{
  "$schema": "/schemas/file-verification-catalog.schema.json",
  "schema_version": "1.0.0",
  "updated": "2026-09-05",
  "title": "HUMMBL file verification catalog",
  "description": "A governed registry of file profiles that HUMMBL can inspect locally in the browser or bound to a deliberately narrower verification mode.",
  "assurance_boundary": "A passing result establishes only the checks named in the result. It does not prove authorship, accuracy, safety, legal compliance, or fitness for purpose.",
  "privacy_boundary": "The public verifier reads selected files in the browser. File bytes are not uploaded or persisted by the verifier.",
  "max_browser_bytes": 10485760,
  "verification_modes": {
    "content": "Hash, metadata, filename, UTF-8 and format-specific content checks run locally.",
    "text-basic": "Hash, metadata, filename, UTF-8 and conservative text-safety checks run locally.",
    "hash-only": "Only local hashing, size, filename, MIME and limited magic-byte observations run.",
    "blocked": "The file is identified, but content parsing is intentionally refused."
  },
  "check_definitions": {
    "filename": "Compare the selected name with the profile's canonical names or patterns.",
    "metadata": "Report browser-provided MIME type and byte size.",
    "magic": "Compare a small set of known binary signatures with the apparent format.",
    "sha256": "Compute SHA-256 from the original bytes in the browser.",
    "utf8": "Require valid UTF-8 before text inspection.",
    "text-safety": "Flag null bytes, mixed line endings and high-confidence secret markers.",
    "sections": "Check profile-specific required headings or fields without judging their truth.",
    "json-parse": "Parse JSON with the browser's JSON parser.",
    "schema": "Validate against a named published schema when a schema is available.",
    "provenance": "Inspect hashes, signatures or provenance envelopes without inferring authorship beyond the evidence.",
    "human-review": "Require a person to judge meaning, accuracy, applicability or completeness."
  },
  "profiles": [
    {
      "id": "project-notes",
      "priority": "P0",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": ["project-notes.txt"],
      "description": "Portable project memory with explicit context, state, decisions, actions, risks and verification notes.",
      "use_cases": [
        "onboarding",
        "handoff",
        "delivery",
        "research",
        "operations",
        "governance"
      ],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "sections",
        "human-review"
      ]
    },
    {
      "id": "robots-txt",
      "priority": "P0",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": ["robots.txt"],
      "description": "Crawler access instructions for an origin.",
      "use_cases": ["web publishing", "crawler policy"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ],
      "standard_url": "https://www.rfc-editor.org/rfc/rfc9309.html"
    },
    {
      "id": "security-txt",
      "priority": "P0",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": ["security.txt", ".well-known/security.txt"],
      "description": "Security vulnerability disclosure contacts and policy metadata.",
      "use_cases": ["security disclosure", "incident routing"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ],
      "standard_url": "https://www.rfc-editor.org/rfc/rfc9116.html"
    },
    {
      "id": "llms-txt",
      "priority": "P0",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": ["llms.txt", "llms-full.txt"],
      "description": "Human-authored site guidance and context intended for AI consumers.",
      "use_cases": ["AI discovery", "public documentation index"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "humans-txt",
      "priority": "P1",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": ["humans.txt"],
      "description": "Voluntary credits and human-maintainer metadata for a website.",
      "use_cases": ["attribution", "maintainer discovery"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "plain-text-operational",
      "priority": "P1",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": [
        "handoff.txt",
        "incident-report.txt",
        "research-notes.txt",
        "release-notes.txt",
        "runbook.txt"
      ],
      "description": "Small, portable operational records that remain readable without specialist tooling.",
      "use_cases": [
        "handoff",
        "incident response",
        "research",
        "release",
        "operations"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "dependency-inputs-txt",
      "priority": "P0",
      "family": "project-config",
      "file_type": "text/plain",
      "filenames": [
        "requirements.txt",
        "constraints.txt",
        "dev-requirements.txt"
      ],
      "description": "Python dependency and version-constraint inputs for reproducible environment review.",
      "use_cases": [
        "dependency inventory",
        "environment setup",
        "supply-chain review"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "project-memory-txt",
      "priority": "P1",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": [
        "architecture-notes.txt",
        "decision-log.txt",
        "meeting-notes.txt",
        "stakeholder-notes.txt"
      ],
      "description": "Focused project memory for architecture, decisions, meetings and stakeholder context.",
      "use_cases": [
        "design review",
        "decision trace",
        "meeting handoff",
        "stakeholder continuity"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "delivery-records-txt",
      "priority": "P1",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": [
        "deployment-notes.txt",
        "maintenance-notes.txt",
        "test-results.txt",
        "rollback-notes.txt"
      ],
      "description": "Delivery records for deployment, maintenance, test outcomes and rollback readiness.",
      "use_cases": [
        "release gate",
        "operations handoff",
        "test evidence",
        "recovery planning"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "data-ai-notes-txt",
      "priority": "P1",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": [
        "data-notes.txt",
        "dataset-notes.txt",
        "model-notes.txt",
        "evaluation-notes.txt"
      ],
      "description": "Plain-text context for datasets, models, evaluations, limitations and reproducibility.",
      "use_cases": [
        "data handoff",
        "model review",
        "evaluation record",
        "reproducibility"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "governance-records-txt",
      "priority": "P1",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": [
        "audit-notes.txt",
        "risk-register.txt",
        "control-notes.txt",
        "exception-log.txt"
      ],
      "description": "Reviewable governance memory for audits, risks, controls and time-bounded exceptions.",
      "use_cases": [
        "audit preparation",
        "risk review",
        "control testing",
        "exception tracking"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "attribution-records-txt",
      "priority": "P2",
      "family": "documentation",
      "file_type": "text/plain",
      "filenames": [
        "AUTHORS.txt",
        "NOTICE.txt",
        "ACKNOWLEDGMENTS.txt",
        "DEPENDENCIES.txt"
      ],
      "description": "Human-readable attribution, notice and dependency disclosure records.",
      "use_cases": ["attribution", "distribution review", "license handoff"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "readme",
      "priority": "P0",
      "family": "documentation",
      "file_type": "text/markdown",
      "filenames": ["README.md"],
      "description": "Project identity, purpose, installation, usage and support entry point.",
      "use_cases": ["onboarding", "distribution", "maintenance"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "changelog",
      "priority": "P0",
      "family": "documentation",
      "file_type": "text/markdown",
      "filenames": ["CHANGELOG.md"],
      "description": "Versioned record of notable project changes.",
      "use_cases": ["release review", "upgrade planning", "audit trail"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "project-policy-docs",
      "priority": "P0",
      "family": "documentation",
      "file_type": "text/markdown",
      "filenames": [
        "SECURITY.md",
        "CONTRIBUTING.md",
        "GOVERNANCE.md",
        "SUPPORT.md",
        "CODE_OF_CONDUCT.md"
      ],
      "description": "Project policies for security, contribution, governance, support and conduct.",
      "use_cases": [
        "project readiness",
        "community operations",
        "control review"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "agent-instructions",
      "priority": "P1",
      "family": "documentation",
      "file_type": "text/markdown",
      "filenames": ["AGENTS.md", "CLAUDE.md", "project-instructions.md"],
      "description": "Repository-local operating instructions for human and agent tooling.",
      "use_cases": ["agent onboarding", "tool governance", "scope control"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "license",
      "priority": "P0",
      "family": "documentation",
      "file_type": "text/plain",
      "filenames": ["LICENSE", "LICENSE.txt", "LICENSE.md"],
      "description": "Project licensing terms or a reference to applicable terms.",
      "use_cases": ["distribution", "dependency review", "legal review"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "citation-cff",
      "priority": "P1",
      "family": "evidence",
      "file_type": "application/yaml",
      "filenames": ["CITATION.cff"],
      "description": "Structured citation metadata for software and research artifacts.",
      "use_cases": ["citation", "research attribution", "release metadata"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "schema",
        "human-review"
      ],
      "standard_url": "https://citation-file-format.github.io/"
    },
    {
      "id": "package-json",
      "priority": "P0",
      "family": "project-config",
      "file_type": "application/json",
      "filenames": ["package.json"],
      "description": "Node.js package identity, scripts, dependencies and runtime constraints.",
      "use_cases": ["build review", "dependency inventory", "release review"],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "human-review"
      ]
    },
    {
      "id": "python-project",
      "priority": "P0",
      "family": "project-config",
      "file_type": "application/toml",
      "filenames": ["pyproject.toml"],
      "description": "Python build-system, package, tool and dependency configuration.",
      "use_cases": [
        "build review",
        "dependency inventory",
        "tool configuration"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "language-project-config",
      "priority": "P1",
      "family": "project-config",
      "file_type": "text/plain",
      "filenames": [
        "Cargo.toml",
        "go.mod",
        "pom.xml",
        "build.gradle",
        "Gemfile",
        "composer.json"
      ],
      "description": "Language ecosystem package, module, build and dependency metadata.",
      "use_cases": ["build review", "dependency inventory", "release planning"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "container-build",
      "priority": "P1",
      "family": "project-config",
      "file_type": "text/plain",
      "filenames": [
        "Dockerfile",
        "Containerfile",
        "compose.yaml",
        "compose.yml",
        "docker-compose.yaml",
        "docker-compose.yml"
      ],
      "description": "Container build and multi-service runtime declarations.",
      "use_cases": [
        "deployment review",
        "dependency review",
        "security review"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "ci-workflow",
      "priority": "P1",
      "family": "project-config",
      "file_type": "application/yaml",
      "filenames": [
        ".github/workflows/*.yml",
        ".github/workflows/*.yaml",
        ".gitlab-ci.yml"
      ],
      "description": "Continuous integration and delivery workflow definitions.",
      "use_cases": ["CI review", "permission review", "supply-chain review"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "hummbl-repo-manifest",
      "priority": "P0",
      "family": "project-config",
      "file_type": "application/yaml",
      "filenames": ["hummbl.repo.yaml"],
      "description": "Proposed HUMMBL repository identity, authority, capability and evidence manifest.",
      "use_cases": [
        "repository onboarding",
        "governance inventory",
        "automation routing"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "schema",
        "human-review"
      ]
    },
    {
      "id": "generic-manifest-json",
      "priority": "P1",
      "family": "structured-data",
      "file_type": "application/json",
      "filenames": ["manifest.json", "*.manifest.json"],
      "description": "Machine-readable inventory or identity manifest.",
      "use_cases": [
        "artifact inventory",
        "configuration exchange",
        "provenance linkage"
      ],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "human-review"
      ]
    },
    {
      "id": "openapi",
      "priority": "P1",
      "family": "api-data",
      "file_type": "application/yaml",
      "filenames": ["openapi.yaml", "openapi.yml", "openapi.json"],
      "description": "OpenAPI description of HTTP operations, schemas and security declarations.",
      "use_cases": ["API review", "client generation", "contract testing"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "human-review"
      ]
    },
    {
      "id": "json-schema",
      "priority": "P1",
      "family": "api-data",
      "file_type": "application/schema+json",
      "filenames": ["schema.json", "*.schema.json"],
      "description": "JSON Schema document describing acceptable JSON instances.",
      "use_cases": [
        "data contracts",
        "configuration validation",
        "API validation"
      ],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "human-review"
      ],
      "standard_url": "https://json-schema.org/specification"
    },
    {
      "id": "newline-json",
      "priority": "P1",
      "family": "api-data",
      "file_type": "application/x-ndjson",
      "filenames": ["*.jsonl", "*.ndjson"],
      "description": "One JSON value per line for streams, logs and large datasets.",
      "use_cases": ["event streams", "model datasets", "audit export"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "human-review"
      ]
    },
    {
      "id": "tabular-data",
      "priority": "P1",
      "family": "api-data",
      "file_type": "text/csv",
      "filenames": ["*.csv", "*.tsv"],
      "description": "Delimited tabular data for exchange, review and analysis.",
      "use_cases": ["data exchange", "quality review", "evidence export"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "data-dictionary",
      "priority": "P1",
      "family": "api-data",
      "file_type": "text/csv",
      "filenames": ["data-dictionary.csv", "data_dictionary.csv"],
      "description": "Field-level definitions, types, constraints and stewardship metadata for a dataset.",
      "use_cases": ["data governance", "analysis handoff", "quality review"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "sections",
        "human-review"
      ]
    },
    {
      "id": "spdx-sbom",
      "priority": "P1",
      "family": "evidence",
      "file_type": "application/spdx+json",
      "filenames": ["sbom.spdx.json", "*.spdx.json"],
      "description": "SPDX software bill of materials and licensing inventory.",
      "use_cases": [
        "supply-chain review",
        "license review",
        "release evidence"
      ],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "provenance",
        "human-review"
      ],
      "standard_url": "https://spdx.dev/use/specifications/"
    },
    {
      "id": "cyclonedx-sbom",
      "priority": "P1",
      "family": "evidence",
      "file_type": "application/vnd.cyclonedx+json",
      "filenames": ["bom.cdx.json", "*.cdx.json"],
      "description": "CycloneDX component, dependency and supply-chain inventory.",
      "use_cases": [
        "supply-chain review",
        "vulnerability management",
        "release evidence"
      ],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "provenance",
        "human-review"
      ],
      "standard_url": "https://cyclonedx.org/specification/overview/"
    },
    {
      "id": "sarif-results",
      "priority": "P1",
      "family": "evidence",
      "file_type": "application/sarif+json",
      "filenames": ["results.sarif", "*.sarif", "*.sarif.json"],
      "description": "Static-analysis findings in the SARIF interchange format.",
      "use_cases": [
        "security findings",
        "code quality",
        "tool interoperability"
      ],
      "mode": "content",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "human-review"
      ],
      "standard_url": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html"
    },
    {
      "id": "in-toto-provenance",
      "priority": "P1",
      "family": "evidence",
      "file_type": "application/x-ndjson",
      "filenames": ["provenance.intoto.jsonl", "*.intoto.jsonl"],
      "description": "Supply-chain provenance statements carried in in-toto envelopes.",
      "use_cases": [
        "build provenance",
        "artifact attestation",
        "release evidence"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "json-parse",
        "schema",
        "provenance",
        "human-review"
      ],
      "standard_url": "https://in-toto.io/"
    },
    {
      "id": "checksum-list",
      "priority": "P0",
      "family": "evidence",
      "file_type": "text/plain",
      "filenames": [
        "SHA256SUMS",
        "SHA256SUMS.txt",
        "checksums.txt",
        "*.sha256"
      ],
      "description": "Expected cryptographic digests used to compare artifact bytes.",
      "use_cases": [
        "download integrity",
        "release verification",
        "artifact inventory"
      ],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "provenance",
        "human-review"
      ]
    },
    {
      "id": "detached-signature",
      "priority": "P1",
      "family": "evidence",
      "file_type": "application/pgp-signature",
      "filenames": ["*.sig", "*.asc"],
      "description": "Detached or armored signature material that must be paired with a trusted key and target artifact.",
      "use_cases": ["release verification", "artifact authentication"],
      "mode": "hash-only",
      "checks": ["filename", "metadata", "sha256", "provenance", "human-review"]
    },
    {
      "id": "environment-example",
      "priority": "P1",
      "family": "security",
      "file_type": "text/plain",
      "filenames": [".env.example", ".env.sample"],
      "description": "Documented environment variable names with non-secret example values.",
      "use_cases": ["configuration onboarding", "deployment documentation"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "environment-secret",
      "priority": "P0",
      "family": "security",
      "file_type": "text/plain",
      "filenames": [".env", ".env.*"],
      "description": "Potential live secret material. HUMMBL identifies the risk and refuses content parsing.",
      "use_cases": ["secret-risk detection"],
      "mode": "blocked",
      "checks": ["filename", "metadata", "human-review"]
    },
    {
      "id": "source-code",
      "priority": "P2",
      "family": "source-code",
      "file_type": "text/plain",
      "filenames": [
        "*.py",
        "*.js",
        "*.mjs",
        "*.cjs",
        "*.ts",
        "*.tsx",
        "*.go",
        "*.rs",
        "*.java",
        "*.rb",
        "*.php"
      ],
      "description": "Source text suitable for local hashing and encoding checks; language semantics require a dedicated toolchain.",
      "use_cases": ["artifact identity", "handoff", "pre-lint inspection"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "shell-script",
      "priority": "P2",
      "family": "source-code",
      "file_type": "text/plain",
      "filenames": ["*.sh", "*.bash", "*.zsh", "*.ps1", "*.bat", "*.cmd"],
      "description": "Executable script source that is inspected as text and never run by the verifier.",
      "use_cases": ["artifact identity", "security review", "handoff"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "web-source",
      "priority": "P2",
      "family": "source-code",
      "file_type": "text/plain",
      "filenames": ["*.html", "*.css", "*.xml"],
      "description": "Web and markup source inspected as inert text, without rendering or executing active content.",
      "use_cases": ["artifact identity", "publishing review", "handoff"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "log-file",
      "priority": "P2",
      "family": "plain-text",
      "file_type": "text/plain",
      "filenames": ["*.log"],
      "description": "Diagnostic text that may contain secrets or personal data and is handled locally only.",
      "use_cases": ["incident diagnosis", "support handoff", "audit review"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "portable-document",
      "priority": "P2",
      "family": "document",
      "file_type": "application/pdf",
      "filenames": ["*.pdf"],
      "description": "Portable documents limited to hash, size, MIME and signature observations in the browser verifier.",
      "use_cases": ["document identity", "evidence inventory", "handoff"],
      "mode": "hash-only",
      "checks": ["filename", "metadata", "magic", "sha256", "human-review"]
    },
    {
      "id": "office-document",
      "priority": "P2",
      "family": "document",
      "file_type": "application/octet-stream",
      "filenames": ["*.docx", "*.xlsx", "*.pptx", "*.odt", "*.ods", "*.odp"],
      "description": "Office documents limited to local hash and container metadata; macros and embedded content are not opened.",
      "use_cases": ["document identity", "evidence inventory", "handoff"],
      "mode": "hash-only",
      "checks": ["filename", "metadata", "magic", "sha256", "human-review"]
    },
    {
      "id": "raster-image",
      "priority": "P2",
      "family": "media",
      "file_type": "image/*",
      "filenames": ["*.png", "*.jpg", "*.jpeg", "*.gif", "*.webp"],
      "description": "Raster images limited to local hash, size, MIME and known signature observations.",
      "use_cases": [
        "asset identity",
        "provenance inventory",
        "publishing handoff"
      ],
      "mode": "hash-only",
      "checks": [
        "filename",
        "metadata",
        "magic",
        "sha256",
        "provenance",
        "human-review"
      ]
    },
    {
      "id": "active-svg",
      "priority": "P2",
      "family": "media",
      "file_type": "image/svg+xml",
      "filenames": ["*.svg"],
      "description": "SVG can contain scripts and external references, so it is never rendered by the verifier.",
      "use_cases": ["asset identity", "security review"],
      "mode": "text-basic",
      "checks": [
        "filename",
        "metadata",
        "sha256",
        "utf8",
        "text-safety",
        "human-review"
      ]
    },
    {
      "id": "audio-video",
      "priority": "P2",
      "family": "media",
      "file_type": "audio/* or video/*",
      "filenames": ["*.mp3", "*.wav", "*.flac", "*.mp4", "*.mov", "*.webm"],
      "description": "Audio and video limited to local hash, size, MIME and limited signature observations.",
      "use_cases": [
        "media identity",
        "evidence inventory",
        "production handoff"
      ],
      "mode": "hash-only",
      "checks": [
        "filename",
        "metadata",
        "magic",
        "sha256",
        "provenance",
        "human-review"
      ]
    },
    {
      "id": "archive",
      "priority": "P2",
      "family": "archive",
      "file_type": "application/archive",
      "filenames": ["*.zip", "*.tar", "*.tar.gz", "*.tgz", "*.7z", "*.rar"],
      "description": "Archives are never extracted in the browser verifier because of traversal, nesting and decompression risks.",
      "use_cases": ["artifact identity", "release handoff", "backup inventory"],
      "mode": "hash-only",
      "checks": ["filename", "metadata", "magic", "sha256", "human-review"]
    },
    {
      "id": "executable-binary",
      "priority": "P2",
      "family": "binary",
      "file_type": "application/octet-stream",
      "filenames": [
        "*.exe",
        "*.dll",
        "*.msi",
        "*.app",
        "*.dmg",
        "*.so",
        "*.bin"
      ],
      "description": "Executable and disk-image content is never executed, mounted or parsed; only local identity observations are made.",
      "use_cases": [
        "artifact identity",
        "release inventory",
        "signature handoff"
      ],
      "mode": "hash-only",
      "checks": [
        "filename",
        "metadata",
        "magic",
        "sha256",
        "provenance",
        "human-review"
      ]
    },
    {
      "id": "font-binary",
      "priority": "P2",
      "family": "binary",
      "file_type": "font/*",
      "filenames": ["*.woff", "*.woff2", "*.ttf", "*.otf"],
      "description": "Font binaries limited to local hash, size and MIME observations; they are not loaded for rendering.",
      "use_cases": [
        "asset identity",
        "license inventory",
        "publishing handoff"
      ],
      "mode": "hash-only",
      "checks": ["filename", "metadata", "sha256", "human-review"]
    }
  ]
}