§7 Layer 2 — Metadata Preservation, Reconciliation, Trust, and Privacy
7.1 Raw Preservation
Producers at conformance level L1+ MUST preserve every metadata segment present at acquisition, byte-exact: { segment: exif|xmp|iptc-iim|icc|c2pa|other, bytes (base64), sha256 }. Preservation is lossless even when parsing fails — unparseable metadata is still evidence.
7.2 Availability States
Each metadata family carries exactly one state:
| State | Meaning |
|---|---|
present | Segment exists in the Asset and is preserved. |
absent | Segment does not exist; no evidence of removal. |
stripped_suspected | Absent, and the acquisition channel is known to strip this family. The basis MUST be stated (e.g., platform identity). |
redacted | Removed or masked by the Producer for privacy, with proof (§7.5). Distinct from absent and stripped. |
unknown | Producer could not determine state. |
7.3 Reconciled Normalized View
A Record at L2+ carries one reconciled metadata object, using the IPTC Photo Metadata JSON-LD vocabulary where a mapping exists. Reconciliation precedence, consistent with Metadata Working Group heritage and the C2PA trust model: C2PA-verified assertion > XMP > IPTC-IIM > EXIF. Disagreements MUST be preserved in conflicts[] — one entry per field, all source values retained. Silent discard is prohibited: a conflict is provenance data.
7.4 Trust Tiers
Every assertion in the normalized view carries a tier: c2pa_verified (cryptographically validated), signed_unverified (signature present, chain not validated), or unsigned. Unsigned values — which includes all bare EXIF — MUST NOT be promoted to trusted semantics, in particular capture time and GPS. This replaces the thesis's “EXIF as authoritative when present” with something that survives an adversary.
7.5 Privacy: Redaction-with-Proof
Sensitive-by-default fields: GPS coordinates, device serial numbers and unique hardware identifiers, owner identifiers, and biometric/person annotations. A redacted value is replaced by { redacted: true, reason, salted_sha256 } with the salt held out-of-record. The Record can thereby prove a value existed — and match it on challenge — without disclosing it. Redaction is recorded in the availability state, so “we removed it” is never confused with “it was never there” or “the platform destroyed it.”
Core rule, carried forward from the thesis verbatim in force: metadata availability MUST NOT be a precondition for producing the Canonical Buffer or any canonical visual embedding.