manifest

The manifest is the ledger that records, for each record, “when, what, with which fingerprint, whose it is, how far it is open, and where it has gone”.

---

1. One shape inside, standards outside

• Inside, we use only one shape. It is a ledger of one line per record (section 2 below). Whether it is a recording or an old document, the common fields are the same, and each type adds only a few fields (section 4).
• When we send something out, we build it in the shape of an international standard. Old documents go out as IIIF manifests, full downloads as BagIt bags, and provenance labels as C2PA (section 7). This is the same way arkive now builds IIIF manifests on demand.
• The only thing we store is our one ledger. If the same content is stored in several shapes, sooner or later they will disagree.
• Field names are short English words, and values use standard vocabularies as they are wherever possible. “Clauses in our own words, fields in standard words” (External Standards Mapping, section 3).

2. Shape of the ledger

• File: one manifest.jsonl in each daily folder of the depositor. One JSON object per line (JSON Lines), UTF-8.
• Append only. Earlier lines are never changed or deleted. When a state changes, copy the latest line of that record, change it, and add it as a new line.
• The last line with the same id is the current state.
• Even if the ledger breaks, it must be possible to rebuild it from the original files and their fingerprints. The files are the real thing.

3. Common fields

Required: must be on every line. Original: only on original records. Interpretation: only on records of the interpretive layer (draft, confirmed, derived). Optional: only when present.

Field	Meaning	Example	When	Standard counterpart
hgp	Version of the Hahoe Genesis Protocol (HGP) specification followed	"2026.10"	Required	HGP-0010 specification version
id	Record number. Made on the device	"3f9a1c2e-7b4d-4e1a-9c2f-0d8e5a6b7c10"	Required	UUID (RFC 9562)
at	Time this line was written	"2026-10-11T08:47:10+09:00"	Required	RFC 3339
event	Why this line was written (section 5)	"received"	Required	PREMIS 3 event name
status	Current processing status (differs by app)	"corrected"	Optional
depositor	Depositor number. Not a name	"u_7k2m9q"	Required	ODRL assigner
kind	Data type (section 4)	"audio"	Required
level	Provenance grade. original original, draft draft, confirmed confirmed, derived derived (04-layer section 2)	"original"	Required	PROV-O Entity
file	File location (relative to the daily folder)	“raw/081203_3f9a1c2e.m4a”	Required
mime	File format	"audio/mp4"	Required	IANA media type
bytes	File size	8213004	Required
sha256_device	Fingerprint taken on the device. null if it could not be taken	"a3f9…"	Original	02-Fingerprint section 2
sha256_store	Fingerprint taken in the store = original fingerprint	"a3f9…"	Required	BagIt manifest-sha256, PREMIS messageDigest
sha256_stored	Fingerprint of the locked file (stored fingerprint)	null	When locked	02-Fingerprint section 4
encryption	Locking	"none" or "user-key"	Required
store	Where the original is now. staging (the staging store on the app server) or arkive (04-layer section 4)	"staging"	Original
started_at	When the record started (for a scan, when it was photographed)	"2026-10-11T08:12:03+09:00"	Original	RFC 3339
source_type	How it came into being (section 6)	"digitalCapture"	Required	IPTC digitalSourceType
action	The act that made it	"c2pa.created"	Required	C2PA c2pa.actions.v2
derived_from	Which record it came from (original fingerprints)	["a3f9…"]	Interpretation	PROV wasDerivedFrom, C2PA ingredient
made_by	Who made it. Whether a person or a machine	{"type":"machine","name":"scribe_v2","provider":"elevenlabs"}	Required	PROV wasAttributedTo
confirmed_by	Who applied the confirmation stamp, and in which role (01-Permissions section 2). Its at is when the stamp was applied, separate from the line’s at (when it was written). Usually the same	{"who":"u_7k2m9q","as":"depositor","at":"2026-10-11T21:03:00+09:00"}	Optional
edits	Number of places changed. People and machines counted separately	{"human":3,"machine":41}	Optional
scope	Scope (00-Principles section 3)	"private"	Required	ODRL policy set
approval_required	“Approval required” flag	false	Optional
scope_after	Time-limited scope (07-Deposit section 5)	[{"at":"2050-01-01","scope":"public"}]	Optional	NAK 8 scheduled disclosure date
owner	Owner number. Only when different from the depositor. If unknown, {"known":false} (07-Deposit section 2)	"g_house_a"	When different	CIDOC-CRM P52
holder	Physical holder (07-Deposit section 2)	"org_ksi"	Optional	CIDOC-CRM P50
agreement	Deposit agreement number (07-Deposit section 4)	"ag-0001"	When owner ≠ depositor	ODRL Agreement
rights	Rights basis and rights holder of the interpretive layer (07-Deposit section 3)	{"basis":"copyright","holder":"u_3x8p"}	Interpretation	PREMIS rightsBasis
consent	The four use consent fields (00-Principles section 4)	{"archive":true,"family":false,"publish":false,"train":false,"at":"…"}	Original	ODRL Permission
voices	Other people’s voices and their consent	[{"who":"p_2","consent":"yes","at":"…"}]	Optional
sent_to	Record of the original or text going outside (section 8)	[{"provider":"elevenlabs","purpose":"transcribe","what":"audio","at":"…","last_at":"…","count":1}]	Optional	PROV Activity
via	Outside places the original passed through before reaching the store (decision 0017)	["telegram"]	Optional	PROV wasInfluencedBy
title	Title	"아침 산책" (“morning walk”)	Optional
people	People who appear	["길동이"] (a sample name)	Optional

Value labels:

• scope: sealed sealed · private private · relation relation · community community · public public
• rights.basis: none no rights (the old text itself) · ownership ownership and agreement · copyright copyright of the person who made it · contract set by the agreement · unsettled the law is not yet clear
• made_by.type: human person · machine machine
• voices[].consent: yes · no · asked (asked, waiting for an answer)
• confirmed_by.as: depositor depositor · editor human editor · admin administrator (only when the depositor has entrusted that record to them). Machines have no value
• consent.train: false, or a list of the training consented to, [{"by":"nodeone","for":"ocr"}]. by is who, for is what is being taught. Any use not on the list is not consented to
• encryption: none · user-key

Names of people in title, people and voices are interpretive information. They stay only inside the store, are locked together with the original when it is locked, and never go out to a certification body or an anchor (section 9).

4. Fields by type

Each type adds the fields below to the common fields. The outside standard is the shape used when that type is sent out.

Recording audio

Field	Meaning	Example
duration_sec	Length (seconds)	2052
codec, sample_rate, channels	Sound format	"aac", 44100, 1
device	Device that recorded it	"SM-S921N"
place	Place. The depositor chooses the precision	"안동" (Andong)

Outside standards: for viewing and exchange, an IIIF 3 canvas (a canvas with duration); each passage of the transcript points to a time span with W3C Web Annotation (#t=12.5,18.0, W3C Media Fragments). For subtitles, WebVTT. For provenance labels, C2PA (for the MP4 family such as m4a, c2pa.hash.bmff.v3). Only when exchanging with oral history archives, PBCore or OHMS; for Korean institutions, the National Library of Korea “Guidelines for Oral Record Metadata” (구술자료 메타데이터 작성 지침) (2023). These guidelines also say that “files born digital are preserved in their original format as they are”. We do not convert a recording original into another format before sending it out.

Old documents and paper scans scan

Field	Meaning	Example
book	Volume number	"book-0001"
seq	Order within the volume	4
width, height, dpi	Image size	2481, 3508, 400
faces	Faces contained in this file (IIIF canvases and the regions within them)	[{"canvas":"c-004a","xywh":[0,0,2481,1000]},{"canvas":"c-004b","xywh":[0,1000,2481,1000]}]
from_bundle	Fingerprint of the received bundle file and the position inside it	{“sha256”:“9be1…”,“path”:“scan-bundle/img004.jpg”}

Outside standards: for viewing and exchange, IIIF Presentation 3 (face = canvas, volume = manifest) and the IIIF Image API. Each line of the reading text points to an image region with W3C Web Annotation (#xywh=). arkive already exports this way. TEI when exchanging reading texts with institutions, METS when exchanging whole packages.

Photo photo

Field	Meaning	Example
width, height	Size	4032, 3024
taken_at	When it was taken	"2026-10-11T07:58:00+09:00"
place	Place. The depositor chooses the precision	"하회마을" (Hahoe Village)

EXIF and XMP information inside the file is part of the original, so it is not touched. Outside standards: IPTC Photo Metadata, C2PA, and for viewing an IIIF 3 canvas.

Video video

duration_sec, width, height, codec, device, place. Outside standards: IIIF 3 canvas (a canvas with both duration and size), C2PA (c2pa.hash.bmff.v3), and WebVTT for subtitles.

Typed text text

Field	Meaning	Example
language	Language	"ko" (BCP 47)
chars	Number of characters	812

The format is text/plain or text/markdown, UTF-8.

Records of the interpretive layer (transcription, correction, translation, summary)

The type follows the original (a transcript of a recording is also kind: "audio"). level is one of draft, confirmed and derived, and derived_from and made_by must be present. The field shape of the interpretive layer follows the outside standard of the original’s type (Web Annotation).

5. Event names (event)

These follow the event names of PREMIS 3, the international preservation standard.

event	Meaning	Closest PREMIS event
captured	Recording ended on the device and the fingerprint was taken	capture
received	The store received it and the fingerprint matched. When moving from the staging store to arkive, this name is used once more and store changes (decision 0017)	ingestion
fixity_checked	The fingerprint matched in a regular check	fixity check
fixity_failed	In a regular check, the fingerprint differed or the file was missing	fixity check
sent	The original or text went outside (section 8)	transfer
derived	An interpretation was made from this record	creation
confirmed	A person applied the confirmation stamp	validation
scope_changed	The scope changed	policy assignment
consent_changed	The use consent changed	policy assignment
encrypted	Locked with the depositor’s key	encryption
destroyed	The key was destroyed (deletion). This line remains	deletion
status	Only the app’s processing status changed

6. How it came into being (source_type)

We use the IPTC digitalSourceType vocabulary as it is. It is a standard that only requires matching values, so it is the only one we can say “conforms” to right now (External Standards Mapping, section 0). The table below follows the “Record Coordinates Examples” of the September HGP specification.

Record	level	action	source_type
Recording original, photos and videos taken directly	original	c2pa.created	digitalCapture
Scans of old documents and handwritten manuscripts	original	c2pa.created	digitalCapture
Typed text	original	c2pa.created	digitalCreation
Machine transcription, OCR, draft decipherment of cursive script (talcho)	draft	c2pa.converted	trainedAlgorithmicMedia
Dictionary correction (only sure replacements from a dictionary; the dictionary in made_by)	draft	c2pa.edited	trainedAlgorithmicMedia (the base is a machine transcription)
Confirmed version that a person corrected or checked	confirmed	c2pa.edited	humanEdits
Audio with noise removed	confirmed-grade	c2pa.edited	algorithmicallyEnhanced
AI summary, translation	derived	c2pa.created	trainedAlgorithmicMedia
Voice changed by AI (stand-in voice)	none	c2pa.edited	trainedAlgorithmicMedia

The September examples left the source_type of machine transcription (draft) empty as “not applicable”. Here we fill it with trainedAlgorithmicMedia for principle 6 (AI contribution labelling). The AI contribution label is computed from this field together with made_by, confirmed_by and edits. Example: “Machine transcription, checked by a person, 3 places corrected by a person”.

7. International standards used when sending out

The grades follow the September HGP “External Standards Mapping”. Conforms: checked with a validation tool. Aligned: we can convert ours into that standard’s shape and send it out. Referenced: consulted. We do not write “conforms” before checking.

Use	Standard	Current grade	To raise it to “conforms”
Fingerprint	SHA-256 (FIPS 180-4)	conforms
Time, number, format, language	RFC 3339, UUID (RFC 9562), IANA media type, BCP 47	conforms
How it came into being	IPTC digitalSourceType	conforms
Full download	BagIt (RFC 8493). Our original fingerprints go into manifest-sha256.txt as they are	aligned	Pass a BagIt validation tool
Viewing and exchanging old documents	IIIF Presentation 3	conforms	Six arkive volume manifests passed the official IIIF validator (presentation-validator 3.0) with no warnings (2026-10-12). Fingerprints go in metadata and in the fixity bundle linked by seeAlso (02-Fingerprint section 9, Decision 0009)
Serving old document images	IIIF Image API	aligned	arkive opens an Image API service and passes a validation tool
Viewing recordings and video	IIIF Presentation 3 (canvas with duration)	aligned	Manifests issued by secretary pass the same validator
Transcription, correction, comments	W3C Web Annotation (readings use supplementing, suggested edits editing, comments commenting)	aligned
Attaching provenance and AI labels to files	C2PA 2.x, CAWG Identity	aligned	Attach signatures and pass a C2PA validation tool (secretary v0.2 and later)
Scope and use	W3C ODRL 2.2	aligned	Publish an HGP ODRL profile
Chain of history	W3C PROV-O	aligned
Preservation events	PREMIS 3 event names	aligned
Storage folder layout	OCFL	referenced
Exchange with oral history archives	PBCore, OHMS, National Library of Korea “Guidelines for Oral Record Metadata” (구술자료 메타데이터 작성 지침) (2023.1, shared by oral history institutions in Korea)	referenced	When a partner institution appears. When sending to a Korean institution, the National Library of Korea guidelines come first
Exchange of reading texts and packages	TEI, METS	referenced	When a partner institution appears

When exchanging with Korean institutions (the Korean Studies Advancement Center, the National Archives of Korea, and others), we check that institution’s standards separately and add them to this table.

8. Record of the original going outside (sent_to)

When an original goes to another company, as in transcription, we record that fact (principle 5).

• Write it down before sending. If it is written after sending, the record is lost when the process stops right after sending. The secretary model gateway does this now.
• sent_to keeps one entry per (provider, purpose, what) pair. at is the first time, last_at the last time, count the number of sends (decision 0017).
• One event: "sent" line is written for that pair the first time it is sent each day.
• Training (train) is not grouped. Each send gets its own sent_to entry and its own line.

Field	Meaning	Values
provider	Which company	"elevenlabs", "anthropic"
purpose	For what	"transcribe" transcription, "chat" secretary conversation, "interpret" interpretation, "train" training (only to those listed in consent.train)
what	What went	"audio" the original sound, "text" text
at	First time sent	RFC 3339 time
last_at	Last time sent	RFC 3339 time
count	Number of sends	number

• A result that comes back (a transcript and so on) is made into a new interpretation record. Write the original fingerprint in derived_from, and the company and model in made_by.
• The secretary v0 spec example wrote purpose as "전사" (transcription), but the code accepts only "transcribe". We align on the English label.

9. Fields that go outside and fields that stay inside

Where to	Fields that go out
Certification body, registry (HGP-0005 section 10)	hgp, sha256_store, at, event, scope, signature
Anchor (anchoring)	Only one line with the node’s daily fingerprint, and the time (02-Fingerprint section 6)
Registry on a public ledger (only records whose scope is public, decision 0016)	Version number, fingerprint of the whole record, registry entry number of the previous record. Signed by the store operator
Full download (by the depositor themselves)	Everything

The rest (title, people, voices, place, sent_to and so on) stays only inside the store.

10. Examples

The line written when a recording original entered the store:

{"hgp":"2026.10","id":"3f9a1c2e-7b4d-4e1a-9c2f-0d8e5a6b7c10","at":"2026-10-11T08:46:30+09:00","event":"received","status":"received","depositor":"u_7k2m9q","kind":"audio","level":"original","file":"raw/081203_3f9a1c2e.m4a","mime":"audio/mp4","bytes":8213004,"sha256_device":"a3f9c1…","sha256_store":"a3f9c1…","encryption":"none","started_at":"2026-10-11T08:12:03+09:00","source_type":"digitalCapture","action":"c2pa.created","made_by":{"type":"human","who":"u_7k2m9q"},"scope":"private","consent":{"archive":true,"family":false,"publish":false,"train":false,"at":"2026-10-11T08:12:03+09:00"},"duration_sec":2052,"codec":"aac","sample_rate":44100,"channels":1,"title":"아침 산책","people":["길동이"]}

The line written when the same recording was sent to a transcription company (made by copying and changing the line just before; only the changed fields are shown):

{"at":"2026-10-11T08:47:10+09:00","event":"sent","status":"transcribing","sent_to":[{"provider":"elevenlabs","purpose":"transcribe","what":"audio","at":"2026-10-11T08:47:10+09:00"}]}

The machine transcript that came back (a new record):

{"hgp":"2026.10","id":"5c1e0b7a-2d3f-4a8b-9e6c-1f2a3b4c5d6e","at":"2026-10-11T08:52:44+09:00","event":"derived","depositor":"u_7k2m9q","kind":"audio","level":"draft","file":"transcripts/081203_3f9a1c2e_raw.md","mime":"text/markdown","bytes":31877,"sha256_store":"7d20e4…","encryption":"none","source_type":"trainedAlgorithmicMedia","action":"c2pa.converted","derived_from":["a3f9c1…"],"made_by":{"type":"machine","name":"scribe_v2","provider":"elevenlabs"},"scope":"private"}

One scan of an old document (a file containing two faces):

{"hgp":"2026.10","id":"0b6f2c9d-4e1a-4c3b-8a7d-6e5f4a3b2c1d","at":"2026-10-11T20:58:23+09:00","event":"received","depositor":"u_9c4w1n","kind":"scan","level":"original","file":"scans/book-0001/img004.jpg","mime":"image/jpeg","bytes":1003501,"sha256_device":null,"sha256_store":"a2c7bb…","encryption":"none","source_type":"digitalCapture","action":"c2pa.created","made_by":{"type":"human","who":"국학진흥원 촬영"},"scope":"private","consent":{"archive":true,"family":false,"publish":false,"train":false,"at":"2026-10-11T20:58:23+09:00"},"book":"book-0001","seq":4,"width":2481,"height":3508,"faces":[{"canvas":"c-004a","xywh":[0,0,2481,1754]},{"canvas":"c-004b","xywh":[0,1754,2481,1754]}],"from_bundle":{"sha256":"9be1d0…","path":"scan-bundle/img004.jpg"}}

A daily fingerprint line and a volume fingerprint line (02-Fingerprint sections 5 and 6):

{"hgp":"2026.10","event":"day_root","depositor":"u_7k2m9q","day":"2026-10-11","version":1,"count":3,"method":"rfc6962-sha256","root":"e81f03…","at":"2026-10-14T00:00:00+09:00"}
{"hgp":"2026.10","event":"book_root","book":"book-0001","version":2,"count":143,"method":"rfc6962-sha256","root":"4c9a7e…","at":"2026-10-11T21:30:00+09:00"}

11. Mapping from existing ledgers

Now	This document
secretary sha256_phone	sha256_device
secretary sha256_server	sha256_store
secretary id, file, started_at, duration_sec, title, people, status, sent_to, encryption, store, at	Same names, unchanged
arkive fixity.tsv sha256, path, size, registered_at, source	sha256_store, file, bytes, at (event: "received"), from_bundle
arkive readings.jsonl made_by, agent_type, verified_by	made_by.who, made_by.type, confirmed_by
level values L0, L1, L2, L3 in the September specification and hgp v0.1	original, draft, confirmed, derived
arkive corrections.jsonl status accepted	event: "confirmed", confirmed_by
personal archive hashes.jsonl layer: A~D	Not used (a field removed from the September canonical glossary). Use level

secretary and arkive do not need to rename anything right away. The next time they change their data structure, they align with this document; until then, the matching names are read as the same thing. Renaming is a data structure change in each repository, so it needs separate approval.

12. To check

• The secretary recording format is provisionally AAC (ADTS) (secretary decision 0006). ADTS is not in the MP4 family, so C2PA is attached to the file differently than for m4a. Look at this together when the format is settled.
• The public address of the hgp: name file is https://hgp.hahoe.io/ns/v1.jsonld (08-Name file, Decision 0014). v1 contains only the fingerprint and relation network fields. The ledger fields in this document go into v2 once 03 is approved.