DAI Methodology v2

Date: 2026-08-16 Status: Consolidated master methodology Audience: external technical reviewers, forensic researchers, and serious journalists Scope: image authenticity investigations in a current DAI implementation

0. Core Principle

Confidence is earned through the systematic reduction of relevant uncertainty.

DAI is not AI detection. It is not a real/fake classifier. It is an evidence interpretation discipline for digital media. A DAI system collects structured evidence from multiple provider families, evaluates that evidence through rules, and reports what the evidence most strongly supports.

The output is claim-relative. DAI does not certify truth, guarantee authenticity, prove all media origin, detect all fakes, or treat missing credentials as proof of falsity. It also does not treat a credential, publication page, or reverse-search match as proof that the surrounding caption, article, or claim is true.

Every assessment must preserve the difference between what was measured, what was inferred, and what remains unresolved. When a DAI system can make a supported finding, it states the finding and its public confidence as High, Moderate, or Low. When a DAI system cannot responsibly assess a proposition, it does not invent a confidence level. It reports a status such as Not established, Not determined, Insufficient evidence, or Unresolved.

The discipline is deliberately bounded. A low AI-generation score weakens an AI-generation explanation; it does not establish real-world capture. Camera metadata can support real-world capture; it does not by itself prove that the published claim is true. Online copies can document circulation or publication; they do not establish original release, capture origin, or independent corroboration.

The case record functions as jurisprudence. The 49ers AI image, Case 002 recycled protest photo, Case 003 fabricated image, the NYT Carroll photo, The Onion satire case, and the McConnell proof-of-life case each forged rules below because each exposed a failure mode that generic authenticity language would miss.

Version 2 adds a layer beneath all of this. Sections 0 through 8 of prior versions describe how to weigh evidence. They assumed that what a provider returns is evidence. Systematic measurement showed that assumption is not safe, and Section 1 now states the conditions a signal must satisfy before it may be weighed at all.

1. Evidence Qualification

A provider output is a measurement. It becomes evidence only after it survives the tests in this section. A discipline that weighs unqualified measurements is precise about the wrong thing.

1.1 Stability

A measurement that changes materially under a transformation that does not change the meaning of the medium is not evidence about the medium. It is evidence about the instrument.

Before a signal may support a claim, its stability must be established under meaning-preserving variation — modest rescaling, mild recompression, and equivalent operations that alter the file without altering what it depicts. Where the provider is a black-box classifier, stability is measured per specimen. It is never inferred from vendor documentation or from the provider's own confidence value.

An unstable signal is withdrawn. It does not become a weaker finding, and it is not averaged with the stable measurements: an average of a real value and a spurious one is a spurious value with a smaller error bar. Withdrawal produces a declared coverage state, not silence and not a finding.

This rule was forged by ten photographs of one handwritten notebook, taken in one session within the same minute. Four scored 0.96 to 0.98 for synthetic generation and six scored approximately zero. No media-form feature distinguished the two groups; they were the same subject in the same light. Re-sampling under ±5% rescaling and mild recompression separated them cleanly. Correct results did not move at all. The false ones collapsed — one from 0.89 to 0.01.

Stability is a precondition, not a corroborator. It does not make a signal true. It only establishes that the signal is about the medium.

1.2 Independence Is Established, Not Assumed

The corroboration gate requires independent evidence families. Independence is itself a claim about the evidence, and it must be established rather than inferred from the fact that two signals carry different names.

Two signals belong to one family when they respond to the same underlying property of the medium. The operational test is co-firing: signals that trigger together across specimens are one family wearing several labels. Summing them as independent produces false corroboration.

False corroboration is the most dangerous failure available to this discipline, because it does not look like an error. It looks like confirmation, and it raises confidence in exactly the cases where confidence should fall.

Two calibrations forged this rule. Five structural pixel signals — smooth-region, edge, gradient, noise-profile, and localized-compression anomalies — fired together on professionally lit photographs, because each responds to evenness of lighting and cleanliness of edges rather than to alteration. And a second synthetic-generation classifier of the same kind, however different its vendor, strengthens the classification family; it does not add a second one. A second family must rest on a different kind of qualified observation: authenticated provenance, a verified signature, documented circulation, or comparison against a reference.

Unsigned EXIF/XMP values are not authenticated provenance. Software, CreatorTool, ContainsAiGeneratedContent, Make, Model, and related fields are writable by the file author. Different field names in one file therefore collapse into one self-declared metadata source, and that source does not qualify as independent corroboration for origin. The values remain reportable as observations. A declaration carried by a cryptographically validated C2PA manifest from a trusted issuer is different: it is authenticated to that issuer and may count as its own provenance family, while still not proving the surrounding claim or event.

1.3 Inferential and Referential Evidence

Evidence in this discipline divides into two classes with different properties, and the distinction governs how much weight each may carry.

Inferential evidence is derived from properties of the artifact itself — compression history, noise structure, classifier scores, statistical regularities. It is probabilistic, it degrades as the file is processed, and it is argued rather than shown. Its conclusions are contestable by construction.

Referential evidence is derived from comparison against an external documented record — a published copy located online, a cryptographically verified manifest, an archived capture, a prior specimen in a custodial archive. It is discrete, it survives processing that destroys inferential signals, and it can be shown rather than argued. A reader can look at the reference and the specimen and see the difference.

Where both are available, referential evidence governs. An inferential signal may not override a referential finding, and inferential absence may not be read as agreement with a referential finding.

This ranking was forged by three independent failures. Pixel-based splice detection was calibrated in July and failed after an unrelated ingestion change; a resolution-invariant rework produced a 21.5% false-alarm rate against uncurated photographs; and neither version detected either owner-created edit in a vehicle-damage corpus, while firing on two clean originals. Comparison against the published original located the altered region on the first attempt, and on an independent hold-out detected copy-move fabrication in 8 of 8 cases and clone-out concealment in 8 of 8, with zero false alarms across 24 benign edits.

The lesson is not that inferential evidence is worthless. It is that inferential evidence is what remains when referential evidence is unavailable, and it must be labeled as such rather than presented as equivalent.

1.4 Measure at the Layer of Consumption

Performance is a property of what the reader is told, not of a component. A component that improves without changing the reported conclusion has not improved the system; it indicates either suppression downstream or a capability that does not exist in practice. Both are defects, and neither may be recorded as progress.

Component-level measurements may be reported alongside the user-facing figure, clearly labeled. They never stand in for it.

2. Evidence Collection

A DAI system collects evidence from provider families. Each family is a distinct class of observation, but provider output is not accepted as a verdict. Provider evidence becomes useful only after it is qualified under Section 1, characterized, bounded, deduplicated, and compared against the claim under investigation.

The current image evidence families are:

• Metadata forensics: embedded metadata such as EXIF/XMP when present, including WebP EXIF extraction through RIFF chunk parsing, and editing-workflow observations such as software tags, Photoshop resource blocks, and document ancestry. Unsigned free-text values are displayed as “Declared by the file; not verified” and carry no independent corroboration authority. Absence of readable metadata is reported as absence of readable metadata, not as evidence of falsity. Presence of an editing tool is an unauthenticated workflow declaration, never proof of origin or material alteration by itself.
• Reverse image search: exact and related matches, candidate source pages, candidate image URLs, and Known History evidence. Exact copies and verified source pages are treated differently.
• Reference comparison: localized comparison between the submitted specimen and a retrieved reference, reporting the differing region when one exists. See Section 1.3 and Section 6.
• AI and manipulation detection: synthetic-generation and face/deepfake classifier signals, subject to the stability requirement in Section 1.1. Same-vendor signals count once for corroboration; same-kind signals from different vendors belong to one family under Section 1.2.
• Pixel and file forensics: ELA, noise analysis, and processing indicators. These are retained as processing-history observations. They do not carry verdict authority for content-level modification — see Section 6.
• Provenance credentials: C2PA manifest detection with cryptographic signature verification and issuer-trust evaluation. See Section 8.

The instance-set investigation model changes the unit of investigation from the uploaded file to the instance set. The submitted file remains important because it is the claim-bearing instance: the specimen the user was shown or asked about. But it is only one instance of the asset. Discovered instances may include exact-match images found through reverse search, direct image copies, or verified source-page copies.

For each instance that a DAI system can acquire, the Instance Map records the role, source URL or domain when available, retrieval status, storage record, SHA-256 hash when fetched, dimensions, format, file size, and metadata presence. Candidate hashes remain unknown until retrieval succeeds; failed acquisition is recorded rather than hidden. The purpose is custody and comparability, not a claim that the copy is original.

Claim-bearing and discovered instances must not be collapsed. A submitted screenshot, a CDN WebP derivative, and a publisher JPEG can all depict the same visual asset while carrying different forensic value. A DAI system therefore records which specimen supports each finding. The Instance Map exists to prevent report language from confusing "this was uploaded" with "this was found online" or "this was measured."

Cross-instance comparison is a first-class evidence operation. It can produce framing divergence, content divergence, and overlay divergence. Framing divergence means that one instance contains regions cropped from another; Case 002 used this pattern when a wider protest image exposed the claim-defeating "SHERIFF" context. Content divergence means localized structural difference inside the overlapping region above re-encoding noise; Case 003 used this rule when details such as epaulettes and belts varied between purported renditions of the same moment. Overlay divergence means added text, watermarks, or stamps; those are lineage evidence and must not be confused with content fabrication by themselves.

3. Forensics on Best Evidence

The submitted file is often the worst specimen. Platform recompression, screenshots, CDN resizing, social reposts, and local re-encoding can launder the signals that forensic tools need. A null result on a degraded derivative can be an expected consequence of degradation rather than evidence against manipulation or generation.

A DAI system therefore analyzes the strongest stored copy available for the relevant measurement and always names the specimen measured. The strongest copy is not called original. It is the least-degraded retained specimen according to available information such as effective pixel area, retained byte density, format, and URL-native-size hints that reveal enlarged derivatives.

The McConnell proof-of-life case forged this rule. The submitted file was a 713 x 660 WebP derivative of about 220 KB. A richer 3000 x 2777 JPEG from CNN's image CDN was already stored. Running AI and face-manipulation analysis on the small submitted derivative while leaving the CNN JPEG unanalyzed created a false impression of evidentiary completeness. The corrected report named the 3000 x 2777 analyzed specimen and reported 0.1% AI-generation and 1% face-manipulation scores in bounded language.

Best-evidence analysis does not make detection conclusive. In McConnell, low generation and face-manipulation scores weakened the AI and identity-level face-modification explanations. They did not establish capture origin, scene authenticity, the truth of the surrounding proof-of-life claim, or absence of subtle retouching or alterations outside the measured face signal.

Submitted-file and matched-copy measurements of the same signal are deduplicated. If a richer matched copy supplies a valid measurement, stale or lower-quality submitted-file findings must not appear to contradict it or inflate the evidence count. The most informative valid measurement governs, and the report displays the measured specimen.

The delivery channel is part of the specimen's history. Consumer messaging platforms transmit either a recompressed derivative or the original file depending on how the sender attached it, and the difference determines whether editing-workflow metadata survives at all. Where an integration controls intake, preserving the original file is a requirement of the integration, not a preference — a workflow that strips evidence before it arrives cannot be compensated for downstream.

4. Coverage and Validation

Coverage is not "the control ran." Adequate coverage means the required controls ran on suitable specimens, passed their quality gates, and produced interpretable results for the proposition being evaluated. A detector that completes on a degraded file and returns nothing diagnostic has not covered that vector. Every assessment therefore declares what was examined, at what quality, and what could not be examined.

A coverage limitation is never a finding. "No readable metadata" describes what could not be examined; it is not evidence of editing, and must never be presented alongside findings as if it were suspicion. Three states must remain distinct in reporting and must never collapse into one another: a control that ran and found nothing, a control that could not run, and a control that ran and produced an unstable result.

Validation is a precondition, not a formality. No DAI deployment may be presented as reliable for a decision context without internal measurement of sensitivity, false negatives, false alarms, per-subgroup performance, and drift. The following rules govern how that measurement is conducted and reported. Each was forged by a measured failure.

4.1 Validation Decays

V-1. Every figure carries its date, its corpus, and its ingestion context. A performance number without those three is an anecdote.

V-2. Re-validate when the evidence path changes. Any change to how files are received, stored, converted, or resized invalidates the calibration of everything downstream — including when the change is an improvement. Especially then, because that is when no one suspects.

A splice detector was calibrated against composites whose thresholds were expressed as fractions of a fixed block grid, and therefore tied to the resolution of files then arriving. When client-side compression was removed — a correct decision, since resampling launders evidence — the system began receiving full-resolution files, the block count grew by an order of magnitude, and the thresholds became unreachable. Nothing failed. No test broke. The detector reported success and found nothing, and detection on twenty splices was zero.

V-3. Calibration must not encode incidental properties of the corpus. Thresholds relative to resolution, file size, aspect ratio, or codec are tied to whatever happened to be measured. Where invariance is not achievable, the dependence is stated and the operating range declared.

4.2 Control Sets Lie

V-4. Count scenes, not files. Derivatives, crops, and re-encodings of one specimen are one specimen. Report both counts; the smaller one constrains any claim.

V-5. Controls must come from the wild. Every validation includes a negative control class drawn from unselected real-world media of the kind the system will actually receive — not assembled to exercise the detector, not filtered for quality, not curated by whoever built the thing being tested. Curated corpora measure the builder's imagination. Once a control set has failed to catch something, it is retained permanently; its replacement will have blind spots of its own.

A detector scored zero false alarms across twenty-four curated controls — six scenes, resampled — and 21.5% against seventy-nine unselected photographs. On the same day, an AI-generation axis that showed no false alarms on the curated set produced them on real-world images including a photographed handwritten document.

V-6. False alarms are weighted above sensitivity. A finding wrongly asserted is more costly than one missed, because the reader acts on assertions and merely lacks information in their absence. Calibration holds the false-alarm rate as a hard constraint and pursues sensitivity within it. A detector that cannot gain sensitivity without accusing more should not gain sensitivity.

This asymmetry is a default, not a law. Its magnitude is use-case dependent and must be stated per deployment profile: a missed fabrication published as authentic is also a real harm.

V-7. Margin is part of the result. A threshold that barely separates has been fitted, not validated. Report the metric distributions per class, not only pass/fail counts. Where distributions overlap, the overlap is the finding.

4.3 Ground Truth and the Instrument

V-8. Ground truth is established, not assumed. A filename, a folder, or the person who supplied a file prove nothing. State how each class was verified and how many candidates were rejected.

Provenance-by-inspection is not verification. In a single review, an image judged authentic by inspection proved to be AI-generated, and an image the owner labeled authentic carried a generator watermark. Neither reviewer could distinguish them by looking — which is the premise of the discipline, demonstrated on its own practitioners.

V-9. Verify the instrument before reporting on the system. A validation run reporting total failure of an axis is more likely broken than the system it measures. In one session three consecutive runs reported catastrophic failure; all three were artifacts of the harness — absent credentials counted as zero detections, and specimens degraded by the harness before analysis. Each produced a clean, precise, entirely false report.

V-10. A development corpus is not a validation. A corpus generated by whoever built the detector measures the builder's model of the problem. Figures intended for external use require a hold-out the builder did not construct.

V-11. Interacting defects are unwound in a stated order. Where two defects offset each other, repairing them independently can ship harm that neither caused alone. One axis was suppressed by an unrelated subtraction elsewhere; correcting the subtraction alone would have released a 21.5% false-alarm rate to users. The remediation order is part of the finding.

4.4 The Limits of Internal Validation

All of the above is internal validation: the floor, not the ceiling. A corpus assembled by its own author measures that author's assumptions as much as it measures the system. V-5 and V-10 reduce that exposure without removing it. External and adversarial evaluation are different and stronger claims, and internal figures must never be presented as though they were independent.

Measurement can establish that a detector separates two classes on the evidence available. It cannot establish that those are the classes that matter to the person reading the report. That judgment stays with people.

5. Dating and Backtracing

DAI uses dates as bounds. The public phrase is "circulating since at least [date]" or "earliest documented occurrence: [date]." The date is never an origin claim, creation date, capture date, or first-publication claim.

Backtracing attempts to date each instance with a method and reliability class. Reliable dating can resolve claim context even when other evidence is limited. Case 002 was resolved by a prior occurrence: the image was already online years before the current claim. Case 003 showed the opposite kind of temporal evidence: after wide circulation, a DAI system did not find a pre-claim instance, which weakened specific origin narratives without proving the asset's true origin.

Date display is UTC date-only for public reporting. This avoids shifting a publisher URL-path date such as July 12 to July 11 for readers in western time zones. The McConnell report made this rule concrete: URL-path and Known History dates had to remain July 12 in the public report.

The current dating methods are:

• Platform ID decode: high reliability when the platform ID encodes a timestamp and the decode method is known.
• Wayback first capture: high reliability for "documented by archive no later than this capture."
• Page-declared date: medium reliability when a page presents an article, post, or publication date.
• Publisher URL-path date: medium reliability when an independently discovered copy or page URL contains a date path such as /YYYY/MM/DD/.

URL-path dating is applied to independently discovered copies, not to the submitted file. A submitted filename or URL context supplied by the user does not become Known History evidence.

Recirculation requires a meaningful temporal gap. The REC-1 framing "Circulating since [date] - predates the current claim" requires the earliest documented occurrence to predate the claim reference date by at least 14 days. A current-event image published one or two days before investigation is not recycled media merely because it appeared elsewhere first.

Absence of a documented occurrence is bounded in time as well as in coverage. A search index is a moving record: an asset absent today may be documented next week. Where a decision remains open, re-checking the distribution axis is a legitimate evidence operation, and any resulting finding is recorded as a new dated observation. A prior assessment is never silently rewritten — a record that changes underneath a decision already taken cannot serve as evidence about that decision.

6. Known History, Distribution, and Reference Comparison

Known History documents what a DAI system found about circulation and publication. It does not answer authenticity by itself.

A DAI system distinguishes exact copies, verified source pages, related pages, page-less exact image copies, and unstable or login-dependent results. Page-only or category results are related pages, not confirmed prior appearances. Facebook group-post URLs are not displayed as verified exact-match source pages when they are volatile, login-dependent, or no longer show the searched image, even if reverse search reports an exact image match.

Verified exact source pages can support a publication-history finding. The NYT Carroll photo forged the PUB-1 scenario: exact matches tied to verified source pages should not collapse to "source and authenticity could not be established" merely because capture origin remains unresolved or an AI detector is unavailable. The bounded headline is "Published copy documented online." It does not confirm camera capture, rule out AI generation or alteration, prove article context, or establish capture origin.

For contemporary clusters, broad republication is not independent corroboration. The McConnell case showed that many copies can trace to one release window. DAI therefore uses a Single-Release Distribution Pattern: when at least two dated exact copies fall within 72 hours and no earlier occurrence is found, Known History may state that all N dated copies trace to one publication window. Republication by multiple outlets does not establish independent corroboration or capture origin.

Durable Known History matters because search results can fluctuate. If a DAI system already fetched and stored safe discovered instances tied to verified exact source pages, a later reverse-search run that omits those pages should not erase that evidence, so long as the current run still finds exact copies.

Hard bound: DAI never claims an original, official, or first source, and never identifies or speculates about the releasing party or its interests.

6.1 Localized Comparison Against a Documented Reference

Where a reference specimen can be retrieved, comparison against it is the strongest available evidence about content-level modification, under Section 1.3.

Comparison is localized, never global. A global difference average is not merely weaker — it is inverted for this purpose. A real localized edit reads as nearly identical because the altered region is small relative to the frame, while a benign crop reads as different as two unrelated photographs because every pixel has moved. Measured: a localized edit produced a global structural difference of 0.025 while a benign crop produced 0.268, and two unrelated photographs produced 0.256.

The signature of a localized edit is two statistics together: a low median difference and a high concentrated peak — everything matches except here. A crop, a different framing, or an unrelated image produces a high median and is excluded on that basis.

Non-comparability is a correct outcome. Where alignment fails — a crop, a different angle of the same event, an unrelated image — the system reports that the specimens are not comparable rather than returning a difference figure that would be read as alteration. A misleading number is worse than a declared limit.

A difference establishes that two versions differ. It does not establish which is authentic, which was altered, or that any alteration was fraudulent. The reference may be a later republication, a differently processed copy, or itself edited. The finding names the reference, where it was found, and whether the match was exact or visually similar, so a reader can weigh the reference as well as the difference.

Reference availability bounds this capability. Publicly circulated media can be compared against its published instances. Media that was never published — a private photograph submitted for a claim — has no public reference, and comparison would require a custodial archive supplied by the party requesting the assessment. Where no reference exists, this axis reports a coverage limitation.

Overlay divergence is localized but not automatically characterized as content alteration. A watermark, caption, timestamp, stamp, or agency logo can satisfy the localized-difference gate. The system shows both regions and states that an overlay is possible; a human determines whether depicted content changed. Structural cues may inform wording, but no unvalidated overlay classifier may suppress the finding.

Localized blur is a known limit. The approved localized-difference threshold is not lowered to catch blur because measured blur statistics overlap benign borders, rotation, exposure, and processing. Where a separate detail-loss observation identifies a localized reduction consistent with applied blur, it is reported as processing context with reason code REFERENCE_LOCAL_DETAIL_LOSS_NOT_EVALUATED. It does not produce, suppress, or corroborate a content-alteration verdict. Blur may reflect privacy redaction or routine processing.

7. Verdict Construction

DAI constructs verdicts from scenarios, not free-form impressions. The controlled nomenclature appears in Appendix A. Scenario families include RWC, SYN, ALT, UNV, QAI, REC, PUB, PRC, FRM, and CON. Scenario selection is claim-relative and bounded by the available evidence.

The corroboration gate protects consequential findings. Public High confidence for AI-generated media or digital manipulation requires at least two independent evidence families, with independence established under Section 1.2. A single vendor classifier, even a strong one, may support a finding but is capped at Moderate unless independently corroborated. Absence signals such as no EXIF or no reverse-search match do not corroborate generation or manipulation.

The 49ers AI image calibrated the edge case. A 99% synthetic classifier score can support the direct headline "AI-generated media," but without an independent qualified family such as a trusted signed C2PA AI declaration, public confidence remains Moderate. An unsigned AI tool signature or XMP content declaration does not corroborate the classifier. Lower strong uncorroborated scores use "Possible AI-generated media."

7.1 Material Modification

Material modification follows the same discipline, with a boundary established by measurement.

Structural pixel signals do not carry verdict authority for content-level modification. Smooth-region, edge, gradient, noise-profile, and localized-compression anomalies are retained as processing-history observations and remain visible in the full investigation record. They may not produce a public conclusion of manipulation, alone or in combination — under Section 1.2 they are one family, not several.

The measurement that established this boundary: across 104 controls the axis accused 10 authentic images and detected 0 of 20 synthesized splices. On real vehicle-damage photographs it detected neither of two known edits and fired on two clean originals. Its only reliably measurable effect was false accusation. The signals respond to even lighting and clean edges — the properties of a well-made photograph — not to alteration.

Where no reference is available and only these signals are present, the dimension reports that content-level modification could not be assessed. It never reports that no manipulation was found. Absence of evidence is not evidence of absence, and this distinction is the difference between a coverage limitation and a false exoneration.

Content-level modification requires evidence about depicted content, not just changed bytes. Referential evidence remains bounded by the comparison's scope. A C2PA hash mismatch establishes a post-signing byte change, but cannot establish or corroborate content-level alteration: ordinary color correction, export, resizing and re-encoding also produce it. A face-manipulation classifier must first qualify under Section 1.1 and requires relevant independent corroboration before contributing to a content-level conclusion. A hash mismatch does not supply that corroboration. Processing, export, and compression artifacts remain distinct from content modification at every level.

Face-classifier qualification (2026-09-14 clarification). A facial reading must pass its own measured, face-specific stability control; passing the synthetic-generation control does not qualify it, and instability in a sibling model does not measure its instability. Without a calibrated threshold and four interpretable meaning-preserving samples, the reading is excluded and reported as coverage. A stable facial reading remains one inferential family: alone, or with smoothing/compression observations, it cannot establish content alteration or receive High manipulation confidence. It can identify a signal requiring independent review. Computational portrait processing, beauty filtering, and messaging-platform recompression are candidate explanations to investigate, not causes established from a high score. Comparing the original and received file can test that explanation; one pair does not establish general detector accuracy.

The public material-modification row and its headline must respect the same corroboration cap. Explanations must identify the qualified deciding evidence; withdrawn pixel paths may not be credited for a conclusion or for raising its confidence. These constraints apply even when a provider completes successfully.

Until a face-specific threshold is calibrated, production face sampling is disabled by default (TRST_FACE_CLASSIFIER_ENABLED=false). No face scores are requested, consumed or used as reassurance. Authorized calibration explicitly enables the flag; this does not change the null threshold or grant the resulting measurements verdict authority.

7.2 Precedence and Framing

Rule A7 governs synthesis precedence. Lineage stability may never serve as the primary assessment while capture origin is undetermined. Case 003 forged this rule when a fabricated image whose file matched circulating copies received a headline that read like authenticity clearance. "No content changes found since circulation" answers whether the copies changed after discovery; it does not answer whether the depiction reflects reality.

Question-focused response is mandatory. When the user submits a direct question, the primary headline answers that question first, within evidence limits. McConnell's "Is this photo AI?" required an answer about AI-generation and face-manipulation evidence before generic publication history.

Claim verifiability is part of verdict construction. A sub-claim can be media-resolvable, context-resolvable, or structurally unverifiable. False and unverifiable are different outcomes. A claim about an unarchived deletion or private transmission may require evidence that does not exist; the report must say so rather than converting unverifiability into falsity.

Obviousness is not evidence. Visual self-evidence cannot substitute for evidence families. Case 003 stayed below a stronger conclusion until continuity failure across renditions supplied independent support. Genuine photographic series of the same moment preserve physical detail; independent generative renditions often reinvent unspecified details. Continuity failure is therefore an evidence family when multiple renditions claim to depict the same moment.

8. Communication Rules

> Operational annex. These rules are elaborated into an enforceable reporting layer — > prohibited terms, canonical output states, coverage definitions, reason-code taxonomy, > and per-use-case coverage profiles — in the TRST Reporting and Decision Guidance Standard. > Where the annex is more specific, it governs how a finding is expressed; it never changes > what the evidence supports.

Status is not confidence. Public confidence is only High, Moderate, or Low. What cannot be assessed receives an explicit status. "Indeterminate" may exist internally as a synthesis state, but it is never presented publicly as a confidence level.

An assessment is decision support, never permission. DAI reports what the completed controls found, bounded by what could actually be examined; it never issues an instruction to proceed, reject, pay, publish, or approve. Absence of a triggered control is not a certification of authenticity, and a coverage limitation is never presented as a finding.

Every verdict carries a "does not claim" statement. Bounded language is not optional; it is how DAI prevents evidence from being overread. Prohibited public terms for backtracing include "original," "created," and "first published." Preferred terms include "earliest documented occurrence," "documented online as of," "published copy documented online," and "circulating since at least."

Public output never uses "manipulated," "fraudulent," "fake," or any numeric percentage of authenticity. A difference from a reference is reported as a difference. A classifier score is reported as what a named classifier returned, not as a probability that the medium is inauthentic.

The public headline and body must agree. A headline that says "could not establish" must not be paired with a confidence pill. A headline that says "published copy documented online" must not imply capture origin. A headline that answers an AI question must not let low AI evidence become real-world capture.

Publisher context labels are display context only. The Onion satire case forged this rule. A known satire/parody label can inform readers that a publisher is a known satire outlet, but it does not move the DAI assessment.

Submitted source context never feeds Known History. User-provided source context can help define the claim, but it does not establish independent circulation.

Reports separate the Investigation Brief from the Full Investigation. The brief states the primary assessment, confidence or status, dimension summaries, Known History, and why the assessment follows. The full section can expose provider findings and instance details, but provider details do not decide the public wording by themselves.

9. Provenance and Credentials

DAI is complementary to C2PA and Content Credentials. Content Credentials can help establish provenance. DAI helps interpret what the total evidence supports.

A current DAI implementation performs cryptographic signature verification and issuer-trust evaluation against a bundled trust list. Five states are distinguished and never collapsed:

1. No manifest. Report a completed no-manifest coverage state, not a planned feature or an authenticity finding. Missing bytes or an unreadable manifest are unavailable coverage, not absence. 2. Manifest present, signature invalid or signed bytes changed. Cite the failure codes. A hash mismatch means the file no longer matches its Content Credentials and was changed after signing; what changed is not established. It never establishes or corroborates material alteration by itself or alongside a classifier. Other signature failures do not establish post-signing byte modification. 3. Manifest present, signature valid, issuer trusted. Provenance evidence. The only state that may count as a corroborating family. 4. Manifest present, signature valid, issuer not trusted. Reported as exactly that. It does not corroborate and it does not support authenticity. 5. Manifest present but unreadable, or trust evaluation unavailable. A coverage limitation, not a finding.

A cryptographically valid signature from an untrusted issuer is not authenticity evidence. Test certificates verify perfectly and mean nothing about trust. This distinction is easy to lose in implementation: the reference SDK reports a validation state of "Valid" for an untrusted issuer, surfacing the trust failure only in a separate results structure. An implementation reading the headline state alone would report a test certificate as trusted provenance.

Manifest contents — claim generator, actions, ingredients, declared edits — are assertions made by whoever signed. Their weight is bounded by the signer's trust status, and they are reported as declared by the signer rather than as established facts about the medium's history.

Readable action history is retained for human inspection, including when validation fails, with that failure clearly stated. Arbitrary action parameters are not sent as narrative instructions or treated as verdict signals. Request the signed original and compare against it to determine the post-signing change.

Durable credentials are the eventual answer to screenshot and re-encode laundering. The McConnell case demonstrated the ceiling of detection without provenance: best-copy classifier results can weaken specific synthetic explanations, but they cannot establish capture origin or the underlying event.

10. Calibration and the Case Record

The case record is not marketing collateral. It is jurisprudence and an acceptance-test suite. Each case records a rule that must survive future development.

The 49ers AI case calibrated single-classifier dominance. Case 002 calibrated temporal bounding and framing divergence: the decisive evidence was not a classifier but an older, wider instance. Case 003 calibrated Rule A7, continuity analysis, degradation-aware nulls, and the difference between fabrication, lineage stability, and unverifiable deletion narratives. The NYT Carroll photo calibrated publication-history nomenclature and page-less exact-copy handling. The Onion satire case calibrated publisher labels as display-only context. The McConnell proof-of-life case calibrated best-evidence forensics, QAI-1 question focus, the 14-day REC-1 gap, UTC date-only display, durable Known History, and the single-release distribution pattern.

The August 2026 validation cycle calibrated Section 1 in full: evidence stability from the notebook series, family independence from the correlated structural signals, the inferential/referential ranking from three failed pixel-forensics attempts against one successful reference comparison, and the validation protocol in Section 4 from control sets that concealed failures they were built to detect.

User feedback feeds the calibration record. A report that is useful, partly right, or wrong is evidence about the methodology. The correct response is not to patch language around a single output; it is to decide whether the case exposes a general rule, add that rule to methodology, and add regression coverage where an implementation can enforce it.

A rejected capability is also a calibration record. Where a detector was built, measured, and withdrawn, both the attempt and the measurement that ended it are retained. A record that documents only what shipped cannot prevent the same attempt from being made again.

Appendix A. Scenario Nomenclature Table

> Headlines were rewritten into plain speech on 2026-09-24. The wording is > display text only: scenario identity, bands and bounds are unchanged, and no > rule may branch on these strings. Prohibited public terms still apply.

Appendix B. Dating Methods and Reliability

All public dates are rendered as UTC date-only values. Public wording must use bounded language such as "since at least" or "documented online as of."

Appendix C. Methodology Version History