Lilith Metaverse · Reference & analysis

V3 C2PA Every Export

The runtime coverage gate is

2sections1 minread
Markdown source
On this page

Manifest version: v3-c2pa-every-export.v1

Saraswati concert recording exports are now checked at the export-ledger level: every video/mp4 and audio/wav concert recording export must have a matching C2PA manifest write, the manifest must match the exported recording id, media family, MIME type, destination path, and sidecar path, and the C2PA reader must validate the assertion set required by Adobe CAI tooling.

Runtime Gate#

The runtime coverage gate is apps/v3/saraswati-service/src/c2pa_export_coverage.rs.

It evaluates:

  • Video and audio export presence.
  • One matching C2PA manifest write for every recording export.
  • Adobe CAI-valid verification through C2paManifestVerification.
  • Required assertions: c2pa.actions.v2, org.oshun.v3.concert-recording, org.oshun.v3.recording-consent, org.oshun.v3.rights-waterfall, org.oshun.v3.generated-artifact-provenance, and org.oshun.v3.adobe-cai-verification.
  • Negative controls for missing manifests, mismatched media metadata, duplicate manifest writes, and missing Adobe CAI assertions.

The underlying manifest writer remains write_concert_recording_c2pa_manifest, which signs video/mp4 and audio/wav exports through c2pa-rs and verifies sidecar manifests with the C2PA reader.

Release Gate#

The analytics manifest is libs/oshun/analytics/src/v3-c2pa-every-export.ts; the machine-readable evidence is V3/security/c2pa-every-export-validation.json.

Verification command: pnpm verify:v3 c2pa-every-export

bash
pnpm verify:v3 c2pa-every-export

The gate fails closed if any concert recording export is missing a manifest write, if a write is duplicated, if a manifest does not match the export media, or if Adobe CAI verification loses a required assertion.