C2PA Content Credentials v2.4

A dated reading of what is claimed, reported, and independently verified in the current evidence.

Current reading

Readiness band and full integer triple

AI-assisted assembly · derived results

Readiness band

Emerging

Primary summary from verified readiness

Evidence strength Critical

Decision

Agent-assisted assessment · independently reviewed · 2026-10-02

Consider v2.4 for a controlled provenance pilot with a tested signing and validation pipeline.

Why: Bounded workflows work, but ordinary exports can strip or invalidate credentials. A valid credential does not establish factual truth, and security assurance depends on the implementation and trust policy.
Next: Use patched libraries and current trust material. Test edits, exports, revoked certificates, timestamps and archival verification before widening deployment.

Constraints

Optional online revocation checks can leave compromised signing credentials accepted.
Timestamp replacement and validator disagreement require application-specific safeguards.
Common editing and export tools can strip or invalidate credentials.
Unstructured-text embedding remains under review; third-party copy-paste survival is untested.
Trusted provenance requires certificate management, trust-list maintenance and archival validation.
SDK security fixes require ongoing patching and hostile-file testing.

Evidence summary

AI-assisted assembly

Counts and dates only. Raw signals, private excerpts, trust records, and internal corpus material are not published here.

Publication record

Revision 4