The verification model

What "verified" means

After every correction CECO renders the page before and after at its working resolution and compares every pixel. A correction is verified when:

• the pixels that changed all lie inside the region the correction declared, so outside_pixels is 0 on every page; and
• every guard passed (the text is where it was measured to be, the edit kept to its own line, and so on).

It is a statement about the image, made by the service about its own output. It is not a statement that the corrected text is true or that anybody was entitled to change it.

Reading a verification

GET /v1/documents/{document_id}/verification describes the document as it now stands:

• passed: whether it may be released;
• per page, changed_pixels, outside_pixels (must be 0) and the box that changed;
• each guard, with passed and a detail line.

The export gate compares the verification's hash of the file with the hash of the file being released. A document that changed after it was verified cannot be downloaded until it is verified again (verification_hash_mismatch).

The manifest

GET /v1/documents/{document_id}/manifest returns the provenance record embedded in the corrected file: every correction, where it was made and how, as written by the engine. It is returned exactly as written.

The record

Every upload, correction, undo, export and download is written to an append-only record in which each entry carries the hash of the one before. GET /v1/audit/verify-chain recomputes the chain and says where it breaks, if anywhere. GET /v1/audit/export (Business) returns the whole record as a file with that verdict inside it.

Certificates

POST /v1/documents/{document_id}/certificate issues a signed verification certificate: both SHA-256 hashes of the document, every correction and its measurement, and the record's head when it was issued, signed with Ed25519. Anybody can check one, without a key:

• GET /v1/certificates/{id} returns whether it is valid, its hashes and its date;
• POST /v1/certificates/verify checks a certificate file's exact bytes;
• the public key is at /.well-known/ceco-certificate-key, so the signature can be checked without CECO at all.

A certificate is not a notarisation, a legal attestation or an invoice.

The same, for people

How a scanned PDF is corrected and checked describes this model for somebody using the interface rather than a program: how a correction is made, what it is compared against, and what is refused.