§9 Provenance, Acquisition Chain, and C2PA Binding

• Acquisition: { method: camera_capture|http_fetch|user_upload|dataset_import|…, source_uri, acquired_at, actor }.
• Chain: an append-only list of transform events { at, actor, action: decode|normalize|embed|transcode|redact|import, tool, params_sha256 } — the Record's own custody log for the post-acquisition life the C2PA manifest cannot see.
• C2PA: when a manifest is present it MUST be validated; the Record stores { status: valid|invalid|missing, manifest_sha256 }. content_hash is the binding key between Record and manifest.
• Record signing: the VER chain is honest but not self-proving. At L3, Producers SHOULD sign the Record — detached JWS or COSE over the JCS canonical form (RFC 8785) of the JSON.

VER complements C2PA; it does not compete with it. C2PA proves what a signer asserted about an asset; VER records what a pipeline actually did with it and what representations it produced.