data, generating fabricated images with valid authenticity signatures. Google recognized the vulnerability but designated the report as \"Won't fix (infeasible)\"\"", "receiving_text": "—", "translation": "untranslated: composed as received beside D725-08, CAP-1-04, CAP-1-08", "archive_claims": [ "D725-08", "CAP-1-04", "CAP-1-08" ] }, { "lineage": "stated limit of the program itself: complete conformance is not yet required", "field_claims": [ "F41" ], "received": "F41 (B7, §6.1.1 Generator Product Specific Requirements): \"The C2PA Content Credentials Specification includes over 300 normative requirements attributed to Generator Products which create C2PA manifests for consumers. The C2PA Conformance Program will eventually require Claim Generators to demonstrate complete conformance to these exacting requirements in order to receive its approval.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-10, PE-21", "archive_claims": [ "PE-10", "PE-21" ] }, { "lineage": "count: 286 conforming product records", "field_claims": [ "F55" ], "received": "F55 (B10, conforming-products-list.json, record 1): \"\"applicant\": \"Google LLC\", \"supportsCompressedManifests\": false, \"status\": \"conformant\", \"product\": { \"productType\": \"generatorProduct\", \"DN\": { \"CN\": \"Pixel Camera\",\"", "receiving_text": "—", "translation": "untranslated: composed as received beside PE-11, CAP-1-05", "archive_claims": [ "PE-11", "CAP-1-05" ] }, { "lineage": "reception: the encyclopedia", "field_claims": [ "F57" ], "received": "F57 (B11, Wikipedia: title C2PA_Conformance_Program): \"raw wikitext (https://en.wikipedia.org/w/index.php?title=C2PA_Conformance_Program&action=raw&redirect=no, 2026-10-29T17:11:57Z): HTTP 404 (Wikimedia Error page; saved as B11.wiki) rendered page (https://en.wikipedia.org/wiki/C2PA_Conformance_Program, 2026-10-29T17:12:33Z): HTTP 404 … Wikipedia does not have an article with this exact name.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside CAP-1-09", "archive_claims": [ "CAP-1-09" ] }, { "lineage": "adoption and its gaps", "field_claims": [ "F63", "F64", "F65" ], "received": "F63 (B13, Content Credentials § C2PA Conformance Program › Conforming Implementations ¶1): \"While the C2PA Conformance Explorer … registry indexes over 200 active products, ecosystem data indicates that 10 organizations have deployed products that simultaneously complete the Conformance Program and achieve on-boarding onto the central C2PA Trust List.\"; F64 (B13, Content Credentials › Cameras ¶1–2): \"As of mid-2026, major dedicated camera manufacturers (Leica, Nikon, and Canon) do not participate in the official C2PA Conformance Program. … As of 2026, no dedicated camera implementations had achieved compliance under the C2PA Conformance Program.\"; F65 (B13, Content Credentials › Desktop Application software ¶1): \"As of mid-2026, no desktop application had achieved compliance under the C2PA Conformance Program.\"", "receiving_text": "—", "translation": "untranslated: composed as received beside D725-03, D499-01, PE-20", "archive_claims": [ "D725-03", "D499-01", "PE-20" ] } ], "receiving_texts": "equal-terms case: every field claim composed as received, beside the archive claims it stands with" }, "measure": { "rule": "v0.9 §4.10: KO_B sentences surviving in the KO at similarity ≥ 0.95, with positions (computed as apply_v09.py does: difflib.SequenceMatcher ratio, the best KO sentence for each KO_B sentence)", "v0.9": { "surviving": 0, "of": 12, "positions": [ null, null, null, null, null, null, null, null, null, null, null, null ] }, "opening_run": { "rule": "v0.9 §5.10 (equal-terms case): the field-only KO's sentences as the KO's opening run in their own order", "breach": false }, "blocks": { "rule": "v0.9 §4.1 (equal-terms and mixed cases): the KO does not open with the field as a block or close with the archive as one; sentences typed by the ledgers of the claims they cite (F field-only, A archive-only, M both)", "sequence": "MFMMFFMAAMFFMMMFAMAMMMMFMAAMMM", "field_only_head": 0, "archive_only_tail": 0, "breach": false }, "max_similarity": [ 0.21, 0.203, 0.065, 0.086, 0.128, 0.525, 0.066, 0.191, 0.436, 0.092, 0.267, 0.17 ], "ko_sentence_1_max_similarity_to_KO_B": 0.21 }, "homonyms": { "names": [ "C2PA Conformance Tool" ], "basis": "The census row carries no disambiguation field; its negative tags ('NOT IPTC embedded metadata'; no judgement of truth; no identity) disambiguate the object, not the name. 'C2PA Conformance Tool' (the C2PA Verify web validator, c2pa-conformulator.netlify.app; Wikipedia, Content Authenticity Initiative, B12) is a distinct entity sharing the name's words: a tool that validates manifests, not the program that designates conforming products; it is not a sense of the name. No card is a homonym.", "distinct_entities": [ "Coalition for Content Provenance and Authenticity (the operator; no Wikipedia article of its own)", "Content Authenticity Initiative (Adobe's coalition, publisher of cards 2 and 3; #615 names it as C2PA)", "Content Credentials / the C2PA specification (what the program certifies conformance to)", "the C2PA Trust List and TSA Trust List (lists the program administers; the census lists the Trust List among the entity's aka)", "Creator Assertions Working Group identity assertions (the extension the Explainer points to for identity)", "Trufo and SSL.com (certification authorities on the Trust List; Trufo hosts the program document)", "IPTC Metawatch (the census record's neighbour; a /non row datasets/negative-of-the-negative/v2/rows/iptc-metawatch.json was not present when this row was written)", "data-provenance-explorer (datasets/negative-of-the-negative/v2/rows/data-provenance-explorer.json names C2PA / Content Credentials, by #725, among the provenance frameworks beside the corpus dimension)" ], "substitutes": { "T": [] }, "register": { "address_1": { "slug": "c2pa-conformance-program-aio-20261029", "obs_id": "OBS-47bccd9af209" } } }, "notes": [ "One address, Google AI Overview (expanded), signed out, incognito, 2026-10-29: c2pa-conformance-program-aio-20261029 (OBS-47bccd9af209, ADDR-c597ce64430f, AXN:0ACC.CAPTURE.♊🌇🧫⚖️🪜🔭), eight cards, 193 words in the answer body with its closer. A NEW address; the census record landed the same day and no card cites it (CAP-1-09).", "Wikipedia: no article 'C2PA Conformance Program' (raw and rendered HTTP 404). The C2PA has no standalone article: 'C2PA' and 'Coalition for Content Provenance and Authenticity' redirect to the section 'Coalition for Content Provenance and Authenticity' of Content Authenticity Initiative, which does not mention the program (B12). The program is a section of the article Content Credentials, '== C2PA Conformance Program ==' with 'Conforming Implementations' (B13), the one article a full-text search for the phrase returns; that section and the article's other statements naming the program are ledgered (F60–F67).", "Fetching: cards B2–B7 saved verbatim with curl on 2026-10-29 between 17:09 and 17:10 UTC; B1 (card 1, which is also the census's own page), B9 and B10 copied from the provenance census's saved sources with the census's url, read date, HTTP code and sha256 (matching); Wikipedia 17:11–17:12 UTC. The Explorer (B4) is a script-rendered page: its served HTML holds only the title, and its text is the UI literals of its bundle main-3SWFN3GG.js (saved whole). Card 7's URL was found by reading trufo.ai's script bundle: the card is the C2PA's own program document v0.2 (PDF, 20 pages, title 'C2PA Conformance Program', by the C2PA Technical Working Group Conformance Task Force) in Trufo's certificate-authority repository; its §2.11 begins with the card's snippet, and the card's date (9 October 2026) is v0.1's sunset in the document's Table 1. Card 8 (Scott Perry, LinkedIn) is unreachable: no URL found by six searches; its snippet stands.", "The fetch times for B2–B7 are the saved files' modification times: the session's fetch log, written to a scratch directory shared with parallel row builders, was overwritten by another builder's log (the iptc-metawatch row's) before it was read; each curl call had reported HTTP 200 with the URLs recorded. In the same directory this builder's build_field.py overwrote a file of the same name left by another builder; this builder's scripts were then moved to scratchpad/c2pa-conformance/.", "Defect in the capture record (reported, not fixed): findings[0] says \"'Risk-based governance' is Trufo's phrase (card 7)\" (CAP-1-02). The phrase is the C2PA's own: the conformance page (B1, card 1) calls the program 'a risk-based, transparent and unbiased governance process' (F3), and card 7 is not a Trufo text but the C2PA's program document v0.2, whose glossary §2.11 opens 'A risk-based governance program' (F36), hosted by Trufo.", "Census record (reported, not fixed): (1) aka lists 'C2PA Trust List', which the program document defines as a list of CA trust anchors the program administers (§2.17), a component rather than another name for the entity; (2) unchecked 'the latest specification version': the saved Explainer 2.4 page (B9) lists 2.5 in its version menu, and the program v0.2 supports specification v2.2 and v2.4 (F44); (3) the census records no third-party source, so the addendum's origin 'census_third_party' is empty; (4) no field of the census is contradicted by a fetched source; the count (286) matches the saved JSON, and the lifecycle (opened June 2025, now v0.2) agrees with B1, B7 and B13. Wikipedia's soft-launch date (4 June 2025) and the version table's sunrise (2 June 2025) differ by two days (open).", "T against its cards (reported): 'run self-test tools' (T1-6) occurs in no fetched source; 'end-to-end tamper evidence' (T1-7) raises the FAQ's 'tamper-evident' against the ingredient and separation limits on the same card (B6 F27, F29).", "Archive defects noted (reported, not fixed): #615 names 'The Content Authenticity Initiative (C2PA)', conflating Adobe's initiative with the coalition; #127 says the manifest 'records authorship' and #1003 that C2PA has 'focused on attribution loss in AI outputs', both against the operator's statement that the core specification does not support attribution (composed under P_coh, opened).", "Field ledger size: 67 claims over 13 sources (above the typical 20–45) because the program's own document (B7, 12 claims) and Explainer (B9, 8 claims) carry the defined terms and stated limits the extraction rule requires; no claim was chosen by how it reads.", "Neighbours: IPTC Metawatch (census relation 'neighbour'; row not present at writing); data-provenance-explorer (rows/data-provenance-explorer.json), which carries #725's C2PA / Content Credentials as the artifact framework beside the corpus dimension. Neither edited." ], "composition_v09": { "source": "this row (composed directly; no rebuild/negative-of-the-negative/v09/c2pa-conformance.json)", "composer": "Claude (Opus 5.5), subagent, 2026-10-29", "defining_material_read": [ { "what": "provenance census record, census row", "file": "/home/claude/fleet/provenance-erasure/data/provenance-census/census.json (rows[slug == 'c2pa-conformance'], organizing_question, schema_note)", "read": "whole" }, { "what": "provenance census record, rendered", "file": "/home/claude/fleet/provenance-erasure/aggregators/c2pa-conformance/index.html", "read": "text, for agreement with the sources" }, { "what": "census saved sources", "file": "/home/claude/fleet/provenance-erasure/data/provenance-census/sources/c2pa-conformance--{conformance,explainer-2.4,products-json}", "read": "whole (the products list counted)" }, { "what": "capture record", "file": "data/EA-WG-CAPTURES-01.json (c2pa-conformance-program-aio-20261029)", "read": "transcript, transcript_raw, cite_list, d, reading, findings, analysis, q_kind, per_note, originator" }, { "dep": 725, "file": "data/texts/AXN-0273-text.md", "read": "whole" }, { "dep": 729, "file": "data/texts/AXN-027C-text.md", "read": "the three-layer table, §8.7 and every passage naming C2PA" }, { "dep": 1443, "file": "data/texts/AXN-05CC-text.md", "read": "§6.1 whole and every passage naming C2PA" }, { "dep": 1444, "file": "data/texts/AXN-05CE-text.md", "read": "the incumbency ring" }, { "dep": 1409, "file": "data/texts/AXN-0592-text.md", "read": "channel C4, §3.4, the open questions, the related-work paragraph, every passage naming C2PA or the Trust List" }, { "dep": 615, "file": "data/texts/AXN-01D0-text.md", "read": "the paragraph naming C2PA" }, { "dep": 127, "file": "data/texts/AXN-02B2-text.md", "read": "§IV.1 and the passages naming C2PA" }, { "what": "the specification", "file": "data/texts/AXN-0700-text.md", "read": "§0–§11 whole; Appendix A to A.5" } ], "cuts": [], "notes": "equal case; KO 30 sentences, all 67 field and 71 archive claims cited; P body 336 words; KO_B 12 sentences, 0 surviving at ≥ 0.95" }, "field_by_origin": { "cards": [ "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8" ], "own_pages": [ "B9", "B10" ], "census_third_party": [], "wikipedia": [ "B11", "B12", "B13" ], "unreachable": [ "B8" ], "title_only": [ "B8" ], "script_rendered": [ "B4" ], "card_also_own_page": [ "B1" ], "wikipedia_state": "no article under the entity's name: 'C2PA Conformance Program' returns HTTP 404 (raw wikitext, redirect=no, and rendered page: 'Wikipedia does not have an article with this exact name.'); the operator has no article of its own either: 'C2PA' and 'Coalition for Content Provenance and Authenticity' are redirects to the section 'Coalition for Content Provenance and Authenticity' of the article Content Authenticity Initiative (revision 1380557793), and that section does not mention the conformance program (the article names only a 'C2PA Conformance Tool', a web validator); the program is a section of the article Content Credentials, '== C2PA Conformance Program ==' with subsection 'Conforming Implementations' (revision 1382375511, last edited 28 October 2026), the one article a full-text search for the phrase returns (2026-10-29)", "sources": [ { "id": "B1", "origin": "card", "also_own_page": true, "role": "Overview card 1 (also the own page the census record cites, c2pa-conformance--conformance)", "card": "Coalition for Content Provenance and Authenticity (C2PA) — Conformance - C2PA", "url": "https://c2pa.org/conformance/", "kind": "Overview card (own page)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 1 } ], "fetched": { "by": "provenance census (copied, not refetched)", "census_source_id": "c2pa-conformance--conformance", "url": "https://c2pa.org/conformance/", "read": "2026-10-29", "fetched_at": "2026-10-29T15:55:23Z", "http": 200, "sha256": "2478cf522501d050fc2ea29118109f6931c5325d1e7745462b69869e0ba5ad54", "copied_from": "/home/claude/fleet/provenance-erasure/data/provenance-census/sources/c2pa-conformance--conformance.html.gz (gunzipped) and c2pa-conformance--conformance.txt" }, "card_title": "Conformance - C2PA", "card_snippet": "The C2PA Conformance Program provides assurance that products adhere to the Content Credentials specification, and fulfill a set of security requirements to ens...", "note": "URL identified by the card's title and snippet (the snippet is the page's second paragraph verbatim). The page is the census's own-page source c2pa-conformance--conformance; per the addendum §3 its saved copy is used (B1.html is the census .html.gz gunzipped, sha256 matches the census record; B1.txt the census's text extraction). Carried once, as a card, with the own-page role recorded.", "files": { "B1.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B1.html", "sha256": "2478cf522501d050fc2ea29118109f6931c5325d1e7745462b69869e0ba5ad54" }, "B1.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B1.txt", "sha256": "6e2785c0be0cf322bd1d10209e29883fd648751137f993a0200373d2e2bf7427" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B2", "origin": "card", "role": "Overview card 2", "card": "Content Authenticity Initiative — C2PA conformance program | Open-source tools for content authenticity and provenance", "url": "https://opensource.contentauthenticity.org/docs/conformance/", "kind": "Overview card (third party: the Content Authenticity Initiative's open-source documentation, © Adobe)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 2 } ], "fetched": { "by": "this row (curl -sSL -m 30 -A 'Mozilla/5.0')", "at": "2026-10-29T17:09:22Z", "http": 200, "url": "https://opensource.contentauthenticity.org/docs/conformance/", "final_url": "https://opensource.contentauthenticity.org/docs/conformance/", "content_type": "text/html; charset=UTF-8", "raw": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B2.html", "raw_sha256": "a77e497ed496753c2d9c019fa32538c7a4042b01c144d9fb8bce326e8992f3f7", "text": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B2.txt", "text_sha256": "6736f72f9e91533fced72be28855c291a08a2e65fcccb6974f67466352d2d171" }, "card_title": "C2PA conformance program | Open-source tools for content authenticity and provenance", "card_snippet": "Overview: The C2PA conformance program ensures products comply with the C2PA Content Credentials specification by adding accepted products to a conforming produ...", "note": "URL by WebSearch on the card's title; page title matches the card title exactly. The snippet's 'Overview:' lead is the composer's label, not page text.", "files": { "B2.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B2.html", "sha256": "a77e497ed496753c2d9c019fa32538c7a4042b01c144d9fb8bce326e8992f3f7" }, "B2.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B2.txt", "sha256": "6736f72f9e91533fced72be28855c291a08a2e65fcccb6974f67466352d2d171" } }, "names_operator": "yes ('C2PA' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B3", "origin": "card", "role": "Overview card 3", "card": "Content Authenticity Initiative — Raising the bar for trust: introducing the C2PA Conformance Program", "url": "https://contentauthenticity.org/blog/raising-the-bar-for-trust-introducing-the-c2pa-conformance-program", "kind": "Overview card (third party: CAI blog post by Andy Parsons, co-chair of the C2PA Conformance Task Force, 9 October 2025)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 3 } ], "fetched": { "by": "this row (curl -sSL -m 30 -A 'Mozilla/5.0')", "at": "2026-10-29T17:09:24Z", "http": 200, "url": "https://contentauthenticity.org/blog/raising-the-bar-for-trust-introducing-the-c2pa-conformance-program", "final_url": "https://contentauthenticity.org/blog/raising-the-bar-for-trust-introducing-the-c2pa-conformance-program", "content_type": "text/html", "raw": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B3.html", "raw_sha256": "957e25fbaccbee4e7658e32fefba1a4074189bc483a585a35eca4dfc97f465c5", "text": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B3.txt", "text_sha256": "954e86c76d79ba53599cf61557be12cf5e4107335d729604b41be8ee93aa1558" }, "card_title": "Raising the bar for trust: introducing the C2PA Conformance Program", "card_snippet": "Program: C2PA Conformance Program launched fully in 2025 by the Coalition for Content Provenance and Authenticity to ensure secure and interoperable implementat...", "note": "URL by WebSearch on the exact title. The card's snippet ('Program: C2PA Conformance Program launched fully in 2025 …') is not page text; it is a generated gloss.", "files": { "B3.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B3.html", "sha256": "957e25fbaccbee4e7658e32fefba1a4074189bc483a585a35eca4dfc97f465c5" }, "B3.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B3.txt", "sha256": "954e86c76d79ba53599cf61557be12cf5e4107335d729604b41be8ee93aa1558" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B4", "origin": "card", "role": "Overview card 4", "card": "C2PA Specifications — C2PA Conformance Explorer", "url": "https://spec.c2pa.org/conformance-explorer/", "kind": "Overview card (own page: the Conformance Explorer)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 4 } ], "fetched": { "by": "this row (curl -sSL -m 30 -A 'Mozilla/5.0')", "at": "2026-10-29T17:09:26Z", "http": 200, "url": "https://spec.c2pa.org/conformance-explorer/", "final_url": "https://spec.c2pa.org/conformance-explorer/", "content_type": "text/html; charset=utf-8", "raw": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B4.html", "raw_sha256": "1b8830b8b9a126b3eb017f4e3e0d2323437e1d1e849262c607175b382c3f03e9", "text": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B4.txt", "text_sha256": "add5f7c134cc0156487aaf30c404dfa5e6cabf09e848348b3b3ee1f98bc8416e", "bundle": { "url": "https://spec.c2pa.org/conformance-explorer/main-3SWFN3GG.js", "at": "2026-10-29T17:09:52Z", "http": 200, "sha256": "9576b26a0d75339b8926bb27a1b42e2980947f4927a42d5f90694b5cbfbca228", "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B4-main-3SWFN3GG.js" } }, "card_title": "C2PA Conformance Explorer", "card_snippet": "Conformance Explorer Toggle dark mode Browse, search, and filter the live versions of the C2PA Conforming Products List, C2PA Trust List, and C2PA TSA Trust Lis...", "note": "URL from the conformance page's link (B1.html) and the program document §6.6.8 (B7). The served HTML is a script shell holding only the title; B4.txt carries the title and then the UI text literals of the page's bundle main-3SWFN3GG.js in bundle order (the snippet's sentence is among them). The bundle loads the three lists from raw.githubusercontent.com/c2pa-org/conformance-public (the products list is B10).", "files": { "B4.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B4.html", "sha256": "1b8830b8b9a126b3eb017f4e3e0d2323437e1d1e849262c607175b382c3f03e9" }, "B4.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B4.txt", "sha256": "add5f7c134cc0156487aaf30c404dfa5e6cabf09e848348b3b3ee1f98bc8416e" }, "B4-main-3SWFN3GG.js": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B4-main-3SWFN3GG.js", "sha256": "9576b26a0d75339b8926bb27a1b42e2980947f4927a42d5f90694b5cbfbca228" } }, "names_operator": "yes ('C2PA' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B5", "origin": "card", "role": "Overview card 5", "card": "SSL.com — How to Submit to the C2PA Conformance Program", "url": "https://www.ssl.com/article/how-to-submit-to-the-c2pa-conformance-program/", "kind": "Overview card (third party: SSL.com, a certification authority on the C2PA Trust List; article datePublished 2026-07-16)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 5 } ], "fetched": { "by": "this row (curl -sSL -m 30 -A 'Mozilla/5.0')", "at": "2026-10-29T17:09:28Z", "http": 200, "url": "https://www.ssl.com/article/how-to-submit-to-the-c2pa-conformance-program/", "final_url": "https://www.ssl.com/article/how-to-submit-to-the-c2pa-conformance-program/", "content_type": "text/html; charset=UTF-8", "raw": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B5.html", "raw_sha256": "c6f361ab501b169213b5819fd8e65950425eaf0712b1afd0fabe582c16d182b2", "text": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B5.txt", "text_sha256": "11e3fbe97489abecbf957f165aa8e24a00809c5cf34a64395a1216b5a80546bf" }, "card_title": "How to Submit to the C2PA Conformance Program", "card_snippet": "Want to keep learning? * Explore C2PA Solutions * The Coalition for Content Provenance and Authenticity (C2PA) maintains a formal conformance program to verify ...", "note": "URL by WebSearch on the exact title.", "files": { "B5.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B5.html", "sha256": "c6f361ab501b169213b5819fd8e65950425eaf0712b1afd0fabe582c16d182b2" }, "B5.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B5.txt", "sha256": "11e3fbe97489abecbf957f165aa8e24a00809c5cf34a64395a1216b5a80546bf" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B6", "origin": "card", "role": "Overview card 6", "card": "Coalition for Content Provenance and Authenticity (C2PA) — C2PA FAQ", "url": "https://c2pa.org/faq/", "kind": "Overview card (own page of the operator: C2PA FAQs)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 6 } ], "fetched": { "by": "this row (curl -sSL -m 30 -A 'Mozilla/5.0')", "at": "2026-10-29T17:09:30Z", "http": 200, "url": "https://c2pa.org/faq/", "final_url": "https://c2pa.org/faqs/", "content_type": "text/html; charset=UTF-8", "raw": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B6.html", "raw_sha256": "2895682fb4ed4f34dc4b2fbe76b61a9b0ddcd52cf15e674ebb4c8ae971bd573a", "text": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B6.txt", "text_sha256": "538d805ef93be9efebda5ceb2701dfb722081effb93b8d903728f1d65ba00a2b" }, "card_title": "C2PA FAQ", "card_snippet": "Content Credentials: Cryptographically secure, tamper-evident provenance data (creation history, tools, edits) traveling with assets; not DRM. Verification: Use...", "note": "URL by site and title (c2pa.org/faq/, which redirects to c2pa.org/faqs/; page title 'C2PA FAQ'). The card's snippet is a generated gloss of the FAQ ('… not DRM. Verification: Use…'), not page text.", "files": { "B6.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B6.html", "sha256": "2895682fb4ed4f34dc4b2fbe76b61a9b0ddcd52cf15e674ebb4c8ae971bd573a" }, "B6.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B6.txt", "sha256": "538d805ef93be9efebda5ceb2701dfb722081effb93b8d903728f1d65ba00a2b" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B7", "origin": "card", "role": "Overview card 7", "card": "trufo.ai — C2PA Conformance Program - Trufo", "url": "https://trufo.ai/tca/repository/c2pa/conformance-program/current.pdf", "kind": "Overview card (the C2PA's own program document, 'C2PA Conformance Program', Version 0.2, 2026-07-31, by the C2PA Technical Working Group Conformance Task Force, as mirrored in Trufo's certificate-authority repository)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 7 } ], "fetched": { "by": "this row (curl -sSL -m 30 -A 'Mozilla/5.0')", "at": "2026-10-29T17:09:31Z", "http": 200, "url": "https://trufo.ai/tca/repository/c2pa/conformance-program/current.pdf", "final_url": "https://trufo.ai/tca/repository/c2pa/conformance-program/current.pdf", "content_type": "application/pdf", "raw": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B7.pdf", "raw_sha256": "d1d4b932320866479fc78abbcd81c35234bdb6f666ca8138fbca71b8bbdf198a", "text": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B7.txt", "text_sha256": "327e3cb2f50e43ad1fe3ae2998788473dfbd467505b632b7fbb9fc1cb558d6c7" }, "card_title": "C2PA Conformance Program - Trufo", "card_snippet": "Oct 9, 2026 — A risk-based governance program intended to hold Applicants who want to demonstrate their conformance to its requirements and then differentiate themselves thro...", "note": "Found by reading trufo.ai: its sitemap (63 URLs) has no page titled 'C2PA Conformance Program'; its script bundle main.5f38c559.js lists the repository document routes, and /tca/repository/c2pa/conformance-program/current.pdf is a 20-page PDF whose metadata title is 'C2PA Conformance Program' and whose §2.11 begins with the card's snippet verbatim ('A risk-based governance program intended to hold Applicants who want to demonstrate their conformance to its requirements and then differentiate themselves thro…'). The card's date 'Oct 9, 2026' is the sunset of program v0.1 in the document's Table 1. The document is C2PA's, not Trufo's: Trufo hosts it as a certification authority. B7.txt is pdftotext -layout of B7.pdf.", "files": { "B7.pdf": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B7.pdf", "sha256": "d1d4b932320866479fc78abbcd81c35234bdb6f666ca8138fbca71b8bbdf198a" }, "B7.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B7.txt", "sha256": "327e3cb2f50e43ad1fe3ae2998788473dfbd467505b632b7fbb9fc1cb558d6c7" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B8", "origin": "card", "role": "Overview card 8", "card": "LinkedIn·Scott Perry — C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn", "url": null, "kind": "Overview card (LinkedIn post by Scott Perry, 31 July 2026)", "surfaced_by_T": [ { "slug": "c2pa-conformance-program-aio-20261029", "card": 8 } ], "fetched": { "status": "unreachable", "tried": [ "WebSearch 'Scott Perry LinkedIn \"C2PA Conformance Program Documents Released\" v0.2' (no LinkedIn result)", "WebSearch 'linkedin.com/posts scott perry c2pa conformance program documents 0.2 upgrade' (no LinkedIn post)", "WebSearch '\"has finally released our Conformance Program documents\"' (no result)", "Google site:linkedin.com search via WebFetch (robots_disallowed)", "DuckDuckGo HTML search via curl (HTTP 403)", "Bing search via curl (HTTP 200, no linkedin.com URL in the results)" ], "at": "2026-10-29" }, "card_title": "C2PA Conformance Program Documents Released v0.2 Upgrade - LinkedIn", "card_snippet": "Jul 31, 2026 — The C2PA has finally released our Conformance Program documents supporting our 0.2 upgrade. This upgrade includes many advances and tools available to applicant...", "note": "The post's URL could not be determined; its title and snippet stand as its only text (§3.1(a)). The date of 31 July 2026 agrees with the v0.2 sunrise in B7's Table 1.", "files": {}, "names_operator": "yes ('The C2PA' in the card snippet)", "names_archive": "no (card title and snippet)" }, { "id": "B9", "origin": "own_page", "role": "own page the census record cites (c2pa-conformance--explainer-2.4); not surfaced by T", "card": "C2PA Specifications — C2PA and Content Credentials Explainer 2.4", "url": "https://spec.c2pa.org/specifications/specifications/2.4/explainer/Explainer.html", "kind": "own page (the operator's Explainer, version 2.4)", "surfaced_by_T": [], "fetched": { "by": "provenance census (copied, not refetched)", "census_source_id": "c2pa-conformance--explainer-2.4", "url": "https://spec.c2pa.org/specifications/specifications/2.4/explainer/Explainer.html", "read": "2026-10-29", "fetched_at": "2026-10-29T15:55:23Z", "http": 200, "sha256": "e1872450e1ae7f6af771812a94d0388322c9b7064f2cdcaa12f0447043dabc7f", "copied_from": "/home/claude/fleet/provenance-erasure/data/provenance-census/sources/c2pa-conformance--explainer-2.4.html.gz (gunzipped) and c2pa-conformance--explainer-2.4.txt" }, "note": "Admitted beside the cards by the operator's ruling (rows built 'as against their wikipedia articles if they exist, their own pages, etc.'); T does not surface it. Saved copy from the census (B9.html gunzipped; B9.txt the census text).", "files": { "B9.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B9.html", "sha256": "e1872450e1ae7f6af771812a94d0388322c9b7064f2cdcaa12f0447043dabc7f" }, "B9.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B9.txt", "sha256": "ae8ce4ee88dd4bdbf29df0f0e783865d0e589aabb52e45db753ec48a6d100319" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B10", "origin": "own_page", "role": "own page the census record cites (c2pa-conformance--products-json); not surfaced by T", "card": "c2pa-org/conformance-public — conforming-products-list.json", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "kind": "own data file (the C2PA Conforming Products List, JSON)", "surfaced_by_T": [], "fetched": { "by": "provenance census (copied, not refetched)", "census_source_id": "c2pa-conformance--products-json", "url": "https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json", "read": "2026-10-29", "fetched_at": "2026-10-29T15:56:59Z", "http": 200, "sha256": "e2fb3928fbb2ba3d019ac02c5ccd40d5e7c974697d9308b7efd966108cd6f4a6", "copied_from": "/home/claude/fleet/provenance-erasure/data/provenance-census/sources/c2pa-conformance--products-json.html.gz (gunzipped) and c2pa-conformance--products-json.txt" }, "note": "Saved copy from the census (B10.json, identical to B10.txt). Counted here: 286 records, all status 'conformant'; 254 generatorProduct, 32 validatorProduct; maxAssuranceLevel 1 for 243 and 2 for 11 generator products; conformanceProgramVersion '0.1' 174, '0.2' 112; 175 distinct applicants (Google LLC 50); conformance dates 2025-06-27 to 2026-10-28.", "files": { "B10.json": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B10.json", "sha256": "e2fb3928fbb2ba3d019ac02c5ccd40d5e7c974697d9308b7efd966108cd6f4a6" }, "B10.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B10.txt", "sha256": "e2fb3928fbb2ba3d019ac02c5ccd40d5e7c974697d9308b7efd966108cd6f4a6" } }, "names_operator": "yes ('C2PA' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B11", "origin": "wikipedia", "role": "Wikipedia: the entity's name", "card": "Wikipedia — C2PA Conformance Program (no article)", "url": "https://en.wikipedia.org/wiki/C2PA_Conformance_Program", "kind": "Wikipedia (no article)", "surfaced_by_T": [], "fetched": { "by": "this row", "raw": { "url": "https://en.wikipedia.org/w/index.php?title=C2PA_Conformance_Program&action=raw&redirect=no", "at": "2026-10-29T17:11:57Z", "http": 404 }, "rendered": { "url": "https://en.wikipedia.org/wiki/C2PA_Conformance_Program", "at": "2026-10-29T17:12:33Z", "http": 404 }, "search": { "url": "https://en.wikipedia.org/w/index.php?search=%22C2PA+Conformance+Program%22&title=Special:Search&profile=advanced&fulltext=1&ns0=1", "at": "2026-10-29T17:12:38Z", "http": 200, "results": [ "Content Credentials" ] }, "redirects": { "C2PA": "Content Authenticity Initiative#Coalition for Content Provenance and Authenticity (HTTP 200, 2026-10-29T17:11:58Z)", "Coalition_for_Content_Provenance_and_Authenticity": "Content Authenticity Initiative#Coalition for Content Provenance and Authenticity (HTTP 200, 2026-10-29T17:11:57Z)" } }, "note": "No article under the name; the phrase occurs in one article, Content Credentials (B13). B11.txt summarises the responses; B11.wiki, B11.html, B11-search.html are the raw responses; the two redirect wikitexts are saved as B12-redirect-*.wiki.", "files": { "B11.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B11.html", "sha256": "d3950ff1e815cc6b577f8cbe6948f761af506af6aea5bdebc4a0fd05229faef0" }, "B11.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B11.txt", "sha256": "d438a4728006d44c6973b050a8ae162ff5190391ade494fbd4e368836275b2c2" }, "B11.wiki": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B11.wiki", "sha256": "05fa797f89ae49bc4db453ee75700a513281b1728643a2e925437be31b33bc5c" }, "B11-search.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B11-search.html", "sha256": "22f5df5b6f1307ab80e758b44eab10a2e5b6a79f0d0caf55e7afd98f554dc3d6" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B12", "origin": "wikipedia", "role": "Wikipedia: the operator, by redirect (C2PA and Coalition for Content Provenance and Authenticity → Content Authenticity Initiative § Coalition for Content Provenance and Authenticity)", "card": "Wikipedia — Content Authenticity Initiative § Coalition for Content Provenance and Authenticity", "url": "https://en.wikipedia.org/wiki/Content_Authenticity_Initiative", "kind": "Wikipedia (redirect target section)", "surfaced_by_T": [], "fetched": { "by": "this row", "raw": { "url": "https://en.wikipedia.org/w/index.php?title=Content_Authenticity_Initiative&action=raw&redirect=no", "at": "2026-10-29T17:12:00Z", "http": 200, "sha256": "b2c8c3508da60e6c0f099a08e566db619df21f21c590df18d7e9655616952bf1" }, "rendered": { "url": "https://en.wikipedia.org/wiki/Content_Authenticity_Initiative", "at": "2026-10-29T17:12:36Z", "http": 200, "sha256": "2665c40cc843a5c5716cc5e80653b0db32037e57daafdbf15838ea6c61d21b42", "revision": 1380557793, "last_edited": "16 October 2026, at 13:37" } }, "note": "The operator has no article of its own: both names redirect to a section of the Content Authenticity Initiative article. That section does not mention the conformance program; the article names only a 'C2PA Conformance Tool' (a web validator, a distinct entity) and, in its Criticism section, limits of C2PA. Ledgered: the redirect section's opening and the Criticism section's statements on C2PA. B12.txt is the rendered page's text.", "files": { "B12.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B12.html", "sha256": "2665c40cc843a5c5716cc5e80653b0db32037e57daafdbf15838ea6c61d21b42" }, "B12.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B12.txt", "sha256": "38c953646fca99b943ce5f022cdf56e46ade391b0b5fb3dec42697b3f5827d8a" }, "B12.wiki": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B12.wiki", "sha256": "b2c8c3508da60e6c0f099a08e566db619df21f21c590df18d7e9655616952bf1" }, "B12-redirect-C2PA.wiki": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B12-redirect-C2PA.wiki", "sha256": "fc5cffc04284c383b944fc87dc53b8aa7f864ddbe6b5acc265f7f1560d1423ee" }, "B12-redirect-Coalition_for_Content_Provenance_and_Authenticity.wiki": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B12-redirect-Coalition_for_Content_Provenance_and_Authenticity.wiki", "sha256": "2972bd6eb325be506de3890faa757292db1fd0f9d30952b0b9dc5f559714e179" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" }, { "id": "B13", "origin": "wikipedia", "role": "Wikipedia: the conformance program as a section (Content Credentials § C2PA Conformance Program, with subsection Conforming Implementations)", "card": "Wikipedia — Content Credentials § C2PA Conformance Program", "url": "https://en.wikipedia.org/wiki/Content_Credentials#C2PA_Conformance_Program", "kind": "Wikipedia (section of another article)", "surfaced_by_T": [], "fetched": { "by": "this row", "raw": { "url": "https://en.wikipedia.org/w/index.php?title=Content_Credentials&action=raw&redirect=no", "at": "2026-10-29T17:12:02Z", "http": 200, "sha256": "53ed327ab084c01ecf1a3d5dc36912c0682f08714327624fb349b922f52ddecd" }, "rendered": { "url": "https://en.wikipedia.org/wiki/Content_Credentials", "at": "2026-10-29T17:12:37Z", "http": 200, "sha256": "5bfabcbc373de07263c944cb6c90a1e369cc1e238e445b08f38ba783e1721f74", "revision": 1382375511, "last_edited": "28 October 2026, at 11:08" } }, "note": "The conformance program is a section of the article Content Credentials. Ledgered: that section and its subsection's lead, and the article's other statements that name the program (the cameras, Android and desktop subsections), with the adjacent section 'Distinction between provenance and factual accuracy'. B13.txt is the rendered page's text.", "files": { "B13.html": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B13.html", "sha256": "5bfabcbc373de07263c944cb6c90a1e369cc1e238e445b08f38ba783e1721f74" }, "B13.txt": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B13.txt", "sha256": "720a27a5751eaf0f348e1364390b1971f4e475b960c9ff6dc3512efe1b846a57" }, "B13.wiki": { "path": "datasets/negative-of-the-negative/v2/intake/c2pa-conformance-20261029/B13.wiki", "sha256": "53ed327ab084c01ecf1a3d5dc36912c0682f08714327624fb349b922f52ddecd" } }, "names_operator": "yes ('C2PA', 'Coalition for Content Provenance and Authenticity' in the saved text)", "names_archive": "no (none of the Crimson Hexagonal Archive, Alexanarch, Lee Sharks, provenanceerasure, machinemediation, EA-WG-CAPTURES-01 in the saved text, card title and snippet)" } ] } }