You signed the file.Did the credential survive?

Because the credential lives as a manifest embedded in the file, and almost every publish step rewrites the file. When a CDN re-encodes, a CMS resaves on upload, or a social platform transcodes your image or video, it produces new bytes and discards the embedded C2PA manifest along the way. The signature was never deleted on purpose — it just doesn't survive the round-trip. That is exactly what this gate tests: it grades the asset as your audience receives it, after your own pipeline has touched it, not as you signed it at the source.

Mostly no. Despite public commitments to provenance, most platforms re-encode media on upload, and that re-encode drops the embedded manifest. So a credential you attached perfectly can be gone the moment it lands on a feed. The durable answer is a soft binding — an invisible watermark plus a fingerprint plus an external manifest repository — so a verifier can recover the credential even after the embedded copy is stripped. The gate scores whether that durable fallback is present and forces UNVERIFIABLE when a stripping path has nothing to fall back on.

No. C2PA proves that a signed record is present, intact, and cryptographically bound to the asset — it says where a file came from and what was done to it, not whether the content is real, true, or fairly used. A valid credential does not mean the image is authentic, and a missing credential does not mean it is fake. This gate grades credential readiness, the technical durability of the provenance record. It is a nutrition label, not a force field, and it is not legal advice.

One verdict per asset — SIGNED, GAPS, or UNVERIFIABLE — plus a single fix-first that names the highest-leverage move for that asset. You mark each asset on five weighted C2PA dimensions (attached, signature valid, trusted signer, disclosure assertion, durability fallback) and flag whether the publish path strips the credential. A stripping gate hard-stops to UNVERIFIABLE when the credential can't survive and can't be recovered, no matter how cleanly it was signed. A library rollup grades your whole set as VERIFIABLE, PATCHY, or UNTRUSTED CHAIN.

Different layers of the same problem. The AI Disclosure & Synthetic-Content Labeling Readiness Kit audits your disclosure obligations — whether your AI surfaces are labeled the way transparency rules like EU AI Act Article 50 expect — and it deliberately is not a watermarking or detection tool. This gate owns the layer the Disclosure Kit excludes: the technical durability of the cryptographic credential itself, whether your C2PA provenance is attached, signed, trusted, and able to survive your CDN. Sign it durably here, disclose it correctly there.

No scanner is included or required. You verify each asset with whatever C2PA tooling you already use — the Content Credentials inspector, your signing tool's validation output, or your platform's provenance check — and mark what you find. The kit then grades those marks deterministically, offline, the same way every time. It ships a workbook, a runnable Python engine that produces the identical verdict from your terminal, two playbooks, and a seven-asset worked sample so you can see the full scoring before you touch your own library.