nx_asset_provenance.nx

nx_asset_provenance.nx -- UNIVERSAL ORGANIZATION TOOLING arc, R2. CRYPTOGRAPHICALLY SIGNED, TAMPER-EVIDENT PROVENANCE for asset records, so we can TRULY KNOW whether an artifact is a generated image, a downloaded video, or human-authored -- not by a trusting a mutable metadata field, but by a signature only the platform/author key could make. THE MODEL (cited to knowledge/registry/org_research.tsv CONFIRMED claims): * c2pa-content-credentials: a provenance CREDENTIAL is a C2PA-style SIGNED, tamper-evident assertion that travels with the asset -- who/what made it (incl. generative-AI). * prov-model: the assertion is shaped as the W3C PROV graph ENTITY <- ACTIVITY <- AGENT. The ENTITY is the asset's RECORD CID -- this BINDS the credential to that exact content (change one byte of the asset/record -> its CID changes -> the credential no longer matches). * provenance-class-three: the assertion states the class human|machine|downloaded, the agent, and (machine) tool+model / (downloaded) source URL+fetch date. THE BACKBONE NEEDS ZERO NEW CRYPTO -- this organ is pure COMPOSITION (Rule 15, DRY): * canonical assertion bytes -> nx_canon_cid (canon_encode: key-sorted, byte-deterministic, so the SAME assertion is the SAME bytes everywhere -> the signer and verifier agree on exactly what was signed) * ed25519 sign / verify -> nx_ed25519_signature (ed25519_sign_full / ed25519_verify_full / ed25519_pub_from_priv) -- the SAME RFC-8032, KAT-verified ed25519 that nx_device_cert and nx_fw_capsule use. NO rolled crypto: forgery (wrong-key signing) is what plain hashing CANNOT catch, and what ed25519 verification DOES catch. CREDENTIAL FORMAT (C2PA "claim || signature", self-framed so verify recovers the exact signed bytes -- the same shape as nx_fw_capsule's payload||sig, here magic + len + assertion + sig): magic "NXPC1" (5) | u32be assertion_len | assertion bytes (canon_encode'd) | ed25519 sig (64) The signature covers magic || len || assertion (everything before the sig), so flipping ANY byte of the framing or the assertion breaks verification. VERIFY is DENY-BY-DEFAULT (Rule 12, fail-closed): a credential ALLOWs (returns 1) ONLY IF (1) the framing is intact (magic + length within bounds), AND (2) the ed25519 signature verifies against the TRUSTED public key over the exact assertion, AND (3) the assertion's `entity` field == the expect_record_cid the caller demands (binding holds). Any failure -> 0 (REJECT). Tampering the asset (different CID), tampering the assertion (sig fails), forging the signature (wrong key fails), or re-binding a credential to a different record (entity mismatch) are each detected. No hardware/persistent-firmware writes (Rule 26). license_tier: ORIGINAL