NOTHING LEAVES UNSEALED
Provenance is the one layer the platform admits can be stripped — which is exactly why the fleet refuses to strip it. The Seal reads and verifies content credentials, carries metadata through the conform untouched, fails the build if provenance is lost, and scans every surface for the marks of somebody else's stamp.
THE LAYER THAT READS THE METADATA
Provenance and AI labeling is a file-level domain, always on, every upload: the platform reads C2PA content credentials, IPTC metadata and invisible watermarks, and labels what it finds. The file domain's cost when it fires against you is mute, block or claim — lose a post, recoverable; its signals also feed ranking and originality. The platform openly concedes this is the one layer where stripping works — and the docs are precise about why that is not an opening: stripped provenance does nothing to the other four domains, and a stripped stamp is a lie in the one place the record is meant to be trusted. The Seal exists to do the opposite: preserve every mark, forge none, and detect the marks that shouldn't be there.
WHAT THE STAMP CAN DO
| Capability | Evidence | Status |
|---|---|---|
| C2PA content-credential read and verify | T-070 | LANDED |
| IPTC/XMP metadata preserved through the conform, byte for byte of meaning | T-071 | LANDED |
| Provenance lost during conform fails the build — not a warning, a failure | T-072 | LANDED |
| Any synthetic capture-metadata write is blocked | T-073 | LANDED |
| Assertion: no fingerprint-altering transforms exist in any encode profile | T-069 | LANDED |
| Observed provenance signals recorded per asset — what the stamp saw, kept | T-074 | LANDED |
| Frame sampling strategy for scanning video without scanning every frame | T-075 | LANDED |
| Watermark template match against the platform watermark library | T-076 | LANDED |
| OCR text detection over the corner regions where reposts carry their history | T-077 | LANDED |
| Confidence scoring with routing to human review — the stamp doesn't guess alone | T-078 | LANDED |
| Labelled evaluation set with measured recall — published, not assumed | T-079 | LANDED |
| The byte-identity gate runs on no CI commit, so a hand-authored capture would pass it | #205 | OPEN QUESTION |
LANDED MEANS MERGED WITH TESTS IN THE REPOSITORY — NOTHING HERE IS GENERALLY AVAILABLE YET. THE OPEN QUESTION IS LISTED BECAUSE WE DOCUMENT GAPS.
WHAT THE STAMP EXPOSES
A recycled asset wearing somebody else's watermark is a claim waiting to land. The template match and the corner-region OCR find the previous owner's marks before the crawlers do.
GREY FOG →Provenance signals feed the platform's originality inputs. Content that arrives already stamped by another platform is exactly what the fog condenses around — the Seal flags it at intake, while it is still a choice.
The Seal rides media-pipeline, directly after MEDIACONFORM in the same stateless run: probe, conform, validate — then the provenance check and the watermark scan, then the thumbnail. The surface is stamped before the artefact leaves the deck; nothing reaches the orchestrator without its wax.
Nothing leaves unsealed, and no seal is ever forged. Provenance lost in transit fails the build — because the stamp is only worth what it refuses to counterfeit.
WHY THE WAX IS PRESSED AT THE DOCK — NOT PAINTED ON AT SEA