Trace Capsule v0.1 Draft Spec

§ 01

Boundary Statement

This is a bounded interpretation-layer proposal. Its purpose is to describe how provenance-bearing content — once it enters human or AI-mediated discourse — might be handled with preserved source, bounded claims, and honest loop closure.

§ 02

Overview

These three layers are not competing systems. They are a continuity stack: provenance at the content level, bounded interpretation at the downstream-use level, and honest loop handling at the communication level.

§ 03

Bridge Rules — Invariants

The following invariants govern the relationship between C2PA provenance and Trace Capsule interpretation. These rules may not be violated by any downstream use of this layer proposal.

• I.01 C2PA remains the provenance / source layer. Trace Capsule attaches bounded interpretation downstream from it.
• I.02 Credential state is never rewritten by the Trace Capsule layer. Only interpretation pressure is updated.
• I.03 Reuse updates interpretation pressure, not origin. Origin does not reset on reuse.
• I.04 Closure is scoped to current evidence. A CLOSED_CURRENT_SCOPE state does not resolve all possible questions — it marks the current pressure object handled honestly.
• I.05 Provenance visibility does not equal claim validity. A credential establishes content history, not the truth of every interpretation built from it.
• I.06 A trace may be HELD, STRAINED, REPAIRING, ENCAPSULATED, FALSE_CLOSURE_RISK, MUST_STOP, or CLOSED_CURRENT_SCOPE.
• I.07 No Trace Capsule may claim AI agreement as proof of the underlying claim.
• I.08 No Trace Capsule may claim that storing a review trace makes the trace true.
• I.09 Source-return path must remain visible or explicitly marked as absent.
• I.10 Minimum necessary access principle applies at every stage. See § 04.

§ 04

Minimum Necessary Access Principle

Trace Capsule v0.1 operates on the minimum necessary access principle. HIR/OAM does not require full sensitive domain access to begin reading structural pressure. It requires enough trace to locate the repair path.

Minimum necessary facts. Maximum repair clarity.

This principle makes Trace Capsule v0.1 compatible with need-to-know environments, least-privilege systems, confidentiality agreements, protected records, hospitals, schools, legal teams, government agencies, research groups, and enterprise systems — without requiring those systems to expose protected data in order to engage the interpretation layer.

§ 05

Minimal Schema

The compact Trace Capsule schema contains the minimum required fields for identification, credential state, loop state, and review routing.

§ 06

JSON Embedding Examples

Compact capsule — minimal fields sufficient for badge rendering and loop state routing:

{
  "trace_capsule_v": "0.1",
  "trace_id": "tc_001",
  "attached_to": "ai_summary",
  "credential_state": "present",
  "loop_state": "HELD",
  "review_status": "unreviewed"
}

Expanded capsule — full pressure field set for review, repair, and boundary documentation:

{
  "trace_capsule_v": "0.1",
  "trace_id": "tc_002",
  "attached_to": "community_note",
  "credential_state": "present",
  "loop_state": "STRAINED",
  "review_status": "repairing",

  "source_uri": "credential/source-pointer",
  "claim_boundary": "note addresses claim scope, not total truth",
  "uncertainty_state": "medium",
  "unsupported_inferences": [
    "disputed claim exceeds credential support"
  ],
  "source_return_path": "add source/context or revise note",
  "notes": [
    "repairing: source-return and context alignment underway"
  ]
}

Non-normative C2PA assertion sketch — for future alignment discussion only:

{
  "label": "resonant_access.trace_capsule.v0_1",
  "relationship": "interpretation-layer",
  "preserves": [
    "source",
    "boundary",
    "uncertainty",
    "source_return"
  ],
  "does_not_replace": "Content Credential"
}

§ 07

loop_state Values

§ 08

Badge / Panel Render Rules

The Trace Capsule UI layer uses a two-level render model: a compact badge for inline display and an expanded panel for detailed field review.

Compact badge format:

§ 09

Render Examples

These examples illustrate how Trace Capsule badges and panels would render on two common downstream content types.

§ 10

Reuse / Update Flow

• 01 Original content has credential / source pointer.
• 02 AI summary or Community Note receives a Trace Capsule on attachment.
• 03 Summary is reposted, quoted, summarized again, or used in a Note.
• 04 System checks whether context or claim scope changed.
• 05 If no change: loop_state remains HELD
• 06 If claim expands beyond source: STRAINED
• 07 If correction / source-return is underway: REPAIRING
• 08 If reuse implies unsupported certainty: FALSE_CLOSURE_RISK
• 09 If unsafe without consent / context / domain review: MUST_STOP
• 10 If repaired and bounded: CLOSED_CURRENT_SCOPE

§ 11

Pseudocode Monitor

The following pseudocode describes the core logic of a Trace Capsule monitor operating at the point of attachment and at each subsequent reuse event.

on_attach(object):
  detect credential_state
  create trace_capsule
  if source + boundary support current use:
    loop_state = HELD
  else:
    loop_state = STRAINED
  render compact badge

on_reuse(object):
  compare new_claim_scope to claim_boundary
  check source_return_path
  check uncertainty_state
  check unsupported_inferences

  if source missing or credential stripped:
    loop_state = STRAINED

  if correction or review begins:
    loop_state = REPAIRING

  if claim exceeds evidence:
    loop_state = FALSE_CLOSURE_RISK

  if unsafe without repair / consent / domain review:
    loop_state = MUST_STOP

  if repaired and bounded:
    loop_state = CLOSED_CURRENT_SCOPE

  render updated badge

# Core rule:
# Credential state is not rewritten.
# Interpretation pressure is updated.
# The badge renders the current loop_state.

§ 12

C2PA Relationship

• ◦ Trace Capsule v0.1 is C2PA-adjacent and non-normative.
• ◦ It may sit beside or after provenance-bearing content in a display environment.
• ◦ It does not define the credential. It does not alter the credential.
• ◦ It attaches bounded interpretation to downstream use, not to the source artifact.
• ◦ This relationship is one of continuity, not competition.
• ◦ Trace Capsule v0.1 should be understood as an optional downstream interpretation object, not a credential assertion, unless and until an actual standards body defines such a relationship.

§ 13

Related Provenance and Audit Systems

Trace Capsule v0.1 does not replace the following systems. It provides bounded interpretation, pressure state, source-return, and closure state around downstream use of traces that may be governed by these systems.

• C2PA / Content CredentialsProvenance and edit-history standard
• W3C PROVProvenance data model
• CRediTContributor roles taxonomy
• DataCiteResearch data attribution
• Audit ledgersChain-of-custody records
• Consent / revocationPermission propagation systems
• EHR meaning preservationClinical record integrity
• Schema.orgStructured data / markup

§ 14

Health and Sensitive Domain Continuity

The Trace Capsule pattern generalizes to sensitive domains. The structural logic of bounded interpretation, source-return, and honest closure is domain-independent.

§ 15

Do Not Claim

The following claims must not be made using Trace Capsule v0.1 or any artifact derived from this proposal:

§ 16

Final Lock