{
  "schema": "checkaifree.credential-scenes.v1",
  "source": "Project-authored unsigned/absent/unreadable PNG controls. The readable public example has no signature box and is not a valid signed credential.",
  "computation": "Actual local reader observations, original-file SHA-256 and default allowlisted reports. No signatures, certificate trust or asset binding were verified; no Canvas/browser interaction is asserted.",
  "scenes": [
    {
      "id": "S-H06-READ",
      "input": {
        "path": "/samples/content-credentials/unsigned.png",
        "report": {
          "schema": "checkaifree.c2pa-read-report.v1",
          "file": {
            "algorithm": "SHA-256",
            "sha256": "9f93391cb723bded7289314abedca7c7ae1b25c6456fbf2c1fa8441461593c4f",
            "bytes": 534
          },
          "reading": {
            "status": "manifest_read",
            "format": "png",
            "store": "found",
            "readableManifests": 1,
            "warningCount": 0,
            "summary": "One or more manifest claims were read. Stored declarations are not verified provenance. Signatures, certificate trust and asset binding were not verified.",
            "signatureVerification": "not_verified"
          },
          "verification": {
            "status": "not_verified",
            "signatureVerified": false,
            "certificateTrustVerified": false,
            "assetBindingVerified": false,
            "statement": "Signatures, certificate trust and asset binding were not verified."
          },
          "privacy": {
            "filenameIncluded": false,
            "storedDeclarationsIncluded": false,
            "unknownActionCodes": "aliased",
            "note": "Defaults omit manifest labels, generators, signer names, ingredient titles, software agents, source-type URLs, assertion labels and raw warnings. Opted-in declarations may contain personal information. The file hash is included to identify these exact bytes; it does not certify authenticity."
          },
          "manifests": [
            {
              "alias": "manifest-001",
              "signatureVerification": "not_verified",
              "signatureBoxPresent": false,
              "aiSourceTypeAssertionRead": false,
              "actions": [
                {
                  "code": "c2pa.created",
                  "label": "Created"
                }
              ],
              "ingredientCount": 0,
              "assertionCount": 1,
              "warningCount": 0
            }
          ],
          "reference": {
            "version": "2.2",
            "url": "https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html",
            "scope": "Fixed subset of standard action names, including legacy names. Other action codes are aliased by default; stored actions are declarations, not verified events."
          },
          "limitations": [
            "This records a local reading and a hash of the original file bytes, not cryptographic validation, certificate trust or asset binding.",
            "Absence applies only to supported JPEG APP11 and PNG caBX locations. Unsupported, damaged, limited and present-but-unreadable results are not absence results.",
            "Manifest fields and actions are the bounded subset returned by this reader, not a complete raw manifest export. The reader retains at most 32 actions, 32 ingredients and 64 assertion labels per manifest.",
            "Stored action text and AI source-type assertions are declarations. They do not establish who created the file, whether the events happened, or whether its pixels are AI-generated.",
            "The input file is unchanged. No URL, action, script or workflow was requested or executed, and no credential was re-signed."
          ]
        }
      },
      "failureBranch": "A readable unsigned claim is not cryptographic validation, and stored actions are declarations."
    },
    {
      "id": "S-H06-ABSENT",
      "input": {
        "path": "/samples/content-credentials/absent.png",
        "report": {
          "schema": "checkaifree.c2pa-read-report.v1",
          "file": {
            "algorithm": "SHA-256",
            "sha256": "5e3d382db4dd83d59aa5742793ad6b7903409e865c83bcbc54835049f043bc15",
            "bytes": 68
          },
          "reading": {
            "status": "absent",
            "format": "png",
            "store": "not_found_in_supported_locations",
            "readableManifests": 0,
            "warningCount": 0,
            "summary": "No embedded C2PA store was found in the supported container locations. This is not a verdict about the pixels or their origin. Signatures, certificate trust and asset binding were not verified.",
            "signatureVerification": "not_verified"
          },
          "verification": {
            "status": "not_verified",
            "signatureVerified": false,
            "certificateTrustVerified": false,
            "assetBindingVerified": false,
            "statement": "Signatures, certificate trust and asset binding were not verified."
          },
          "privacy": {
            "filenameIncluded": false,
            "storedDeclarationsIncluded": false,
            "unknownActionCodes": "aliased",
            "note": "Defaults omit manifest labels, generators, signer names, ingredient titles, software agents, source-type URLs, assertion labels and raw warnings. Opted-in declarations may contain personal information. The file hash is included to identify these exact bytes; it does not certify authenticity."
          },
          "manifests": [],
          "reference": {
            "version": "2.2",
            "url": "https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html",
            "scope": "Fixed subset of standard action names, including legacy names. Other action codes are aliased by default; stored actions are declarations, not verified events."
          },
          "limitations": [
            "This records a local reading and a hash of the original file bytes, not cryptographic validation, certificate trust or asset binding.",
            "Absence applies only to supported JPEG APP11 and PNG caBX locations. Unsupported, damaged, limited and present-but-unreadable results are not absence results.",
            "Manifest fields and actions are the bounded subset returned by this reader, not a complete raw manifest export. The reader retains at most 32 actions, 32 ingredients and 64 assertion labels per manifest.",
            "Stored action text and AI source-type assertions are declarations. They do not establish who created the file, whether the events happened, or whether its pixels are AI-generated.",
            "The input file is unchanged. No URL, action, script or workflow was requested or executed, and no credential was re-signed."
          ]
        }
      },
      "failureBranch": "Absence is scoped to supported JPEG APP11/PNG caBX locations. Unsupported, damaged and limited reads are not absence."
    },
    {
      "id": "S-H06-UNREADABLE",
      "input": {
        "path": "/samples/content-credentials/unreadable.png",
        "report": {
          "schema": "checkaifree.c2pa-read-report.v1",
          "file": {
            "algorithm": "SHA-256",
            "sha256": "d01cced5823be700073942995856a92f1c18d26d52c61da23e8c17387ab4f025",
            "bytes": 83
          },
          "reading": {
            "status": "present_unreadable",
            "format": "png",
            "store": "found",
            "readableManifests": 0,
            "warningCount": 1,
            "summary": "Embedded credential storage or JUMBF packets were found, but no manifest claim was read. Storage may be incomplete, damaged or outside this reader's supported structure; absence was not inferred. Signatures, certificate trust and asset binding were not verified.",
            "signatureVerification": "not_verified"
          },
          "verification": {
            "status": "not_verified",
            "signatureVerified": false,
            "certificateTrustVerified": false,
            "assetBindingVerified": false,
            "statement": "Signatures, certificate trust and asset binding were not verified."
          },
          "privacy": {
            "filenameIncluded": false,
            "storedDeclarationsIncluded": false,
            "unknownActionCodes": "aliased",
            "note": "Defaults omit manifest labels, generators, signer names, ingredient titles, software agents, source-type URLs, assertion labels and raw warnings. Opted-in declarations may contain personal information. The file hash is included to identify these exact bytes; it does not certify authenticity."
          },
          "manifests": [],
          "reference": {
            "version": "2.2",
            "url": "https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html",
            "scope": "Fixed subset of standard action names, including legacy names. Other action codes are aliased by default; stored actions are declarations, not verified events."
          },
          "limitations": [
            "This records a local reading and a hash of the original file bytes, not cryptographic validation, certificate trust or asset binding.",
            "Absence applies only to supported JPEG APP11 and PNG caBX locations. Unsupported, damaged, limited and present-but-unreadable results are not absence results.",
            "Manifest fields and actions are the bounded subset returned by this reader, not a complete raw manifest export. The reader retains at most 32 actions, 32 ingredients and 64 assertion labels per manifest.",
            "Stored action text and AI source-type assertions are declarations. They do not establish who created the file, whether the events happened, or whether its pixels are AI-generated.",
            "The input file is unchanged. No URL, action, script or workflow was requested or executed, and no credential was re-signed."
          ]
        }
      },
      "failureBranch": "Storage is found despite zero readable claims; do not replace present_unreadable with absent."
    }
  ],
  "removalCopy": {
    "input": {
      "path": "/samples/content-credentials/unsigned.png",
      "report": {
        "schema": "checkaifree.c2pa-read-report.v1",
        "file": {
          "algorithm": "SHA-256",
          "sha256": "9f93391cb723bded7289314abedca7c7ae1b25c6456fbf2c1fa8441461593c4f",
          "bytes": 534
        },
        "reading": {
          "status": "manifest_read",
          "format": "png",
          "store": "found",
          "readableManifests": 1,
          "warningCount": 0,
          "summary": "One or more manifest claims were read. Stored declarations are not verified provenance. Signatures, certificate trust and asset binding were not verified.",
          "signatureVerification": "not_verified"
        },
        "verification": {
          "status": "not_verified",
          "signatureVerified": false,
          "certificateTrustVerified": false,
          "assetBindingVerified": false,
          "statement": "Signatures, certificate trust and asset binding were not verified."
        },
        "privacy": {
          "filenameIncluded": false,
          "storedDeclarationsIncluded": false,
          "unknownActionCodes": "aliased",
          "note": "Defaults omit manifest labels, generators, signer names, ingredient titles, software agents, source-type URLs, assertion labels and raw warnings. Opted-in declarations may contain personal information. The file hash is included to identify these exact bytes; it does not certify authenticity."
        },
        "manifests": [
          {
            "alias": "manifest-001",
            "signatureVerification": "not_verified",
            "signatureBoxPresent": false,
            "aiSourceTypeAssertionRead": false,
            "actions": [
              {
                "code": "c2pa.created",
                "label": "Created"
              }
            ],
            "ingredientCount": 0,
            "assertionCount": 1,
            "warningCount": 0
          }
        ],
        "reference": {
          "version": "2.2",
          "url": "https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html",
          "scope": "Fixed subset of standard action names, including legacy names. Other action codes are aliased by default; stored actions are declarations, not verified events."
        },
        "limitations": [
          "This records a local reading and a hash of the original file bytes, not cryptographic validation, certificate trust or asset binding.",
          "Absence applies only to supported JPEG APP11 and PNG caBX locations. Unsupported, damaged, limited and present-but-unreadable results are not absence results.",
          "Manifest fields and actions are the bounded subset returned by this reader, not a complete raw manifest export. The reader retains at most 32 actions, 32 ingredients and 64 assertion labels per manifest.",
          "Stored action text and AI source-type assertions are declarations. They do not establish who created the file, whether the events happened, or whether its pixels are AI-generated.",
          "The input file is unchanged. No URL, action, script or workflow was requested or executed, and no credential was re-signed."
        ]
      }
    },
    "output": {
      "path": "/samples/content-credentials/removed.png",
      "report": {
        "schema": "checkaifree.c2pa-read-report.v1",
        "file": {
          "algorithm": "SHA-256",
          "sha256": "e878950f8091ec010cf5cc723bdea027a8539cf7147cfea199c2f666232dcd4e",
          "bytes": 69
        },
        "reading": {
          "status": "absent",
          "format": "png",
          "store": "not_found_in_supported_locations",
          "readableManifests": 0,
          "warningCount": 0,
          "summary": "No embedded C2PA store was found in the supported container locations. This is not a verdict about the pixels or their origin. Signatures, certificate trust and asset binding were not verified.",
          "signatureVerification": "not_verified"
        },
        "verification": {
          "status": "not_verified",
          "signatureVerified": false,
          "certificateTrustVerified": false,
          "assetBindingVerified": false,
          "statement": "Signatures, certificate trust and asset binding were not verified."
        },
        "privacy": {
          "filenameIncluded": false,
          "storedDeclarationsIncluded": false,
          "unknownActionCodes": "aliased",
          "note": "Defaults omit manifest labels, generators, signer names, ingredient titles, software agents, source-type URLs, assertion labels and raw warnings. Opted-in declarations may contain personal information. The file hash is included to identify these exact bytes; it does not certify authenticity."
        },
        "manifests": [],
        "reference": {
          "version": "2.2",
          "url": "https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html",
          "scope": "Fixed subset of standard action names, including legacy names. Other action codes are aliased by default; stored actions are declarations, not verified events."
        },
        "limitations": [
          "This records a local reading and a hash of the original file bytes, not cryptographic validation, certificate trust or asset binding.",
          "Absence applies only to supported JPEG APP11 and PNG caBX locations. Unsupported, damaged, limited and present-but-unreadable results are not absence results.",
          "Manifest fields and actions are the bounded subset returned by this reader, not a complete raw manifest export. The reader retains at most 32 actions, 32 ingredients and 64 assertion labels per manifest.",
          "Stored action text and AI source-type assertions are declarations. They do not establish who created the file, whether the events happened, or whether its pixels are AI-generated.",
          "The input file is unchanged. No URL, action, script or workflow was requested or executed, and no credential was re-signed."
        ]
      }
    },
    "selected": [
      "c2pa"
    ],
    "originalIdatRetained": true,
    "note": "Whole PNG caBX removal; no credential was re-signed and no before/after validity transition is asserted."
  },
  "externalReferences": [
    {
      "name": "C.jpg",
      "source": "https://github.com/contentauth/c2pa-rs/blob/60f7cbdc69ab7a2554fcc87eb4df77050814b2cf/sdk/tests/fixtures/C.jpg",
      "sha256": "a2d14755db55de67a47c04090340d8266e892367be4104a45626d7a6fa6e9ffd",
      "distribution": "Not mirrored. Obtain original from fixed upstream source.",
      "priorReferenceRead": "manifest_read; one APP11 packet; signature box present; not verified",
      "computedHere": false
    },
    {
      "name": "CA.jpg",
      "source": "https://github.com/contentauth/c2pa-rs/blob/60f7cbdc69ab7a2554fcc87eb4df77050814b2cf/sdk/tests/fixtures/CA.jpg",
      "sha256": "e71bff58fc57640803e6e65f7534e2fb0c2f99018c85276cc14b30f04427cc76",
      "distribution": "Not mirrored. Obtain original from fixed upstream source.",
      "priorReferenceRead": "manifest_read; two APP11 packets; signature box present; not verified",
      "computedHere": false
    }
  ]
}