Provenance and C2PA: four states, no fifth

Who does the marking

The generating provider does. C2PA Content Credentials are embedded — or not — by whoever ran the model. Wakemark does not create manifests and does not sign them. What Wakemark contributes is that the file is never transformed, so a mark that was embedded survives custody intact, and that the detection result is written to a ledger you can query later.

The four states

There is no fifth, softer state, and no state that means “probably fine”.

The mapping is mechanical. Inspection records a nullable present/verified pair; a null present means inspection never ran and yields not_inspected. Verified requires positive evidence — a manifest whose verdict is not recognised reads as present_unverified, never as a pass, because verified is a positive claim and needs positive proof.

Why “not inspected” never renders as a pass

Because it is the state that would be most convenient to blur, and blurring it would make every other state meaningless. A reader who cannot distinguish “we looked and found nothing” from “we did not look” cannot act on either.

It is also not one condition. An asset can be uninspected because custody was waived and the bytes were never copied, because a transfer failed, because the transfer has not happened yet, or because the detection tool did not run on a deployment that has it enabled. Only the last of those is Wakemark's to fix, and the audit export's gap report separates them so the reader can tell which one they are looking at.

Lineage

When a job takes another asset as input — an image-to-video step, an upscale, an edit — the relationship is recorded as a lineage edge. A chain can therefore cross providers: a still generated on one company's model and animated on another's is one traceable history rather than two unrelated files. Preservation of marks across such transformations is exactly what the Code of Practice's Measure 1.2 is about, and the chain is what the audit export reports against it.