open-standards/wai/extensions/reconstruction-binding.md

# WAI Extension: Reproducible-Reconstruction Binding

> Status: Draft. A cryptographic **hard binding over the deterministically
> decoded pixels** of a neural-coded asset — the reconstruct-side analogue of
> the [Asset Provenance](provenance.md) extension, and a bridge from WAI's
> byte-exact decode into C2PA / JPEG Trust provenance. Reference impl: the
> `reconstruction_binding` module of `wai-rs` (feature `provenance`).
> Keywords **MUST**, **MUST NOT**, **SHOULD**, **MAY** are RFC 2119/8174.

## 1. Scope and model

A provenance manifest binds itself to an asset with a **hard binding**: a
cryptographic hash over the asset's bytes. For neural-coded media that hash
covers the *compressed* codestream, and it has been the only hard option
available — because a neural decode is normally not reproducible. Two conformant
decoders may produce different pixels, so a hash of the *decoded image* is not
portable across implementations, and provenance over the rendered result has had
to fall back to fuzzy **soft** bindings (perceptual hashes, watermarks), which
are approximate and spoofable.

This is not incidental to the codec. The JPEG AI standard (ISO/IEC 6048 /
ITU-T T.840) defines its normative bit-exact conformance point at the **output
of the entropy decoder**, not at reconstruction to pixels; and its multi-branch
design specifies **up to three synthesis transforms** (`decoderID` 0/1/2), any of
which produces a conformant reconstruction of the same codestream. Reconstruction
to pixels is therefore, by design, **not** required to be bit-exact, and one
codestream may legally decode to different images. A hash of the decoded pixels is
not portable under the base standard.

WAI decodes to RGB **deterministically** — one pinned reconstruction, byte-identical
on every machine (integer entropy and dequant; fixed-order, reproducible synthesis).
Pinning one reconstruction is a determinism guarantee **beyond what the base standard
requires**, and it restores exactly the precondition a hard binding needs: a stable,
portable hash of the decoded pixels. This extension expresses that hash as a
provenance assertion.

A `reconstruction-binding` is **not a content capability**. The asset declares an
ordinary capability (`wai.image.jpegai`, `wai.neural.int_hyper`, …) and is carried
and decoded normally; the binding is metadata *about* the decoded result, the way
[`provenance`](provenance.md) is metadata about the carried bytes.

## 2. The binding

A binding is a hash plus the descriptor that makes the decode reproducible:

```json
{
  "alg": "sha256",
  "hash": "<lowercase hex SHA-256 over the canonical decoded pixels>",
  "reconstruction": {
    "decoderId":  0,          // the pinned synthesis branch (multi-branch codecs)
    "profile":    "<id>",     // codec profile
    "level":      "<id>",     // codec level
    "width":      256,
    "height":     256,
    "format":     "RGB8",     // canonical: row-major, 3 bytes/pixel, no padding, no alpha
    "colorSpace": "bt709"
  }
}
```

- **Hash algorithm** — `sha256` (the C2PA default; every C2PA validator supports
  it). MUST be an algorithm in the C2PA hash-algorithm registry.
- **Canonical buffer** — the hash is computed over the decoded image as a `RGB8`
  buffer: row-major, three bytes per pixel, no row padding, no alpha, exactly
  `width * height * 3` bytes. No other pre-processing.
- **The descriptor is part of the binding.** A multi-branch codec decodes one
  codestream several ways; a verifier MUST decode under exactly the descriptor's
  `decoderId`, `profile`, and `level` before hashing, or the comparison is
  meaningless. The descriptor pins the one reconstruction the hash is over.

Conformance criterion: **decode-equivalence** — a verifier that decodes the
codestream with a WAI decoder under the binding's descriptor, hashes the canonical
`RGB8` buffer, and compares MUST obtain the recorded `hash`.

## 3. C2PA / JPEG Trust carriage

C2PA (and JPEG Trust, ISO/IEC 21617-1, which is built on the C2PA architecture)
has **no standard assertion that hashes decoded/rendered pixels** — every standard
hard binding (`c2pa.hash.data`, `c2pa.hash.boxes`, `c2pa.hash.bmff`) hashes the
compressed bytes. A reproducible-reconstruction binding is therefore expressed as a
**custom assertion**, using C2PA's reverse-domain labelling for third-party
assertions:

- **Assertion label:** `science.transaction.wai.hash.reconstruction`
- **Body:** the object in §2, serialized as a CBOR map (the C2PA assertion
  serialization). Field names map 1:1 to the JSON above:
  `alg` (text), `hash` (byte string), and `reconstruction` (a map of
  `decoderId` (uint), `profile`/`level`/`format`/`colorSpace` (text),
  `width`/`height` (uint)).
- **Placement:** this assertion is **additional**. A manifest SHOULD still carry a
  standard hard binding (`c2pa.hash.data` over the codestream) referenced by the
  claim's `created_assertions`, so it is valid in any C2PA validator; the
  reconstruction binding sits **beside** it. The byte-binding proves *these
  compressed bytes*; the reconstruction binding upgrades that to *and anyone who
  decodes them per this descriptor obtains this exact image*.
- **Signature:** the assertion is covered by the C2PA claim signature like any
  other, so it is tamper-evident.

The digest is the same value WAI's own receipt carries (§4), so a validator with a
WAI decoder reaches a matching hash whether it reads the C2PA CBOR assertion or the
WAI receipt.

## 4. WAI receipt carriage

The binding MAY be carried in a WAI receipt alongside an [asset
provenance](provenance.md) receipt: provenance binds the opaque asset bytes
(content-hash-equivalence, BLAKE3 over the envelope); this binds the reconstructed
pixels (decode-equivalence, SHA-256 over the canonical RGB). Together they cover
both halves of the thesis — the bytes that are carried and the pixels that are
reconstructed. The reference impl emits the §2 JSON via
`ReconstructionBinding::to_json`.

## 5. Machine-readable AI-content marking

A reproducible-reconstruction binding is a substrate for **machine-readable marking
of AI-processed media**. Where a regime requires content to be marked in a
machine-readable, detectable format (for example EU AI Act Article 50, whose
transparency obligations apply from 2 August 2026, with the technical marking
standards developed via the Code of Practice), a signed assertion that binds the
*reconstructed* content — carried through the neural coding step rather than
invalidated by it — is a mechanism that survives decode. WAI states this as a
capability (a signed, reproducible binding over decoded content); it does not make
a legal claim, and any deployment MUST confirm sufficiency against the applicable
regime.

## 6. Reference implementation

`wai-rs`, feature `provenance`, module `reconstruction_binding`:
`ReconstructionDescriptor`, `ReconstructionBinding::{bind, verify, hash_hex,
to_json, C2PA_LABEL}`. `bind` hashes the canonical `RGB8` buffer under a
descriptor; `verify` re-hashes a freshly decoded buffer and compares. The digest is
a plain SHA-256, reproducible by any SHA-256 implementation — which is what makes it
portable into a C2PA validator.