References
Standards, specifications, libraries, legal frameworks, and external work that ArcVelvet implements, depends on, and references.
ArcVelvet is part of an ecosystem of standards and projects working on content provenance, authorship documentation, and digital trust. This page documents what the platform implements, what it depends on, and which standards bodies and external projects shape the work. It is written for peer architects, standards-community participants, researchers, and practitioners who want to calibrate the platform's claims against the broader landscape.
Implemented standards
C2PA Specification v2.2
The substrate specification. ArcVelvet emits manifests conformant to v2.2 and validates incoming manifests against the v2.2 conformance rules. The published signingStatus.manifestConformance string in the verifier response is the canonical disclosure of which substrate version is in force.
JCS Canonicalization Scheme (RFC 8785)
Used for JSON canonicalization in the ARC chain-hash computation and the creator-side self-content-hash assertion. Selected because deterministic JSON serialization is a prerequisite for hash-based integrity claims that survive serializer drift.
Well-Known URIs (RFC 8615)
The convention behind /.well-known/c2pa-certs and /.well-known/c2pa-jwks. Third-party verifier toolchains can discover the platform's signing-cert material at the standards-recognized paths without per-vendor coordination.
security.txt (RFC 9116)
The machine-readable contact format at /.well-known/security.txt. Security researchers can discover the platform's disclosure contact + policy URL through the standards-recognized path.
JSON Web Key (RFC 7517)
The format used to publish the platform's signing public key at /.well-known/c2pa-jwks. Verifiers can cross-reference a COSE envelope's kid against the published JWKS to confirm which platform key signed a given manifest.
COSE Signature Format (RFC 8152)
The CBOR Object Signing and Encryption format used by C2PA to wrap the signature itself. ArcVelvet's COSE envelopes carry the ES256 signature plus the certificate chain plus the disclosed assertions.
ES256 (ECDSA with P-256 and SHA-256)
The signature algorithm used for all platform signatures. Selected because it is the C2PA-recommended algorithm for the current standard's profile and is broadly supported by verifiers.
Standards-body engagement
ArcVelvet operates as an implementer of standards rather than a paying standards-body member at this stage. The platform implements the published specifications, ships conformant manifests, and engages with the community as a practitioner. Membership is treated as a function of platform maturity, on a separate track from the work itself.
C2PA (Coalition for Content Provenance and Authenticity)
The standards body that publishes the specification ArcVelvet implements. The membership includes Adobe, Microsoft, Sony, Nikon, Leica, the BBC, the New York Times, Reuters, the Truepic team, and others. ArcVelvet engages at the implementer level: shipping conformant manifests, participating in the broader provenance discourse, and following the spec evolution.
CAWG (Creator Assertions Working Group)
Working on the standards for creator-authored assertions (identity, training data disclosure, generative AI inputs) that get embedded in C2PA manifests. ArcVelvet's creator-side custom assertions (com.arcvelvet.capture, com.arcvelvet.sale, the reversal and license claims) are positioned to align with the CAWG framework as it formalizes.
C2PA for GLAM Community of Practice
A community of practice focused on C2PA adoption in galleries, libraries, archives, and museums. The Murray and Sternfeld paper (cited below) is the founding document. ArcVelvet's posture is informed by the GLAM-side framing of provenance as an archival concern rather than a marketing claim.
Adobe Content Authenticity Initiative (CAI)
The Adobe-side counterpart to the C2PA standards work. CAI ships the inspector tool and the open-source libraries that most independent verifiers use. ArcVelvet manifests verify in the CAI inspector and in the public verifier at contentcredentials.org.
ISO/TC 171/SC 2 (PDF and document file formats)
The ISO subcommittee that owns the document-format standards including the working group on content provenance metadata. C2PA-style provenance assertions in PDF and document workflows are an active standards conversation, and ArcVelvet's PDF-format support sits in that frame.
Implementing libraries
@contentauth/c2pa-node 0.5.4
The Node-side library that wraps the c2pa-rs Rust reference implementation (currently c2pa-rs 0.78.4 under the hood). ArcVelvet's Cloud Functions use c2pa-node for signing and verification. The published credential.substrate string in the verifier response is the canonical disclosure of which library version produced a given manifest.
c2pa-rs
The upstream Rust library that c2pa-node wraps. The signing certificate currently in production is the c2pa-rs pilot test fixture (a publicly distributed dev-cert intended for pre-production deployments), pending SSL.com production cert issuance. The cutover plan is documented in the trust page.
Sharp
Used for share-card and profile-share-card PNG generation. Sharp's SVG-to-PNG conversion plus composite operations are the substrate for the 1200x630 social-preview images that ride alongside the OG metadata.
Firebase (Google Cloud Platform)
The infrastructure substrate. Firebase Authentication for the magic-link sign-in flow plus optional MFA. Firestore for the document database. Cloud Functions for the server-side logic including signing and verification. Hosting for the static surfaces and the Cloud Function rewrites. Cloud Storage for media + the publicly readable share-card images.
Legal and policy framing
Thaler v. Perlmutter
The U.S. legal anchor on AI authorship: copyright requires human authorship. ArcVelvet's posture on AI-involved work follows from this. The signature records the human's authorship claim and the disclosed tool-chain; it does not adjudicate copyrightability. That question lives between the creator, their work, and counsel.
GDPR (General Data Protection Regulation)
The European data-protection framework the platform commits to operating within. The deletion flow with 30-day grace + escrow + recovery is calibrated against GDPR's right-to-erasure framing while preserving the cryptographic record for buyers who paid for verifiability of signed-on records.
CCPA / CPRA
The California privacy frameworks that complement GDPR for the U.S. side. The cookie-consent banner, the explicit PostHog disclosure, the Do Not Track header respect, and the no-data-sale posture are calibrated against the combined GDPR + CCPA expectations.
Platform's own documentation
/privacy — privacy policy. /terms — terms of service. /trust — trust infrastructure documentation. /security-policy — vulnerability disclosure policy. /accessibility — accessibility statement.
Related work and ecosystem
Murray and Sternfeld: Content Authenticity and Provenance in the Age of Artificial Intelligence
The founding document for the LoC's C2PA for GLAM Community of Practice. Frames provenance as an archival concern at institutional scale and identifies the gap between large-platform provenance work and individual-creator provenance work. ArcVelvet operates in that gap.
InterPARES Trust AI
Academic-side research on what trust means for AI-involved digital records. Conceptually adjacent to the platform's posture on disclosed-tool-chain framing and the durability of cryptographic provenance through institutional change.
Project ARCHANGEL
A distributed-ledger archival authenticity research project from the mid-2010s that explored blockchain-based provenance for archival records. Conceptually informative on what blockchain-based provenance offers and where the model breaks down at archival scale.
Starling Lab
Research lab at Stanford and the USC Shoah Foundation working on cryptographic verification for journalism, human rights documentation, and archival records. Conceptually adjacent to ArcVelvet's framing of provenance as an integrity property of the file rather than a marketing claim.
Trust in Archives Initiative
Adjacent work on the foundational question of what archival authenticity means when records are born digital and travel through many custodial hands. Informs the platform's posture on durability through institutional change.
How to engage
The platform welcomes outreach from researchers, standards-community participants, practitioners working in adjacent spaces, and curious peers. Email arcvelvet@arcvelvet.com with whatever you want to discuss. The trust documentation at /trust is the recommended starting point for technical readers who want to verify claims against the live code. The how-it-works page at /how-it-works is the recommended starting point for first-time visitors. The about page at /about covers the founder context and the operating posture.