Two decisions, not open questions.
1. Bind covers the manifest commitment.
The earlier ceremony put Bind inside the hashed C2PA claim, so the manifest hash did not exist at signing time. That was a ceremony error, not a protocol limit. Bind is an attestation of the sealed claim, not a field inside it. A C2PA X.509 author assertion or a CAWG identity assertion, if present, is a separate signature.
Normative order:
- Compute
contentCommitment. - Finalize the C2PA claim without Bind. The claim generator seals those bytes.
- Compute
manifestCommitment = keccak256(salt || sha256(finalized claim)). - The author signs
Bind, covering both commitments, thebiocid, permanence, ingredients, subject, andsnpBloom. bindContentrecords the signed tuple. A public work still mints no grant.
Bind(bytes32 contentCommitment,bytes32 manifestCommitment,string biocid,bool revocable,bytes32 ingredientsRoot,bytes32 subjectCommit,bytes32 snpBloom,uint256 nonce)
A relayer that swaps the sealed C2PA after signing fails SignatureChecker. bindContent rejects a zero manifestCommitment.
Sequentia (15132025), Bind-covers-manifest bytecode:
0xC1F0E978FF99263ade7dC81a7E6222BBd926c025
Deploy: Sequentia Network Explorer — GenoBank.io
First ContentBound under this typehash: Sequentia Network Explorer — GenoBank.io
The previous instance 0x44FAB290563759390A93d613aF3F32b8Cd8E142b remains live and is superseded. It stored a manifestCommitment that Bind did not cover. Do not use it for new HumanMark binds.
2. The restrictive-wins lattice belongs in this ERC.
It is a verifier MUST in the Content Credentials profile. A companion note would let implementations diverge on the one rule that makes consent and C2PA a joint claim. The table stays in ERCS/erc-8356.md.
HumanMark 1.1.0 writes the sealed claim first, then the prove bundle. Verifier: Sequentia Network Explorer — GenoBank.io