Topics · Evidence gap
A verifier can ask the only question that matters later: does this file still match the record that was signed when it left the original system?
Concrete scenario
A safety report embeds a sensor chart exported from an operations tool. Six months later an investigator receives a PDF screen shot in email. The original portal account is inactive. They need to know whether the visible chart still matches the measurement set that was signed when the incident occurred.
Problem
Files outlive the systems that created them. Metadata strips away, screen shots replace originals, and embeds break the link between what you are looking at and what was actually signed.
Mechanism
The producer commits artifact roots and fingerprints into the receipt claim. A verifier recomputes the digest profile over the candidate file and compares it to the signed inputs_root binding — checking cryptography locally instead of trusting the original service UI.
Verifiable outcome
Scope boundary
Fingerprint binding proves integrity against the signed commitment, not intent, authorship disputes outside the claim, or that the original capture device was honest — those require additional profiles, witnesses, or governance layers.