Ariadne · Architecture

Asset provenance fields

A focused page within the Ariadne Architecture documentation. The full map and every sibling page live in the Architecture hub.

4sections2 minread1table
← Back to the Architecture hubMarkdown source
On this page

Current Loom-to-case provenance boundary. When case-assets binds a Loom-minted asset, provenanceFor derives a deterministic local claim handle from the asset's locator (a digest over url+seed) and says so explicitly — hashScope: 'locator', signed: false — rather than presenting a locator digest as a byte-bound C2PA claim. A downstream signer that actually fetches and hashes the media bytes is the only party that may upgrade an entry to hashScope: 'asset-bytes' with signed: true. recordProvenance then preserves each hash's declared scope and signed state per asset when the case is published, and folds the model versions and canon hash into the case's reproducibility key — the audit row Sekhmet and legal read when a contested case must be regenerated exactly. The reading rule: digest scope and signed state must travel with every contentHash; consult signed before calling anything a C2PA claim, and consult hashScope before treating a digest as authenticating media bytes.

Runtime sources#

  • libs/yemaya/case-contracts/src/asset-manifest.ts
  • libs/yemaya/case-assets/src/bind.ts
  • libs/yemaya/case-pipeline/src/provenance.ts

Exercised by#

  • libs/yemaya/case-assets/src/bind.test.ts
  • libs/yemaya/case-pipeline/src/pipeline.test.ts

Field contract#

Field Current producer Current behavior
claimId case-assets provenanceFor or an existing library handle A claim handle; it is a signed C2PA claim only when signed is true.
contentHash case-assets provenanceFor or a downstream byte signer A SHA-256 digest whose meaning is incomplete without hashScope.
hashScope case-assets provenanceFor locator for Loom's url+seed digest; asset-bytes only after media bytes are fetched and hashed.
signed case-assets provenanceFor or a downstream signer false on the current Loom path; true only for a real signed C2PA claim.
recordProvenance.assets[] case-pipeline recordProvenance Copies claimId/contentHash and retains normalized hashScope/signed values for every asset.

Claim boundary#

  • Legacy records with no hashScope normalize to locator and with no signed flag normalize to false — normalization only ever narrows a claim, never upgrades one.
  • A locator digest detects manifest locator changes; it does not authenticate media bytes.
  • The pipeline preserves a downstream byte-bound signed claim as-is while leaving locator handles untouched, so signed and unsigned assets can coexist in one case record without cross-contamination.
  • The reproducibility key digests the generation seed, sorted model versions, and canon hash together; provenance and exact regeneration therefore travel as one audit surface.

Contract: scripts/audit/machine-adjacent-doc-contract.json. Regenerate with pnpm generate:audit:machine-adjacent-docs.