# Asset provenance fields Current Loom-to-case provenance boundary. When case-assets binds a Loom-minted asset, `provenanceFor` derives a deterministic local claim handle from the asset's locator (a digest over url+seed) and says so explicitly — `hashScope: 'locator'`, `signed: false` — rather than presenting a locator digest as a byte-bound C2PA claim. A downstream signer that actually fetches and hashes the media bytes is the only party that may upgrade an entry to `hashScope: 'asset-bytes'` with `signed: true`. `recordProvenance` then preserves each hash's declared scope and signed state per asset when the case is published, and folds the model versions and canon hash into the case's reproducibility key — the audit row Sekhmet and legal read when a contested case must be regenerated exactly. The reading rule: digest scope and signed state must travel with every `contentHash`; consult `signed` before calling anything a C2PA claim, and consult `hashScope` before treating a digest as authenticating media bytes. ## Runtime sources - `libs/yemaya/case-contracts/src/asset-manifest.ts` - `libs/yemaya/case-assets/src/bind.ts` - `libs/yemaya/case-pipeline/src/provenance.ts` ## Exercised by - `libs/yemaya/case-assets/src/bind.test.ts` - `libs/yemaya/case-pipeline/src/pipeline.test.ts` ## Field contract | Field | Current producer | Current behavior | | --- | --- | --- | | `claimId` | case-assets provenanceFor or an existing library handle | A claim handle; it is a signed C2PA claim only when signed is true. | | `contentHash` | case-assets provenanceFor or a downstream byte signer | A SHA-256 digest whose meaning is incomplete without hashScope. | | `hashScope` | case-assets provenanceFor | locator for Loom's url+seed digest; asset-bytes only after media bytes are fetched and hashed. | | `signed` | case-assets provenanceFor or a downstream signer | false on the current Loom path; true only for a real signed C2PA claim. | | `recordProvenance.assets[]` | case-pipeline recordProvenance | Copies claimId/contentHash and retains normalized hashScope/signed values for every asset. | ## Claim boundary - Legacy records with no hashScope normalize to locator and with no signed flag normalize to false — normalization only ever narrows a claim, never upgrades one. - A locator digest detects manifest locator changes; it does not authenticate media bytes. - The pipeline preserves a downstream byte-bound signed claim as-is while leaving locator handles untouched, so signed and unsigned assets can coexist in one case record without cross-contamination. - The reproducibility key digests the generation seed, sorted model versions, and canon hash together; provenance and exact regeneration therefore travel as one audit surface. Contract: `scripts/audit/machine-adjacent-doc-contract.json`. Regenerate with `pnpm generate:audit:machine-adjacent-docs`.