Week 11 Workshop: Chain of custody

What does a provenance record establish, and what can it omit?

12 May 2027

What does a provenance record establish, and what can it omit?

Learning target. Distinguish recorded history, missing history and the truth of a claim.

Before the workshop#

Download the week 11 pack: manifest-before.json (metadata recorded when image/output-7, from week 4, was deposited into the archive), manifest-after.json (metadata on the public archive copy), and stripping-log.txt (the publishing pipeline’s own account of what it changed between the two). Do not open reveal/ yet.

Reading. C2PA Technical Specification v2.1, §1.2 Scope and §2.3.10 Authenticity, freely available at spec.c2pa.org. Read for what “authenticity” means in this specification: a set of assertions that can be cryptographically verified as tied to a signer’s key and free of tampering since signing — not a judgement that the assertions themselves are true. This week’s manifests are plain, unsigned JSON, not C2PA credentials, and the difference is the point.

Check — 5 minutes#

The stripping log names two operations: removing contributorId and removing depositTimestamp. Comparing the two manifests directly, name one field that changed between them that the log does not mention.

Receive — 15 minutes#

Confirm you can state, in your own words, the difference between a field that is retained (present and unchanged), a field that underwent a documented removal (absent, and the log says why), a field with an undocumented change (different between the manifests, but the log is silent about it), and a field that was never captured (absent in both manifests, at every stage — its absence is not this operation’s doing).

Investigate — 40 minutes#

Compare the two manifests against the log (15 minutes). For each field present in either manifest, record whether it appears in manifest-before.json, whether it appears in manifest-after.json, and whether the stripping log mentions it changing.

Classify every field (15 minutes). Using the four categories from Receive, classify every field into your own copy of the worksheet. Pay particular attention to gpsCoordinates and cameraModel: both are absent from both manifests. Before concluding the stripping operation removed them, check whether they were ever present to remove — per week 4, Output 7 never retained EXIF at any stage.

Propose one proportionate archive-policy improvement (10 minutes). Given what the log did and did not capture, propose one specific, bounded change to what the publishing pipeline logs — not a demand for full cryptographic signing, which is a different and much larger commitment (see this week’s reading). State what your proposed change would have caught here, and what it still would not catch.

Evaluate — 30 minutes#

Write your completed audit worksheet before opening reveal/. Then answer: if you had trusted the stripping log alone, without comparing the manifests field by field, which of your findings would you have missed? Name one way a provenance record that cites another provenance record — rather than an independent, retained measurement — can loop back on itself without ever being checked against anything outside the loop, and say why that is not the same failure as this week’s undocumented rename.

Deposit — 30 minutes#

Open reveal/analysis.md (ask your tutor for the link once your worksheet is done) and compare it against your own worksheet. Deposit your completed audit worksheet, labelled by field, into the Image collection. Week 12 reuses this audit; do not attempt to re-verify every earlier week’s evidence from scratch.

Accessible route#

manifest-before.json, manifest-after.json and stripping-log.txt are all plain text; no image needs to be looked at.

Assessment#

Peer review the scope, assumptions and costing in another student’s draft for The Lossless Argument using a short checklist: does their preservation proposal name what a provenance record in their scenario would and would not establish, the way this week’s audit does?