git:20261009.a160e9d to git:20261009.91b1806

1 added, 0 removed. Audit A to A.

---

name: c2pa-sign

description: "Embed C2PA content credentials and an AI-disclosure record in AI-generated assets. \"sign these images for AI disclosure\""

+ effort: medium

---

# /socialforge:c2pa-sign — Embed Content Authenticity Provenance

## Purpose

## Context efficiency

Asset-heavy skill. **Grep before Read** the asset catalog (`${CLAUDE_PLUGIN_DATA}/socialforge/brands/<brand>/asset-index.json`) — never list the asset directory. Reference generated images / videos by path, not by loading metadata. Brand profile loads once per session.

Wraps `scripts/c2pa_sign.py` to add a **C2PA manifest** to any SocialForge-generated marketing asset. The manifest carries:

- Machine-readable provenance trail (brand, generator name, timestamp, prompt, target platform)

- IPTC digital-source-type vocabulary tag (`TRAINED_ALGORITHMIC_MEDIA` / `COMPOSITE_WITH_TRAINED_ALGORITHMIC_MEDIA` / `HUMAN_EDITS`)

- schema.org CreativeWork assertion (author = brand organization, dateCreated, publishingPrinciples = target platform)

**Why this matters:** EU AI Act Article 50 applies from **2 August 2026**. Generative-AI marketing content distributed in EU markets must be marked in a machine-readable format using open, interoperable standards — C2PA is the emerging backbone. Penalty: up to **€15 million or 3% global annual turnover**. Additional disclosure obligations apply under NY synthetic-performer law (effective June 2026) and FTC May 2026 endorsement guidance.

The resulting asset is verifiable at [contentcredentials.org/verify](https://contentcredentials.org/verify) or in any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, Microsoft Copilot, etc.).

### C2PA spec versions relevant to SocialForge (June 2026)

- **Content Credentials 2.3** (released 9 February 2026 — [launch post](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/)) added support for **live video** (broadcast/streaming), **plain text documents**, **OGG Vorbis audio**, **large AVI video files**, and **EXIF Original Preservation Images**. Relevant to SocialForge because:

- Live video signing matters if you're producing Reels / TikTok / Shorts streaming content alongside the planned monthly batch.

- EXIF Original Preservation Image format is the cleanest path for signing product photography that the brand wants to preserve through ad ops cropping.

- **C2PA Spec 2.4** (April 2026 — [spec.c2pa.org/specifications/specifications/2.4](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html)) introduces the **AI Disclosure Assertion (`c2pa.ai-disclosure`)** — machine-readable AI transparency info that the EU AI Act Article 50 deployer pathway will read. When `c2pa_sign.py` is on a C2PA SDK ≥ 0.36 that handles 2.4, include this assertion alongside the existing IPTC + schema.org tags. The combination is what the **EU Code of Practice WG1/WG2** drafts reference as the canonical machine-readable mark.

- **C2PA Trust List** is now handled via the public C2PA Conformance Program — production signing certificates should come from a Conformance-Program-listed CA.

For the regulatory context (EU Article 50, the voluntary Code of Practice, the provider-vs-deployer obligations split, and where SocialForge falls), see `references/eu-ai-act-article50.md` in this plugin.

What each platform does with the manifest after upload (which read it, which show a label, which drop it — each claim graded primary or secondary): [content-credentials-by-platform.md](../../references/content-credentials-by-platform.md). Read it before telling a client how a signed asset will appear on a given platform.

## When SocialForge invokes this automatically

If a brand profile sets `c2pa_auto_sign: true`, the image and video generation pipelines call this script as a post-generation step before delivering the asset. The signed file replaces the unsigned one — original output path is preserved.

If the brand profile does NOT set `c2pa_auto_sign: true`, generated assets are unsigned by default. You can sign on demand by invoking this skill explicitly.

## Quick examples

```bash

# Sign an image generated by Vertex AI for Instagram

/socialforge:c2pa-sign \

--input assets/q3-launch-hero.png \

--output assets/signed/q3-launch-hero.png \

--brand "Acme Corp" \

--generator "<provider> / <model id>" \

--ai-claim ai-generated-content \

--platform instagram

# Sign a generated video for TikTok

/socialforge:c2pa-sign \

--input campaigns/launch.mp4 \

--output campaigns/signed/launch.mp4 \

--brand "Acme Corp" \

--generator "<provider> / <model id>" \

--ai-claim ai-generated-content \

--platform tiktok

# Production sign with a real C2PA certificate

/socialforge:c2pa-sign \

--input assets/q3-launch-hero.png \

--output assets/signed/q3-launch-hero.png \

--brand "Acme Corp" \

--generator "<provider> / <model id>" \

--ai-claim ai-generated-content \

--platform instagram \

--signing-cert /secure/c2pa-prod-cert.pem \

--signing-key /secure/c2pa-prod-key.pem

```

## AI claim values (IPTC digital source type)

| Value | When to use |

|---|---|

| `ai-generated-content` | Asset fully generated by AI (default for SocialForge image/video output) |

| `ai-assisted-edits` | Human-created asset with AI editing (e.g. brand-watermarked stock photo + AI background replacement) |

| `ai-no-substantive-changes` | AI used but no semantic change (e.g. AI upscaling, AI noise reduction) |

## Supported asset formats

Image: `.png` · `.jpg/.jpeg` · `.webp` · `.gif` · `.tiff`

Video: `.mp4` · `.mov` · `.webm`

Audio: `.mp3` · `.wav`

## Signing certificate

Production C2PA signatures require a certificate from a CAI-recognized signing authority (Adobe, Truepic, Numbers Protocol, Microsoft Azure Confidential Ledger). Pass `--signing-cert` and `--signing-key` for production. If omitted, the script generates a **self-signed 90-day dev certificate** — assets sign successfully but verify as "signature present, signer not in trust list" at contentcredentials.org/verify. **Do not ship dev-cert-signed assets to production.**

For production deployment:

1. Obtain a C2PA-compatible signing certificate from a CAI-recognized authority

2. Store cert + key securely (not in git; use environment variables or a secret store)

3. Either pass paths on every invocation OR set `c2pa_signing_cert_path` and `c2pa_signing_key_path` in brand profile so the auto-sign hook picks them up

Reference: [opensource.contentauthenticity.org/docs/manifest/signing-manifests/](https://opensource.contentauthenticity.org/docs/manifest/signing-manifests/)

## Python dependencies

- `c2pa-python==0.38.0` (the version the script was tested against)

- `cryptography==46.0.6` — only required for the dev self-signed cert path

Neither is installed for you. If `c2pa-python` is missing, the script stops with the exact pinned command (`python scripts/install_deps.py --groups c2pa` prints it; add `--install` to have the script run it, or set `SOCIALFORGE_INSTALL_DEPS=1` for one run). `cryptography` is not installed for you either: without it the dev self-signed path fails with an error, so install it first.

## Output

JSON status report to stdout:

```json

{

"status": "success",

"input": "assets/q3-launch-hero.png",

"output": "assets/signed/q3-launch-hero.png",

"size_bytes": 482371,

"brand": "Acme Corp",

"generator": "<provider> / <model id>",

"ai_claim": "ai-generated-content",

"c2pa_digital_source_type": "TRAINED_ALGORITHMIC_MEDIA",

"platform": "instagram",

"created": "2026-05-17T10:30:00+00:00",

"manifest_embedded_and_verified": true,

"c2pa_active_manifest_id": "urn:c2pa:...",

"using_dev_cert": false,

"verify_url": "https://contentcredentials.org/verify"

}

```

## Interoperability

This skill is intentionally **self-contained** — signing requires nothing beyond this plugin. Manifests follow the open C2PA spec (same manifest schema, same IPTC vocabulary), so any standards-compliant C2PA tool verifies a SocialForge-signed asset identically, and assets signed elsewhere verify here.

## Related

- `scripts/c2pa_sign.py` — the underlying implementation

- `scripts/generate_image.py` — calls `c2pa_sign.py` as a post-step when brand profile has `c2pa_auto_sign: true`

- `scripts/video_postprocess.py` — same auto-sign hook for video output

- `references/eu-ai-act-article50.md` — regulatory context

- [C2PA spec v2.0](https://c2pa.org/specifications/specifications/2.0/specs/C2PA_Specification.html)

- [Content Authenticity Initiative](https://contentauthenticity.org/)