When a marked file becomes a prompt: Measure 1.2 and the provenance chain

You generate a portrait. The model embeds a signed credential; the output leaves the model marked. Then that image becomes the first frame of an image-to-video job on a different provider. The video is dubbed by a third. A fourth transcodes it for the web. Four steps, three companies, one published asset — and the mark that started on the portrait is four hops upstream. The Code of Practice has a measure about exactly this, and it is the one that no single provider can satisfy alone.

Measure 1.2, and the word "input"

Most of the marking conversation is about a single file: mark the output, don't strip the mark. Measure 1.2 of the final Code of Practice ("Non-removal of markings") reaches further. Signatories commit to preserve existing metadata markings not just on their own outputs, but on content that flows through their systems:

"…retain, and abstain from intentionally altering or removing, existing metadata markings, where such content is used as input and subsequently transformed by their AI system into" a new output.

Read that clause slowly, because it changes the shape of the problem. The obligation follows the mark across the transformation. A marked image used as the input to a video model is not a fresh start; the Code expects the marking story to carry forward. That is not a property of any one file. It is a property of a chain.

Why a single provider is structurally blind to it

Consider the four-step pipeline from the top, and ask each provider what it can honestly attest to:

step 1  text-to-image     provider A   → portrait.png   (signed at source)
step 2  image-to-video    provider B   → clip.mp4       (input: portrait.png)
step 3  dubbing           provider C   → clip.dub.mp4   (input: clip.mp4)
step 4  transcode/deliver your CDN     → clip.web.mp4   (mark stripped)

Provider B sees a video job with an image attached. It does not know that image was signed by provider A, or whether the signature was valid, or what prompt produced it — it sees bytes and a request. Provider C sees a dubbing job. Each provider can vouch, at most, for its own step. None of them can produce the artifact Measure 1.2 is really asking about: the path from the published clip.web.mp4 back through every intermediate job to the original marked portrait. That artifact only exists somewhere that sees all four steps.

A single provider can attest to one link. The chain of custody across the whole pipeline is a different object, and it lives at the orchestration layer or it lives nowhere.

This is not hypothetical fragility. Published provenance research keeps finding the same failure: credentials break across multi-step, multi-tool pipelines, because signed metadata dies on the first lossy hop — a re-encode, a screenshot, a CDN optimization. When the mark on clip.mp4 is gone by step 4, "preserve the mark" has already failed, and the only thing that can reconstruct the story is a record of what fed what.

Lineage is the evidence the chain leaves behind

The orchestration-layer answer is to record the graph as it happens: every job, its inputs, and the jobs those inputs came from, as an append-only event ledger rather than a status field that forgets. Concretely, three properties make lineage usable as evidence rather than trivia:

• Edges recorded at generation time. When step 2 runs with portrait.png as input, the edge from the video job back to the image job is written then — not reconstructed later from filenames and hope.
• Inputs mirrored, so sources can't rot. If the source image lived on a provider URL that expires in an hour, the chain is only as durable as that URL unless the input itself is captured byte-exactly. Store the ingredients, or the lineage dead-ends the moment a provider garbage-collects.
• Each node carries its own digest. The sha256 recorded per asset lets you prove that the portrait.png referenced at step 2 is the exact one produced at step 1 — the binding that turns a list of jobs into a verifiable chain.

This is what Wakemark's lineage graph is (GET /v1/jobs/{id}/lineage): the DAG from a published asset back through every intermediate job and input, with sources optionally mirrored so they survive the provider's retention window. It maps directly onto C2PA's ingredients model — the standard's own way of recording "this output was made from those marked inputs" — for the day signing lands.

None of this is EU-specific. "What was this made from, and can you prove the path?" is the question a newsroom asks about a leaked clip, an insurer asks about a claim photo, and a platform asks about a thousand agent-generated assets a day. Article 50 gave the question a deadline. The provenance chain would matter without it.