0009 Where IIIF manifests carry fingerprints: standard fields and a machine-readable fixity bundle

This changes “attach hgp: fields to the IIIF manifest”, as set out in 02-Fingerprint section 9. When arkive did exactly that, the result did not pass the official IIIF validator.

What

• Human-readable fingerprints go as text in the IIIF standard field metadata. The original fingerprint on each canvas (face), and the volume fingerprint on the manifest (volume).
• Machine-readable fingerprints are published separately as a “fixity bundle” file, and the manifest’s seeAlso points to its address. type: "Dataset", format: "application/json", profile: "urn:x-hgp:fixity".
• Fields of the fixity bundle: profile, manifest (which manifest the bundle belongs to), hgp:root (volume fingerprint), hgp:root_version, method (how the volume fingerprint was made), canvases[] (for each canvas: canvas, hgp:sha256 original fingerprint, derivation crop area, rotation, reduced size).
• urn:x-hgp:fixity is a temporary name. When a public name file address (JSON-LD context) is published, it will be replaced with that address. Even then, our own fields will not be attached inside the manifest.
• The grade for IIIF Presentation 3 goes up from “aligned” to “conforms”. Six arkive manifests passed the official IIIF validator (IIIF/presentation-validator, 3.0) with no warnings (arkive 2026-10-12; the hgp session ran the same tool again and confirmed 6/6 passed). The Image API stays “aligned”, because arkive has not opened that service yet.

Documents updated: 02-Fingerprint section 9 (v0.2), 03-manifest sections 7 and 12 (v0.4).

Why

• If our own fields are attached directly to the manifest, the official validator rejects it. Only when the validator passes can IIIF viewers made by others (Mirador and others) and institutions read it as is (decision 0002, “standards outside”).
• metadata and seeAlso are fields IIIF 3.0 has had from the start. People see the fingerprints in a viewer, and machines fetch the bundle and check against it. Neither breaks the standard.
• arkive had already built it this way and passed the validator. We align with what already exists.

Other options

Option	Why not chosen
Keep hgp: fields in the manifest (02 v0.1)	Does not pass the official validator
Publish a public context address first and attach the fields again	Even with an address, the validator does not know these fields, so passing is not guaranteed. We would have to wait until the public repository opens
Fingerprints only in metadata	Machines would have to parse text. It is hard to hold the crop area and how the volume fingerprint was made

Where it has effect

• arkive: already does this (/api/books/<책>/export/fixity). Nothing to do. One arkive to-do item is finished.
• secretary: uses the same shape when publishing recordings as IIIF (canvases with a duration). Nothing to do for now.
• Remaining work: a public address for the hgp: name file. It is needed when the fixity bundle and the claim ledger are published as JSON-LD (03-manifest section 12).

Cost

0 won.