1. Presence is not a verdict
The first result only states whether a readable C2PA manifest was observed. A camera, editor or platform may never have added credentials, and later workflows can remove metadata.
2. Integrity and trust answer different questions
Cryptographic validation checks signatures, hashes and asset binding. A valid result can coexist with an untrusted signer when the certificate is outside the verifier's local trust anchors.
3. AI Disclosure is a declaration
The tool exposes c2pa.ai-disclosure and supported digital source types. It does not run a visual classifier or treat a missing declaration as evidence that AI was absent.
4. The timeline preserves declared evidence
Actions retain manifest presentation order. An action when value is labeled manifest-declared and untrusted; a validated TSA timestamp is shown separately so the two time sources are not conflated.
5. Trust diagnostics preserve their boundary
The workbench shows sanitized signer and TSA leaf summaries, path roles and validation decisions. It does not expose serials, certificate bytes, intermediate/root objects or claim to reconstruct the complete x5chain.
6. Two-file comparison separates bytes from evidence
SHA-256 establishes exact byte identity while structured Manifest Diff shows changed manifest labels, assertions, actions, ingredients, signer fields and validation codes. A difference does not identify its cause or author.
7. Batch review keeps one independent row per file
Up to 2,000 files are processed sequentially with one full report in memory at a time. Results render 100 rows per page, errors remain visible, and descriptive totals are never converted into a quality, risk or truth score.
8. Source assets remain in the browser
The pinned CAI verifier and WebAssembly are self-hosted and load only after file selection. There is no remote trust list or browser storage, and aggregate metrics use fixed labels.
9. The Evidence Package preserves interoperable artifacts
The BagIt 1.0 ZIP carries SHA-256 payload and tag manifests, PROV-JSONLD, provenance timeline and trust diagnostics. It is an H/M profile, not an official C2PA package standard.
10. The audit report preserves context and a local chain
The audit ZIP adds canonical JSON, provenance timeline, trust diagnostics, print-ready HTML, Markdown, verification results and a locally hash-chained custody record. It detects changes but does not digitally sign the report or authenticate the operator.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does a valid Content Credential prove an image is true?
No. It supports cryptographic integrity of signed evidence and its asset binding within the validator's scope, not the semantic truth of a scene or claim.
Does no Content Credential mean the file is fake or AI-generated?
No. Absence is a neutral observation and cannot establish origin, authenticity or AI use.
Why can integrity be valid while the signer is untrusted?
The signature can be mathematically valid while its certificate chain does not terminate at a trust anchor available to this local verifier.
Is the credential path the complete x5chain?
No. It is a sanitized view of observed leaves and roles; it excludes serials, certificate bytes and intermediate/root certificate objects.
What does a difference between two files prove?
Only that the bytes or observed evidence fields differ. It does not establish who made a change, why it occurred or whether the content is true.
Is the batch summary a score?
No. It contains descriptive counts for reads, manifests, errors and validation states; it does not rank quality, risk or authenticity.
Are files uploaded or stored in the browser?
No. They are processed locally, the page uses no localStorage, sessionStorage or IndexedDB, and the verifier does not query a remote trust list.
Is the audit report digitally signed?
No. Its hashes detect local changes, but they do not authenticate the operator, organization or exporter.