@maestroagora/agora 1.7.0 → 1.8.0

package/.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "maestro-agora",
-  "description": "Self-hosted marketplace for Maestro: Agora, the argument-first persuasion, technical explanation, case-study, and investment-writing skill.",
+  "description": "Self-hosted marketplace for Maestro: Agora, the argument-first writing and publication artifact review skill.",
   "owner": {
     "name": "Mark Laursen",
     "url": "https://github.com/mbanderas"
@@ -9,7 +9,7 @@
     {
       "name": "maestro-agora",
       "source": "./",
-      "description": "Write user-directed commercial, technical, case-study, investment, interface, and spoken arguments that preserve the user's claims, framing, and creative choices."
+      "description": "Write user-directed commercial, technical, case-study, investment, interface, and spoken arguments, then inspect local publication artifacts when explicitly requested."
     }
   ]
 }

package/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "maestro-agora",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "displayName": "Maestro: Agora",
-  "description": "Use /agora for persuasive writing, technical explanation, compelling case studies, fundraising, investment analysis, and spoken or written copy.",
+  "description": "Use /agora for persuasive writing, technical explanation, case studies, investment analysis, spoken or written copy, and explicit publication artifact audits.",
   "author": {
     "name": "Mark Laursen",
     "url": "https://github.com/mbanderas"

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "maestro-agora",
-  "version": "1.7.0",
-  "description": "Maestro: Agora writes clear persuasion, technical explanations, compelling case studies, and investment communication to the user's brief.",
+  "version": "1.8.0",
+  "description": "Maestro: Agora writes clear persuasion, technical explanations, case studies, and investment communication, then audits local publication artifacts when requested.",
   "author": {
     "name": "Mark Laursen",
     "url": "https://github.com/mbanderas"
@@ -25,8 +25,8 @@
   "skills": "./skills/",
   "interface": {
     "displayName": "Maestro: Agora",
-    "shortDescription": "Persuasion, science, cases, and capital",
-    "longDescription": "Install Maestro: Agora in Codex for a direct /agora skill that follows the user's claims, framing, creative choices, and intended action across commercial arguments, technical explanations, case studies, and investment communication.",
+    "shortDescription": "Writing and publication artifact review",
+    "longDescription": "Install Maestro: Agora in Codex for a direct /agora skill that follows the user's claims, framing, creative choices, and intended action across commercial arguments, technical explanations, case studies, and investment communication, with explicit read-only privacy and provenance audits for local publication artifacts.",
     "developerName": "Mark Laursen",
     "category": "Productivity",
     "capabilities": [
@@ -40,7 +40,8 @@
       "/agora sell Write the strongest hero from this brief and destination.",
       "/agora science Explain this technical subject with the certainty and framing I specify.",
       "/agora case study Turn this project material into the case study I describe.",
-      "/agora invest Build this fundraising asset from my thesis, claims, urgency, and plan."
+      "/agora invest Build this fundraising asset from my thesis, claims, urgency, and plan.",
+      "/agora publication audit Inspect this local file for hidden Unicode, metadata, and provenance."
     ]
   }
 }

package/DISCLAIMER.md

@@ -1,6 +1,6 @@
 # User Responsibility and Disclaimer
 
-Last updated: August 10, 2026
+Last updated: August 12, 2026
 
 ## Purpose
 
@@ -23,6 +23,8 @@ That responsibility includes:
 
 Agora can perform claim, evidence, permission, confidentiality, disclosure, diligence, or compliance review when explicitly requested. Such review is automated assistance, not professional advice or a guarantee that content is accurate, lawful, complete, effective, or suitable for a particular purpose.
 
+Agora can also inspect selected local publication artifacts for configured privacy, metadata, hidden-text, review-data, and provenance signals. That inspection is partial and format-dependent. It is not a watermark remover, AI detector, authorship determination, forensic examination, anonymization service, or guarantee that a file is clean, safe, private, authentic, human-written, or free of undisclosed provenance. `NOT_FOUND_BY_THIS_CHECK` applies only to the named check. `UNKNOWN` coverage remains unresolved.
+
 ## No monitoring or approval duty
 
 The project maintainer does not review, approve, monitor, or control what users ask Agora to produce or how users use its output. Availability of a feature or generated result does not constitute approval, endorsement, verification, or legal clearance.

package/PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy Notice
 
-Last updated: August 10, 2026
+Last updated: August 12, 2026
 
 ## Scope
 
@@ -35,6 +35,16 @@ These files can contain sensitive or identifiable writing. Users control the cor
 
 When a user supplies an HTTP or HTTPS URL as a corpus source, the voice tool fetches that URL from the user's computer. The remote website may receive ordinary request and network information under its own privacy policy. The fetched content and resulting profile are not sent to the Agora maintainer by the tool.
 
+## Publication audit
+
+The optional `agora-publication-audit` tool reads local files selected by the user. It computes file hashes and can inspect configured text controls, document properties, comments, notes, tracked changes, image metadata containers, and provenance signals. It does not send source files or audit reports to the Agora maintainer.
+
+The tool does not change source files. It reads each source again after inspection and reports whether its SHA-256 hash stayed unchanged. A report is written to disk only when the user supplies `--output`; the tool refuses to overwrite an existing report.
+
+Audit reports redact metadata values and absolute paths by default. `--show-values` and `--include-paths` can place sensitive or identifying information in terminal output, logs, copied reports, host prompts, or files selected by the user. Users control those options and the storage, sharing, retention, and deletion of reports.
+
+ExifTool, when already installed, runs locally in read mode to add metadata coverage. C2PA verification runs only when the user supplies `--verify-c2pa`; Agora supplies a local settings file that disables remote-manifest fetching. ExifTool, c2patool, the operating system, terminal, host application, and any separately configured wrappers remain third-party software outside the Agora project's control.
+
 ## GitHub interactions
 
 GitHub processes information when users visit the repository, download releases, open issues, create pull requests, or otherwise use GitHub. GitHub's [General Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement) applies to that processing.
@@ -45,7 +55,7 @@ The maintainer may receive and use information a person voluntarily submits thro
 
 Agora does not maintain a project-operated server containing user prompts, drafts, outputs, or voice profiles.
 
-Users can delete locally stored Agora files and voice profiles using their operating system. Data held by npm, GitHub, a host application, a model provider, a remote website, or another third party is governed by that third party's retention and deletion process.
+Users can delete locally stored Agora files, voice profiles, and saved audit reports using their operating system. Data held by npm, GitHub, a host application, a model provider, a remote website, or another third party is governed by that third party's retention and deletion process.
 
 ## Changes and contact
 

package/README.md

@@ -122,6 +122,31 @@ Add modifiers when the subject or asset needs them:
 
 In Codex, `$agora` and the skills picker can also select the installed skill. Other hosts may expose skills through a picker or mention syntax. Asking the agent to use the Agora skill remains portable.
 
+## Publication privacy and provenance
+
+Agora writes copy. It does not create SVG, PNG, JPEG, PDF, DOCX, or PPTX files by itself. Other document, presentation, PDF, site, design, or image tools may place Agora copy into those artifacts.
+
+When you explicitly request a publication audit, Agora can inspect the local artifact before it leaves your control:
+
+```text
+/agora publication audit Inspect ./launch-deck.pptx before I share it.
+```
+
+Run the packaged read-only inspector directly when you want a deterministic report:
+
+```sh
+npx -y -p @maestroagora/agora@latest agora-publication-audit ./launch-deck.pptx
+npx -y -p @maestroagora/agora@latest agora-publication-audit ./public-assets --json --output audit.json
+```
+
+The inspector covers configured hidden or control characters in text, selected HTML and SVG metadata, Office properties and review material, PDF metadata, PNG and JPEG metadata containers, and C2PA carrier hints. ExifTool adds broader read-only PDF and image metadata coverage when it is already installed. `c2patool` verification is opt-in through `--verify-c2pa`, with remote-manifest fetching disabled by supplied settings.
+
+Source files are read only and compared by SHA-256 before and after inspection. Sensitive values and absolute paths are redacted by default. Missing or partial coverage is reported as `UNKNOWN`.
+
+This is publication hygiene, not a watermark remover or authorship detector. A result cannot prove that content is AI-generated, human-written, anonymous, clean, or safe. Claude's documented model-level text marking is not equivalent to unusual Unicode or ordinary file metadata.
+
+Model-level text watermarks are statistical generation signals, not hidden characters or metadata fields. Without the matching provider verifier or detector configuration and enough eligible text, Agora reports that question as uninspected instead of guessing from style, Unicode, or generic detector scores.
+
 ## Routing model
 
 Agora chooses a primary mode first, then the publication surface, then any domain or asset modifiers. `VOICE` enters afterward and preserves your required language and content choices.
@@ -314,11 +339,15 @@ skills/agora/
 |-- SKILL.md
 |-- agents/
 |   `-- openai.yaml
+|-- scripts/
+|   `-- publication-audit.mjs
 `-- references/
     |-- agora-case-studies.md
+    |-- agora-conversion.md
     |-- agora-craft.md
     |-- agora-invest.md
     |-- agora-marketing.md
+    |-- agora-publication.md
     |-- agora-science.md
     `-- agora-voice.md
 ```
@@ -331,7 +360,9 @@ skills/agora/
 - `agora-case-studies.md` adds case structure, results, and optional attribution, permission, and confidentiality review.
 - `agora-conversion.md` adds bounded conversion priors, outcome matching, self-serve and enterprise route design, pricing decision contracts, decision-adjacent proof, contradiction handling, and experiment interpretation for funnel surfaces.
 - `agora-invest.md` adds fundraising, diligence, allocation, and optional claim-review procedures.
+- `agora-publication.md` adds explicit read-only publication privacy and provenance review for local artifacts.
 - `agora-voice.md` adds measured voice profiles and user-controlled profile use.
+- `publication-audit.mjs` produces a deterministic, source-preserving inspection report without a cleaning operation.
 
 ## Public-package hygiene
 
@@ -339,7 +370,9 @@ Research informed Agora, but research custody is separate from distribution.
 
 The public repository and npm package must not contain raw or corrected transcripts, caption files, supplied PDFs or office documents, audio, video, private source identities, model-output scratch, research working files, local paths, or assigned secrets.
 
-`npm run check` runs validation, deterministic tests, the exact package allowlist, and release hygiene. `npm run release:check` repeats that complete distributable validation. `npm pack` and `npm publish` run it through `prepack` and `prepublishOnly`.
+`npm run check` runs validation, deterministic tests, the exact package allowlist, and release hygiene. `npm run release:check` is the proportional mandatory release gate and runs those same checks. `npm pack` and `npm publish` invoke it through `prepack` and `prepublishOnly`.
+
+Behavioral evaluation is optional research, not a pack or publish blocker. `npm run eval:release` preserves the version-specific v1.7 evidence audit and must be run from a matching v1.7 checkout. Existing evaluation artifacts remain frozen for reproducibility; new blind or confirmatory generations are not required for later releases.
 
 The versioned directories under `evals/blind/` are public pairwise-release artifacts, not permanently secret holdouts. `v1.2.0`, `v1.4.0`, `v1.5.0`, and `v1.7.0` are frozen by exact tree hashes in `evals/releases/locks.json`; validation fails on additions, deletions, or edits.
 
@@ -357,12 +390,13 @@ npm pack --dry-run --json
 npx -y @maestroagora/agora --dry-run
 ```
 
-The release gate checks skill structure, routing contracts, user-authority boundaries, modifiers, typography, metadata, reference links, full-tree installer parity, exact npm contents, frozen evaluation-tree locks, and public-tree hygiene.
+The mandatory release gate checks skill structure, routing contracts, user-authority boundaries, modifiers, typography, metadata, reference links, full-tree installer parity, exact npm contents, frozen evaluation-tree locks, public-tree hygiene, and deterministic tests. It does not require model generation or blind adjudication.
 
 ## Change record
 
 | Version | What changed |
 |---|---|
+| 1.8.0 | Adds opt-in publication privacy and provenance review plus a packaged read-only audit CLI. Reports configured hidden Unicode, document and image metadata, Office review material, and C2PA carrier or validation signals without changing source files. Redacts sensitive values and paths by default, preserves unknown coverage, and makes no watermark-removal or authorship claim. |
 | 1.7.0 | Adds a progressively loaded conversion-context reference with bounded conversion priors, downstream outcome matching, self-serve and enterprise route design, pricing decision contracts, proof placement, and contradiction handling. Tightens closed-world fact preservation and limits written GEO/AEO requirements to indexable public work. |
 | 1.6.0 | Expands user control across every writing mode. User-selected claims, fiction, urgency, attribution, profile use, and publication choices now control the draft. Claim, evidence, permission, disclosure, confidentiality, diligence, and compliance review are opt-in. Adds a user-responsibility disclaimer and an accurate privacy notice. |
 | 1.5.0 | Hardens `INVEST` across fundraising, diligence, and capital allocation. Adds an investment claim ledger, metric separations, asset-specific procedures, decision-led questions, objection handling, defensibility analysis, truthful urgency and commitment language, modifier composition, and current-verification boundaries. Separates real projects from fictional mock and concept-portfolio routes, and permits clearly disclosed invention for mock and hypothetical articles. Adds a customer-language boundary that keeps internal checking terms out of ordinary public copy while preserving them where scientific, methodological, audit, legal, compliance, diligence, or technical work needs them. Expands the blind corpus from 60 to 86 cases. Adds a mandatory public-tree and package hygiene gate that blocks research, transcripts, supplied private documents, raw model outputs, local paths, secrets, unexpected binaries, and private source identities. |

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@maestroagora/agora",
-  "version": "1.7.0",
-  "description": "Install Maestro: Agora for persuasive writing, scientific and technical explanation, case studies, fundraising, and investment analysis.",
+  "version": "1.8.0",
+  "description": "Install Maestro: Agora for persuasive writing, technical explanation, case studies, investment communication, and publication artifact review.",
   "type": "module",
   "bin": {
     "agora": "scripts/install.mjs",
+    "agora-publication-audit": "skills/agora/scripts/publication-audit.mjs",
     "agora-voice": "scripts/voice-measure.mjs"
   },
   "files": [
@@ -32,7 +33,7 @@
     "prepublishOnly": "npm run release:check",
     "eval:release": "node scripts/release-evidence-check.mjs",
     "release:check": "npm run check",
-    "test": "node --test tests/behavior-contract.test.mjs tests/hero-contract.test.mjs tests/conversion-context-contract.test.mjs tests/science-contract.test.mjs tests/case-study-contract.test.mjs tests/invest-contract.test.mjs tests/blind-summary.test.mjs tests/blind-judge-prompt.test.mjs tests/blind-judge-materialize.test.mjs tests/blind-judgment-ingest.test.mjs tests/adjudication-reducer.test.mjs tests/eval-provenance-check.test.mjs tests/release-evidence-check.test.mjs tests/release-hygiene.test.mjs tests/install.test.mjs tests/voice-measure.test.mjs",
+    "test": "node --test tests/behavior-contract.test.mjs tests/hero-contract.test.mjs tests/conversion-context-contract.test.mjs tests/science-contract.test.mjs tests/case-study-contract.test.mjs tests/invest-contract.test.mjs tests/publication-audit.test.mjs tests/blind-summary.test.mjs tests/blind-judge-prompt.test.mjs tests/blind-judge-materialize.test.mjs tests/blind-judgment-ingest.test.mjs tests/adjudication-reducer.test.mjs tests/eval-provenance-check.test.mjs tests/release-evidence-check.test.mjs tests/release-hygiene.test.mjs tests/install.test.mjs tests/voice-measure.test.mjs",
     "validate": "node scripts/validate.mjs"
   },
   "engines": {
@@ -62,6 +63,9 @@
     "fundraising",
     "investor-communications",
     "pitch-decks",
+    "publication-privacy",
+    "content-provenance",
+    "metadata-audit",
     "codex",
     "claude-code",
     "cursor",

package/scripts/install.mjs

@@ -248,11 +248,14 @@ async function verifySource() {
     "SKILL.md",
     "agents/openai.yaml",
     "references/agora-case-studies.md",
+    "references/agora-conversion.md",
     "references/agora-craft.md",
     "references/agora-invest.md",
     "references/agora-marketing.md",
+    "references/agora-publication.md",
     "references/agora-science.md",
     "references/agora-voice.md",
+    "scripts/publication-audit.mjs",
   ];
   for (const file of required) {
     if (!(await exists(join(SOURCE_DIR, file)))) {

package/skills/agora/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: agora
-description: Write, rewrite, shorten, critique, or plan user-directed argument-first persuasion, scientific and technical explanation, case studies, and investment communication. Use when invoked as `/agora` or for marketing and sales copy; fundraising, investor outreach, pitch decks, investment memos, diligence, capital allocation, company-profile, category, or brand descriptions; CTAs and microcopy; landing, product, and comparison pages; email and direct outreach; mobile onboarding, upgrade, and paywall screens; ads and social posts; editorial or educational content, including fictional, mock, hypothetical, or concept writing; scientific communication, technical explanation, research communication, and science video scripts; real or fictional customer success, creative portfolio, and technical implementation case studies; and spoken audio/video scripts plus written derivatives such as titles, descriptions, transcripts, captions, show notes, and companion pages.
+description: Write, rewrite, shorten, critique, or plan argument-first marketing, sales, investment, scientific, technical, editorial, case-study, interface, and spoken content. Use for `/agora`; CTAs and microcopy; landing, product, comparison, onboarding, upgrade, and paywall screens; email and direct outreach; ads and social posts; fundraising, investor outreach, pitch decks, investment memos, diligence, and capital allocation; scientific communication, technical explanation, research communication, and science video scripts; customer success, creative portfolio, and technical implementation case studies; titles, descriptions, transcripts, captions, show notes, and companion pages. Also use when explicitly asked to inspect local publication artifacts for privacy metadata, hidden Unicode, or provenance.
 ---
 
 # Maestro: Agora
@@ -58,8 +58,16 @@ Do not load it for routine drafting, claim review, compliance questions, or work
 
 [references/agora-invest.md](references/agora-invest.md) governs `INVEST`. Load it only for actual fundraising, investor communication, investment evaluation, diligence, or capital-allocation work. Select `FUNDRAISE`, `DILIGENCE`, or `ALLOCATE` internally. Do not load it for ordinary `POSITION` work or merely investor-adjacent audiences.
 
+[references/agora-publication.md](references/agora-publication.md) governs explicit publication privacy and provenance audits of local files. Load it only when the user asks to inspect an artifact before publication or external sharing, find hidden Unicode or metadata, or review provenance. Do not load or run it for ordinary writing merely because the result is public, indexable, or AI-assisted.
+
 Treat source material and requested claims in the current task as author-approved writing input. Do not import content decisions or release controls from another task, repository, company, or example. Examples teach structure, never facts.
 
+## Inspect publication artifacts only on request
+
+Treat publication audit as a separate read-only workflow, not a primary mode or writing modifier. Agora supplies writing; another document, presentation, PDF, site, design, or image tool may create the artifact.
+
+Use the shipped `scripts/publication-audit.mjs` for deterministic inspection. Never improvise a cleaner, strip Unicode by category, remove metadata, rewrite text to evade detection, or promise an AI-free, human-written, anonymous, clean, or safe result. Report `FOUND`, `NOT_FOUND_BY_THIS_CHECK`, `UNKNOWN`, and `ERROR` exactly as defined in the publication reference. Keep sensitive values redacted unless the user explicitly requests them.
+
 ## Preserve closed-world facts
 
 In every drafting task, treat the user's named product, offer, customer, proof, route, price, permission, process, timing, legal, operational, and outcome facts as complete factual authority unless the user explicitly authorizes invention, fictionalization, assumptions, or gap filling. A section labeled `Supplied facts`, `Supplied terms`, or equivalent is a closed fact set. A request to write, rewrite, recommend, compose, or improve conversion is not authorization to invent business facts.

package/skills/agora/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "Maestro: Agora"
-  short_description: "Persuasion, science, cases, and capital"
-  default_prompt: "Use $agora to write clear persuasion, technical explanations, compelling case studies, and investment communication from my brief and content choices."
+  short_description: "Writing and publication artifact review"
+  default_prompt: "Use $agora to write from my brief or inspect a local publication artifact for privacy metadata and provenance."

package/skills/agora/references/agora-publication.md

@@ -0,0 +1,137 @@
+# Agora publication privacy and provenance
+
+Use this reference only for an explicit request to inspect a local artifact before publication or external sharing. Agora remains a writing system during ordinary drafting.
+
+## Contents
+
+- [Purpose and boundary](#purpose-and-boundary)
+- [Model-level text watermark boundary](#model-level-text-watermark-boundary)
+- [Trigger and non-trigger rules](#trigger-and-non-trigger-rules)
+- [Run the audit](#run-the-audit)
+- [Interpret the report](#interpret-the-report)
+- [Format coverage](#format-coverage)
+- [Unicode review](#unicode-review)
+- [Metadata and privacy review](#metadata-and-privacy-review)
+- [Provenance review](#provenance-review)
+- [Publication decision](#publication-decision)
+- [Sources](#sources)
+
+## Purpose and boundary
+
+Inspect the artifact that will leave the user's control. Report hidden text controls, document metadata, review material, and provenance carriers without changing source bytes.
+
+Never describe this audit as a watermark remover, AI detector, authorship detector, humanizer, anonymizer, metadata cleaner, or proof that a file is safe or clean. Do not promise detector evasion. A missing finding means only that the named check did not find its configured signal.
+
+Claude's documented text marking is model-level. Do not imply that a Unicode scan can detect or remove it. Unicode review and file metadata review solve narrower publication-hygiene problems.
+
+## Model-level text watermark boundary
+
+A token-distribution watermark is introduced during generation by changing token-selection probabilities. It is not a hidden Unicode string or an ordinary file property. Detection can depend on the matching tokenizer, keyed hash or partition rule, normalization procedure, statistical threshold, and enough eligible text. Without the provider's verifier or equivalent configuration, the result remains `UNKNOWN`.
+
+The Kirchenbauer et al. green-list method is one research example, not evidence that Claude uses that exact scheme. It shows why short or low-entropy text can provide weaker statistical evidence, why editing may dilute rather than deterministically remove a mark, and why a detector can normalize whitespace, homoglyph, or zero-width changes before testing. Unusual Unicode is therefore neither evidence of a model-level watermark nor reliable evidence that one was removed.
+
+Do not estimate model-level watermark status from prose style, generic AI-detector scores, ad hoc word frequencies, or the absence of metadata findings.
+
+## Trigger and non-trigger rules
+
+Load this reference when the user explicitly asks Agora to:
+
+- inspect one or more local files before publication, submission, delivery, or external sharing;
+- find hidden Unicode, metadata, comments, notes, tracked changes, personal information, or provenance records;
+- perform a publication privacy or provenance audit;
+- review an artifact produced by another document, presentation, PDF, site, design, or image tool before release.
+
+Do not load or run the audit merely because writing is public, indexable, generated with AI, or being optimized for GEO/AEO. Do not run it against ordinary chat text unless the user supplies or identifies a local file. Do not create SVG, PNG, JPEG, PDF, DOCX, or PPTX files solely to make this workflow applicable.
+
+## Run the audit
+
+Use the shipped read-only script:
+
+```sh
+node <skill-root>/scripts/publication-audit.mjs <path...>
+```
+
+Use JSON when another tool or agent will consume the report:
+
+```sh
+node <skill-root>/scripts/publication-audit.mjs <path...> --json
+```
+
+Keep sensitive metadata values redacted by default. Use `--show-values` only when the user explicitly needs exact values. Use `--include-paths` only when full local paths are necessary. Use `--verify-c2pa` only when local C2PA verification is requested; the script supplies settings that disable remote-manifest fetching.
+
+The script may write an audit report only through an explicit `--output <path>`. It refuses to overwrite an existing report. It never writes to a source file.
+
+## Interpret the report
+
+Use the exact states:
+
+| State | Meaning |
+|---|---|
+| `FOUND` | The named check observed its configured signal. |
+| `NOT_FOUND_BY_THIS_CHECK` | The named check ran and did not observe that signal. |
+| `UNKNOWN` | Coverage was unavailable, unsupported, skipped, partial, or not requested. |
+| `ERROR` | The named check could not complete. |
+
+Use finding severities as routing aids, not verdicts:
+
+| Severity | Treatment |
+|---|---|
+| `info` | Normal technical detail that may still matter to publication. |
+| `review` | Inspect purpose and intended audience before publishing. |
+| `sensitive` | Likely personal, organizational, editorial, or hidden review material. |
+| `provenance` | Origin or processing information. Presence is not automatically harmful. |
+
+Never collapse `UNKNOWN` into success. Never translate `NOT_FOUND_BY_THIS_CHECK` into `clean`, `AI-free`, `human-written`, `anonymous`, or `safe`.
+
+## Format coverage
+
+| Format | Built-in inspection |
+|---|---|
+| TXT, Markdown | UTF-8 decoding and configured invisible or control characters. |
+| HTML | Text controls, selected metadata fields, and published comments. |
+| SVG | Text controls, metadata blocks, comments, and selected editor fields. |
+| DOCX | Core, application, and custom properties; comments; tracked changes; custom XML. |
+| PPTX | Core, application, and custom properties; comments; authors; notes; hidden slides; custom XML. |
+| PDF | Selected document-information fields, XMP presence, and C2PA carrier hints. |
+| PNG | Text chunks, EXIF-container presence, and C2PA carrier hints. |
+| JPEG | EXIF, XMP, IPTC, comment-container presence, and C2PA carrier hints. |
+
+ExifTool, when already installed, adds broader read-only metadata inspection for PDF, PNG, and JPEG. The script does not install it. Embedded Office media is reported as uninspected instead of being silently treated as clean.
+
+## Unicode review
+
+Review code point, count, and location. Do not delete characters by category.
+
+Zero-width joiners, zero-width non-joiners, variation selectors, and direction controls can be legitimate in emoji, Persian, Arabic, Hebrew, and other writing systems. Treat them as context-dependent. Treat directional overrides, internal byte-order marks, soft hyphens, and unexplained invisible separators as review findings, not proof of malicious or AI-generated text.
+
+## Metadata and privacy review
+
+Prioritize GPS coordinates, device or owner serials, email addresses, author and company names, local paths, comments, speaker notes, hidden slides, tracked changes, custom properties, custom XML, and edit history.
+
+Report field names and counts without values by default. Avoid pasting a full audit report into a hosted model when the report contains values the user has not approved for disclosure.
+
+## Provenance review
+
+Treat creator software, timestamps, XMP, EXIF, IPTC, and C2PA as provenance signals. Do not assume they are private, harmful, accurate, complete, or forged.
+
+C2PA can bind assertions and ingredients to an asset. A carrier hint is not cryptographic validation. `c2patool` validation may distinguish absent, reported, or problematic manifest information, but it cannot establish the full real-world truth of every assertion.
+
+Do not remove or invalidate provenance because it reveals AI involvement. Preserve, disclose, or remove metadata only through a separate user-directed editing workflow with exact fields and consequences identified. This audit provides no cleaning operation.
+
+## Publication decision
+
+Return findings first, then coverage gaps, then source-integrity status. Separate three decisions:
+
+1. Privacy: whether identified values or hidden review material should be disclosed.
+2. Provenance: whether origin and processing records should be preserved or disclosed.
+3. Integrity: whether the inspected source stayed byte-identical.
+
+When remediation is requested later, name exact fields and create a separate copy. Never modify the only source artifact. Re-audit the derived copy and report any provenance invalidation or coverage gap caused by the edit.
+
+## Sources
+
+- Anthropic, [How Claude marks AI-generated content](https://support.claude.com/en/articles/16266773-how-claude-marks-ai-generated-content)
+- Kirchenbauer et al., [A Watermark for Large Language Models](https://arxiv.org/abs/2301.10226) (research mechanism example, not a Claude implementation specification)
+- Coalition for Content Provenance and Authenticity, [C2PA technical specification](https://spec.c2pa.org/specifications/specifications/2.4/specs/ContentCredentials.html)
+- Content Authenticity Initiative, [Using C2PA Tool](https://github.com/contentauth/c2pa-rs/blob/main/cli/docs/usage.md)
+- Phil Harvey, [ExifTool application documentation](https://exiftool.org/exiftool_pod2.html)