Closes #18. C2PA 2.4 §A.7 binds a manifest to a document that cannot embed one — HTML above all — by hashing the delivered bytes, and the document points at the manifest through an RFC 8288 Link: response header or a <link rel="c2pa-manifest"> element. That is the delivery-chain regression this project exists to catch, in the format most likely to suffer it: a minifier, an HTML-rewriting CDN or a template change turns a valid provenance claim into an invalid one while the page still renders perfectly. Nothing errors, no log line appears, and the operator finds out when somebody from outside asks. A correction to the record first. Issue #18 assumed this needed a third-party library, on the grounds that c2pa-rs has no HTML handler. That was too broad. The accurate statement is narrower: c2pa-rs will not *embed* a manifest into HTML, but it will produce and verify one that stands beside it — `set_no_embed()` when signing, `manifest_data=` when reading. Which is exactly the A.7 arrangement. So this is built entirely on the official CAI bindings, and the dependency question the issue raised does not arise. Verified against c2pa-python 0.37.8 / c2pa-rs 0.90.15: a document edited by four characters after signing reports assertion.dataHash.mismatch, and the unedited one does not. The new `document` probe fetches bytes rather than driving a browser, and that is a correctness requirement rather than a shortcut. A UI probe reports what a browser rendered; a browser normalises markup before anything is readable, so the rendered document and the delivered one are different bytes and only one of them is what the manifest signs. Two refusals worth naming. A manifest hosted on another origin is refused rather than followed — a provenance claim that depends on a third party being reachable stops being checkable when they are not. And a manifest link that answers 404 is an error rather than a shrug, because a dangling provenance link is worse than none: it reads as marked and verifies as nothing. `Artifact` gained `sidecar_manifest` (excluded from serialisation, like `data`) and `sidecar_source`. The source is kept because header and element are not equivalent in practice — a header survives an HTML rewrite that would strip or move the element, so a report saying which one the chain actually used tells an operator something a pass alone does not. A missing manifest on a format that cannot embed one is now reported as manifest_missing rather than unreadable. The distinction is real: "there is nowhere a manifest could be" is a fact about the asset, while "unreadable" blames the evidence. Four generated fixtures and two golden cases, including the one that matters — `1932` became `1888` after signing, the page renders identically, and the binding fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Commits

Commits on Sep 1, 2026

MPF-M-002: verify the C2PA manifest bound to a delivered document