{ "reviewed_on": "2026-11-10", "sdk_version": "0.7.2a1", "tested_commit": "8c6fda81b27c5c6c0c9539bbbc3daef7e285b1fa", "ci_url": "https://github.com/ariadne-mark/ariadne-mark/actions/runs/42738430001", "rows": [ { "id": "EU-01", "jurisdiction": "EU", "source_type": "law", "provision": "50(2)", "requirement": "Machine-readable marking and detection", "mechanism": "C2PA + watermark + verifier", "evidence": "217 installed tests; kit fresh exports", "remaining_action": "Actual output coverage and modality applicability", "owner": "shared", "source_id": "EU-50", "implementation_path": "src/ariadne_mark/pipeline/__init__.py", "evidence_path": "tests/integration/test_media.py" }, { "id": "EU-02", "jurisdiction": "EU", "source_type": "law", "provision": "50(2)", "requirement": "Effectiveness, reliability, robustness, interoperability", "mechanism": "Layered scheme and versioned protocols", "evidence": "Scoped historical transforms + external C2PA read", "remaining_action": "Representative delivery/error-rate assessment; known failures", "owner": "shared", "source_id": "EU-50", "implementation_path": "src/ariadne_mark/verification/media.py", "evidence_path": "tests/integration/test_economy.py" }, { "id": "EU-03", "jurisdiction": "EU", "source_type": "law", "provision": "111(4)", "requirement": "Specific provider transition by placement date", "mechanism": "Date-aware product planner", "evidence": "Date-boundary regressions", "remaining_action": "Actual placement date and exception facts", "owner": "operator", "source_id": "EU-TIMING", "implementation_path": "src/ariadne_mark/profiles/__init__.py", "evidence_path": "tests/compliance/test_profiles.py" }, { "id": "EU-04", "jurisdiction": "EU", "source_type": "law", "provision": "50(4)-(5)", "requirement": "Applicable deepfake disclosure and accessibility", "mechanism": "Optional baked-in label", "evidence": "Reference component tests only", "remaining_action": "Product wording, placement, audience and accessibility", "owner": "operator", "source_id": "EU-50", "implementation_path": "src/ariadne_mark/cli.py", "evidence_path": "tests/disclosure" }, { "id": "EU-05", "jurisdiction": "EU", "source_type": "law", "provision": "50(1),50(6)", "requirement": "Direct AI interaction and other applicable duties", "mechanism": "Planner flags scope boundaries", "evidence": "Profile checks", "remaining_action": "App-specific duties outside visual marking", "owner": "operator", "source_id": "EU-50", "implementation_path": "src/ariadne_mark/profiles/__init__.py", "evidence_path": "tests/compliance/test_profiles.py" }, { "id": "CODE-01", "jurisdiction": "EU", "source_type": "voluntary-code", "provision": "1.1.1-1.1.2", "requirement": "Layered signed metadata and watermark", "mechanism": "C2PA, production timestamp gate, TrustMark Q", "evidence": "Signature/hash read + fresh ID read-back", "remaining_action": "Production identity/time policy; durability assessment", "owner": "shared", "source_id": "EU-CODE", "implementation_path": "src/ariadne_mark/signing/__init__.py", "evidence_path": "tests/integration/test_timestamp_expiry.py" }, { "id": "CODE-02", "jurisdiction": "EU", "source_type": "voluntary-code", "provision": "2.1-2.3", "requirement": "Available detection, signed download, clear results", "mechanism": "Open decoder, UI/API, Ed25519 reports", "evidence": "Kit HTTPS + report rejection/isolation", "remaining_action": "Operation/accessibility/continuity for actual audience", "owner": "operator", "source_id": "EU-CODE", "implementation_path": "src/ariadne_mark/server.py", "evidence_path": "scripts/ci_kit_acceptance.py" }, { "id": "CODE-03", "jurisdiction": "EU", "source_type": "voluntary-code", "provision": "3.2-3.3", "requirement": "Reliability and robustness measurement", "mechanism": "Protocols and carried-forward corpus observations", "evidence": "22 clean clips and scoped positives in historical review", "remaining_action": "Held-out content/threat assessment; no population pass claim", "owner": "shared", "source_id": "EU-CODE", "implementation_path": "benchmarks/reliability", "evidence_path": "benchmarks/reliability/README.md" }, { "id": "CODE-04", "jurisdiction": "EU", "source_type": "voluntary-code", "provision": "3.4(c)", "requirement": "Chosen detection interoperability solution by 2027-02-02", "mechanism": "Read-only repository subset, provisional algorithms", "evidence": "Matched recovery in own kit", "remaining_action": "Universal routing/signpost/registered method not qualified", "owner": "Ariadne + operator", "source_id": "EU-CODE", "implementation_path": "src/ariadne_mark/softbinding.py", "evidence_path": "scripts/ci_kit_acceptance.py" }, { "id": "CODE-05", "jurisdiction": "EU", "source_type": "voluntary-code", "provision": "4.1-4.4", "requirement": "Document, test, monitor, train and cooperate", "mechanism": "Evidence templates and versioned reports", "evidence": "Engineering evidence only", "remaining_action": "Adopt operator process and maintain records", "owner": "operator", "source_id": "EU-CODE", "implementation_path": "docs/compliance/operator-evidence-template.md", "evidence_path": "docs/benchmarks/protocols.md" }, { "id": "CA-01", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.1(e),22757.6", "requirement": "Determine covered-provider scope and dates", "mechanism": "Current amended planner without MAU threshold", "evidence": "Profile date/scope regressions", "remaining_action": "Actual production/public-access facts and exceptions", "owner": "operator", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/profiles/__init__.py", "evidence_path": "tests/compliance/test_profiles.py" }, { "id": "CA-02", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.2(a)(1)-(2)", "requirement": "Verification and system-provenance output", "mechanism": "UI/API + reviewed public-source fields", "evidence": "HTTPS fixture verification", "remaining_action": "Review fields/trust and actual deployment", "owner": "shared", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/public_verifier.py", "evidence_path": "scripts/ci_kit_acceptance.py" }, { "id": "CA-03", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.2(a)(3),(c)-(d)", "requirement": "Personal-data minimization and access", "mechanism": "Transient uploads, allowlist, no access logs in kit", "evidence": "Cleanup, privacy and output tests", "remaining_action": "Host/proxy logs and processing review; single-operator scope", "owner": "operator", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/public_verifier.py", "evidence_path": "tests/privacy" }, { "id": "CA-04", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.2(a)(4)-(6),(e)", "requirement": "Public free upload-or-URL tool/API; third-party access", "mechanism": "Upload API/UI; URL fetch intentionally absent", "evidence": "HTTPS upload and API behavior", "remaining_action": "Host availability, capacity, required product link", "owner": "operator", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/server.py", "evidence_path": "scripts/ci_kit_acceptance.py" }, { "id": "CA-05", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.2(b)", "requirement": "Feedback and relevant improvement", "mechanism": "Anonymous aggregate counters", "evidence": "Persistence across restart", "remaining_action": "Review and incorporate useful feedback", "owner": "operator", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/public_verifier.py", "evidence_path": "scripts/ci_kit_acceptance.py" }, { "id": "CA-06", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.3(a)(1)(A)-(E)", "requirement": "Provider/system/version/time/UUID/action fields", "mechanism": "Signed record; ID-to-registry recovery", "evidence": "Record tests, future-date guard, metadata-only recovery", "remaining_action": "Truthful fields, permanence of access, one system/version per kit", "owner": "shared", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/provenance/__init__.py", "evidence_path": "tests/provenance/test_records.py" }, { "id": "CA-07", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.3(a)(2)-(4)", "requirement": "Removal resistance and verifier/standard compatibility", "mechanism": "Watermark + C2PA, external standard read", "evidence": "Known attacks/limits + c2patool validation", "remaining_action": "Permanence not established; provisional soft-binding/discovery", "owner": "shared", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/verification/media.py", "evidence_path": "docs/benchmarks/evidence-index.md" }, { "id": "CA-08", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.3(b)", "requirement": "GenAI-system licensing notice/response process", "mechanism": "Operator evidence template", "evidence": "No automated process implementation", "remaining_action": "Assign 72h/96h and reporting actions when applicable", "owner": "operator", "source_id": "CA-22757", "implementation_path": "docs/compliance/california.md", "evidence_path": "docs/compliance/operator-evidence-template.md" }, { "id": "CA-09", "jurisdiction": "US-CA", "source_type": "law", "provision": "22757.3(a)(1)(F)", "requirement": "2029 assistive-technology metadata", "mechanism": "Planner flags missing future schema", "evidence": "Future profile finding", "remaining_action": "Not implemented; update before applicable date", "owner": "Ariadne + operator", "source_id": "CA-22757", "implementation_path": "src/ariadne_mark/profiles/__init__.py", "evidence_path": "tests/compliance/test_profiles.py" }, { "id": "ENG-01", "jurisdiction": "all", "source_type": "engineering-policy", "provision": "SDK production policy", "requirement": "Trusted timestamp and isolated keys", "mechanism": "Separate provider/report/TLS keys and roots", "evidence": "Local chain/EKU and TSA regression; mount isolation", "remaining_action": "Supply production services; policy is not statute", "owner": "operator", "source_id": "EU-CODE", "implementation_path": "src/ariadne_mark/kit.py", "evidence_path": "tests/signing/test_provider_chain.py" }, { "id": "ENG-02", "jurisdiction": "all", "source_type": "engineering-policy", "provision": "Economy/Resilient selection", "requirement": "Select compute/temporal coverage trade-off", "mechanism": "125ms windows per 5/2s or per-frame marking", "evidence": "6s cadence assertion; per-window/five-sample gates", "remaining_action": "No mode is a statutory minimum or unremovable mark", "owner": "shared", "source_id": "EU-50", "implementation_path": "src/ariadne_mark/video/policy.py", "evidence_path": "scripts/ci_kit_acceptance.py" } ] }