{
  "profile": "dialokia-prov-1",
  "schema_version": 1,
  "updated": "2026-08-07",
  "scope": [
    "material-html",
    "informe-pedagogico",
    "transcripcion",
    "informe-pedagogico-pdf",
    "transcripcion-pdf"
  ],
  "standards": ["RFC 7515", "RFC 8785"],
  "jws": {
    "serialization": "compact",
    "segment_encoding": "base64url without padding",
    "alg": "ES256",
    "signature_encoding": "64-byte IEEE P1363 r||s",
    "protected_header": {
      "exact_members": ["alg", "kid", "typ"],
      "alg": "ES256",
      "kid": "stable identifier of the signing key",
      "typ": "dialokia-prov-1+jws"
    },
    "protected_header_serialization": "RFC 8785 (JCS)"
  },
  "manifest": {
    "serialization": "RFC 8785 (JCS)",
    "exact_members": [
      "schema_version",
      "artifact_type",
      "ai_generated",
      "provider_family",
      "generated_at",
      "output_id",
      "content_sha256"
    ],
    "members": {
      "schema_version": "integer 1",
      "artifact_type": "material-html, informe-pedagogico, transcripcion, informe-pedagogico-pdf or transcripcion-pdf",
      "ai_generated": "boolean true",
      "provider_family": "non-empty provider/model family string",
      "generated_at": "ISO 8601 UTC timestamp stable for the artifact",
      "output_id": "non-empty opaque output identifier stable for the artifact",
      "content_sha256": "64 lowercase hexadecimal characters"
    },
    "payload": "base64url without padding of the UTF-8 JCS manifest"
  },
  "content_binding": {
    "material-html": {
      "output_id_source": "MaterialRequest.id",
      "generated_at_source": "MaterialRequest.completedAt",
      "signed_marker": "<meta name=\"dialokia-provenance\" content=\"<compact-jws>\">",
      "empty_marker": "<meta name=\"dialokia-provenance\" content=\"\">",
      "marker_pattern": "<meta name=\"dialokia-provenance\" content=\"([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)\">",
      "marker_rule": "exactly one global match is required",
      "hash_input": "exact UTF-8 bytes of the final delivered HTML after replacing the complete unique signed marker with the empty marker; no DOM reserialization or newline normalization",
      "composition_order": "all delivery transforms, CSP and visible notice; empty marker; hash and signature; replace only the empty marker value with the compact JWS",
      "collision_rule": "delivery fails closed if transformed source HTML already contains the reserved provenance marker name"
    },
    "informe-pedagogico": {
      "output_id_source": "top-level report.sessionId",
      "generated_at_source": "top-level report.generatedAt",
      "jws_location": "top-level report.provenance.jws",
      "projection": "the complete parsed top-level report object excluding only the top-level provenance member",
      "hash_input": "UTF-8 bytes of the RFC 8785 (JCS) projection",
      "consistency_rule": "the verified manifest output_id must equal report.sessionId and generated_at must equal report.generatedAt",
      "rendering_rule": "verify the received projection before normalization or rendering"
    },
    "transcripcion": {
      "output_id_source": "top-level transcript.sessionId",
      "generated_at_source": "transcript.metadata.generatedAt",
      "jws_location": "top-level transcript.provenance.jws",
      "projection": "the complete parsed top-level transcript object excluding only the top-level provenance member",
      "hash_input": "UTF-8 bytes of the RFC 8785 (JCS) projection",
      "consistency_rule": "the verified manifest output_id must equal transcript.sessionId and generated_at must equal transcript.metadata.generatedAt",
      "rendering_rule": "verify the received projection before normalization or rendering"
    },
    "informe-pedagogico-pdf": {
      "output_id_source": "source report.sessionId",
      "generated_at_source": "source report.generatedAt",
      "signed_marker": "%dialokia-provenance:<compact-jws>",
      "empty_marker": "%dialokia-provenance:",
      "marker_rule": "exactly one ASCII marker line is required immediately before the terminal startxref line; startxref must be followed by one decimal offset line and terminal %%EOF, using LF or CRLF, with only PDF whitespace permitted after %%EOF",
      "hash_input": "exact bytes of the final delivered PDF after removing only the compact JWS bytes from the unique terminal marker; no PDF parsing, reserialization or newline normalization",
      "composition_order": "generate the final PDF through its trailer; insert the empty marker line immediately before terminal startxref; hash and sign that canonical byte sequence; insert only the compact JWS after the marker colon",
      "consistency_rule": "an authenticated delivery must require the verified manifest output_id to equal the requested report sessionId",
      "rendering_rule": "verify the received PDF bytes before creating a browser Blob, rendering or download"
    },
    "transcripcion-pdf": {
      "output_id_source": "source transcript.sessionId",
      "generated_at_source": "source transcript.metadata.generatedAt",
      "signed_marker": "%dialokia-provenance:<compact-jws>",
      "empty_marker": "%dialokia-provenance:",
      "marker_rule": "exactly one ASCII marker line is required immediately before the terminal startxref line; startxref must be followed by one decimal offset line and terminal %%EOF, using LF or CRLF, with only PDF whitespace permitted after %%EOF",
      "hash_input": "exact bytes of the final delivered PDF after removing only the compact JWS bytes from the unique terminal marker; no PDF parsing, reserialization or newline normalization",
      "composition_order": "generate the final PDF through its trailer; insert the empty marker line immediately before terminal startxref; hash and sign that canonical byte sequence; insert only the compact JWS after the marker colon",
      "consistency_rule": "an authenticated delivery must require the verified manifest output_id to equal the requested transcript sessionId",
      "rendering_rule": "verify the received PDF bytes before creating a browser Blob, rendering or download"
    }
  },
  "jwks": {
    "url": "https://api.dialokia.com/api/verificar/jwks.json",
    "key_type": "EC P-256",
    "required_members": ["kty", "crv", "x", "y", "kid", "dialokia_status"],
    "private_members_forbidden": ["d"],
    "statuses": {
      "activa": "may sign and verifies existing artifacts",
      "retirada": "must not sign and continues to verify historical artifacts",
      "revocada": "must not sign or verify; maps to unrecognized"
    }
  },
  "verification_states": {
    "valid": "signature valid with an active or retired key and content hash unchanged",
    "modified": "signature invalid or content hash mismatch",
    "unrecognized": "mark absent or non-unique, malformed or unknown profile/algorithm/artifact, invalid or unknown key, or revoked key"
  },
  "interpretation_note": "unrecognized does not prove human authorship and does not prove that a signed original never existed",
  "verification_mode": "local in the browser; selected or pasted content is not uploaded",
  "vectors": "/verificar/vectores/manifest.json"
}