Artifact custody

An artifact record says what an object is; each representation says which bytes are held, how they were verified, and whether they remain independently retrievable.

Logical object and representation

One artifact can have an original, thumbnail, transcript, accessible alternative, or derived rendition. Each representation has its own media type, digest, byte size, verification method, availability, and source dependency.

Composition preserves each profile’s authority, custody, and disclosure boundaries.

Artifact record

{
  "ocp_version": "0.4",
  "schema_uri": "https://opencontinuity.org/schemas/0.4/artifact.schema.json",
  "type": "artifact",
  "id": "urn:uuid:00000000-0000-4000-8000-000000000300",
  "revision": 1,
  "created_at": "2026-08-13T12:00:00Z",
  "created_by": {
    "id": "https://provider-one.example",
    "type": "service",
    "display_name": "Synthetic OCP Provider 1"
  },
  "extensions": {},
  "profile_id": "https://opencontinuity.org/profiles/artifact",
  "profile_version": "0.4",
  "compatible_core": ">=0.4 <0.5",
  "subjects": [
    {
      "id": "urn:uuid:00000000-0000-4000-8000-000000000101",
      "type": "person",
      "display_name": "Synthetic User"
    }
  ],
  "space_ref": {
    "id": "urn:uuid:00000000-0000-4000-8000-000000000102",
    "revision": 1,
    "schema_uri": "https://opencontinuity.org/schemas/0.4/context-space.schema.json",
    "digest": "sha-256:7d1d417fcb3aa98fadae41f5be2b6cb59ad4de12264fbd2f0a633d521c691255"
  },
  "semantic_type": "image",
  "origin": {
    "source_authority": {
      "id": "https://provider-a.example",
      "type": "service",
      "display_name": "Synthetic Provider A"
    },
    "runtime_source": {
      "actor": {
        "id": "https://provider-one.example",
        "type": "service",
        "display_name": "Synthetic OCP Provider 1"
      },
      "software_name": "OCP Reference Importer",
      "software_version": "0.4-test",
      "execution_context": "offline_import",
      "build_digest": "sha-256:1111111111111111111111111111111111111111111111111111111111111111"
    },
    "provider_object_id": "asset-xyz",
    "source_uri": "https://provider-a.example/assets/asset-xyz",
    "created_at": "2026-08-01T10:00:00Z",
    "acquired_at": "2026-08-13T11:50:00Z"
  },
  "custody": {
    "mode": "managed_copy",
    "holder": {
      "id": "https://provider-one.example",
      "type": "service",
      "display_name": "Synthetic OCP Provider 1"
    },
    "source_dependency": false,
    "synchronization_status": "not_applicable"
  },
  "representations": [
    {
      "representation_id": "urn:uuid:00000000-0000-4000-8000-000000000310",
      "relation": "original",
      "media_type": "image/png",
      "filename": "source-image.png",
      "byte_size": 46,
      "content_ref": "urn:ocp:content:synthetic-image",
      "digest": "sha-256:7e9aa08b283bb63ba5e087b5b2aadecd5408d59a3334cf9fb368e2dccf0c40f0",
      "digest_algorithm": "sha-256",
      "verified_at": "2026-08-13T11:51:00Z",
      "verification_method": "bytes_hashed_on_acquisition",
      "availability": "available",
      "independently_retrievable": true,
      "source_dependency": false
    }
  ],
  "rights": [
    {
      "status": "unknown",
      "asserted_by": {
        "id": "https://provider-one.example",
        "type": "service",
        "display_name": "Synthetic OCP Provider 1"
      },
      "basis": "No portable rights assertion was present in the source export.",
      "asserted_at": "2026-08-13T12:00:00Z",
      "scope": "All uses",
      "limitations": "Possession and preservation do not establish copyright or permission."
    }
  ],
  "accessibility": [],
  "lineage_refs": [],
  "access": {
    "metadata": "grant_required",
    "content": "grant_required"
  },
  "sensitivity": "normal",
  "lifecycle": {
    "status": "active"
  }
}

{
  "representation_id": "urn:uuid:00000000-0000-4000-8000-000000000310",
  "relation": "original",
  "media_type": "image/png",
  "filename": "source-image.png",
  "byte_size": 46,
  "content_ref": "urn:ocp:content:synthetic-image",
  "digest": "sha-256:7e9aa08b283bb63ba5e087b5b2aadecd5408d59a3334cf9fb368e2dccf0c40f0",
  "digest_algorithm": "sha-256",
  "verified_at": "2026-08-13T11:51:00Z",
  "verification_method": "bytes_hashed_on_acquisition",
  "availability": "available",
  "independently_retrievable": true,
  "source_dependency": false
}

JSONManaged-copy artifact fixture

Preservation invariant

A provider may claim a managed copy only when the representation bytes are held independently of the source and can be retrieved and integrity-checked. A source URL and a digest alone are provenance signals, not preservation.

Package bytes safely

Declare the exact member set.
Reject traversal, duplicates, case collisions, links, devices, and undeclared members.
Verify every digest before use.
Apply encryption and signature profiles without exposing secrets in metadata.

{
  "manifest_version": "1.1",
  "ocp_version": "0.4",
  "package_type": "context_package",
  "package_id": "urn:uuid:82b2f316-2adc-4181-b676-c8431fceb32c",
  "created_at": "2026-08-12T15:06:00Z",
  "archive_format": "zip",
  "content_classification": "non_public",
  "payload_members": [
    {
      "path": "payload/context-package.json",
      "media_type": "application/ocp+json",
      "byte_size": 4096,
      "digest": "sha-256:8ced29d3e102f915e5953d43820df4968e681998dd8d982169ed8b69858a35e3",
      "object_id": "urn:uuid:82b2f316-2adc-4181-b676-c8431fceb32c",
      "schema_uri": "https://opencontinuity.org/schemas/0.4/context-package.schema.json"
    }
  ],
  "security_members": [
    {
      "path": "security/manifest.sig",
      "media_type": "application/octet-stream",
      "byte_size": 96,
      "digest": "sha-256:73aa4db40c283a7171df237789376e6de8b5a20406c9d17c23c7b147d012debc"
    },
    {
      "path": "security/recipients.json",
      "media_type": "application/json",
      "byte_size": 256,
      "digest": "sha-256:8f58c55c91c2fd8f38dc4474e99ab8d0c1637702150a381347b3305b7873582c"
    }
  ],
  "member_set_policy": "exact_declared_set",
  "protection": {
    "encryption": {
      "profile": "https://opencontinuity.org/example-profiles/recipient-encryption-review-example",
      "metadata_path": "security/recipients.json"
    },
    "signature": {
      "profile": "https://opencontinuity.org/example-profiles/archive-signature-review-example",
      "signature_path": "security/manifest.sig",
      "signed_view": "jcs_manifest_without_signature_descriptor_and_member"
    }
  }
}

JSONOffline package manifest fixture

Was this page useful?

Feedback is stored in this browser only until a project feedback endpoint is adopted.