Open-source v0.4.0 technical preview

Your AI disclosure passed review.Did it survive production?

Regression-test declared AI disclosures, initial-render visibility, basic accessible-name checks, and configured C2PA provenance in the experience people actually receive.

No legal compliance verdicts. No customer-media uploads. No silent telemetry.

Build my 5-minute checkWatch the 30-second proof
Or inspect a real production report
v0.4.0 / production14:32:08 UTC

$ npx art50-ci audit

PASSdisclosure observed in initial state

PASSbasic accessible-name check

FAILlabel covered by cookie overlay

FAILC2PA manifest missing from delivered asset

2 failed · evidence saved to .art50-ci/reports

Configured assertions only · not a legal conclusion

Local-firstRuns with your build

Delivered-pathTests the real URL and bytes

InspectableJSON, HTML, screenshots, hashes

Deliberately narrowTechnical conditions, not legal scope

No account · no upload · five minutes

Build your first production disclosure check.

Enter one public product URL and the disclosure your team selected. The command is assembled entirely in this browser and runs locally on your machine.

  • Nothing is submitted or stored
  • No customer media or credentials
  • Inspectable JSON, HTML, and screenshot evidence
Command shell

Founding offer · 30-day monitored launch

€500 monitored launch.

The open-source software remains free to self-serve. €500 buys delivery and accountability—not access to the code.

  • Working release gate for one product and up to five declared checks
  • Configuration and one GitHub Actions workflow integrated
  • Reproducible baseline run and evidence delivered: a confirmed pass or product failure
  • Up to three distinct failed-run causes triaged during the 30-day window
  • Agreed configuration, workflow, evidence index, and runbook handoff

Each browser disclosure assertion, optional first-interaction control, or C2PA provenance item counts as one check.

Check monitored launch fit Read the exact delivery scope

Public 60-second fit check. No product URLs, media, repository access, private details, or payment. Preliminary fit or no-fit comes first; private intake requires explicit opt-in. Daily or weekly monitoring is asynchronous, with no on-call or response-time SLA. Engineering delivery only: no legal advice or certification, C2PA creation or embedding, trust determination, or product fixes. Evidence is handed off; hosted custody is not included.

Real release evidence

Inspect the report before trusting the pitch.

This public schema-v2 report was produced by the released v0.4.0 CLI against the production site. It checked the declared result boundary at a 1440 × 1000 viewport and retained hashes and the exact release commit. Screenshots were disabled for this public run.

Open rendered reportInspect portable JSONView the configuration

PASS means only that the configured technical condition was observed at the recorded time. It is not certification or a legal-compliance conclusion.

npm consumer audit limitation: npm does not propagate a dependency package's overrides. Projects installing the CLI can therefore still see four high-severity audit findings in the @contentauth/c2pa-node install-time unzipper@0.10.14 dependency chain. The tagged Action and repository lockfile use unzipper@0.12.5.

Result
PASS
Observed
27 Jul 2026 · 02:04 UTC
Report schema
2 · portable paths
HTTP
200
Release commit
c2132e1
Page SHA-256
61663d1de543…70b08

The delivery path is the product

Turn the controls people selected into tests engineers can run.

Design files and policy documents do not test the configured viewport, sampled obstruction, or bytes after delivery transformations. art50-ci does.

01

At the interaction checkpoint

Observe the declared disclosure in the initial page state before any configured interaction is performed.

disclosure.before-interaction
02

In the initial viewport

Catch copy drift, off-viewport labels, sampled overlay obstruction, and missing accessible names.

label.initial-viewport
03

From source to delivery

Check whether the source C2PA manifest label appears in the manifest chain of the bytes delivered by your CDN.

c2pa.source-manifest-in-chain

C2PA is one configurable metadata implementation. Article 50 and the Code of Practice do not require it by name, and this preview is not complete Article 50(2) marking or detection coverage.

See the public C2PA delivery pass/fail proof

One file. One command. Release evidence.

Legal scope stays with people. Regression checks live in CI.

  1. 1
    Declare

    Record the selectors, text, asset URLs, and provenance expectations your governance owner selected.

  2. 2
    Run

    Test a preview before merge and schedule the same check against production.

  3. 3
    Retain

    Archive time-bound results, screenshots, byte hashes, and precise failure codes with the release.

How Article 50 disclosure checks fit into CI Test Content Credentials through delivery
.art50-ci.ymlYAML
version: 1
project:
  name: acme-ai-product

surfaces:
  - id: public-assistant
    target: https://app.example.com
    firstInteraction:
      selector: "[data-chat-input]"
    disclosures:
      - id: ai-notice
        selector: "[data-ai-disclosure]"
        expectedText: "AI system"
        inViewport: true
        unobstructed: true
        accessible: true

provenance:
  - id: launch-poster
    source: ./poster.png
    delivered: https://cdn.example.com/poster.png
    requireManifest: true
    requireSourceManifestInDeliveredChain: true

A sharp result boundary

A test runner should never pretend to be your lawyer.

Article 50 includes scope questions and fact-specific exceptions that browser automation cannot responsibly decide. art50-ci starts after those decisions and tests the observable mechanics.

  • You decide which systems and content are in scope.
  • You declare the technical controls your organisation selected.
  • art50-ci reports only what it observed at a recorded time.
  • A passing run is evidence—not certification or legal advice.

Why now

Final Commission guidance landed on 20 July 2026.

The relevant Article 50 transparency obligations apply from 2 August 2026, subject to scope and exceptions. Use the primary sources; never treat this tool as a substitute.

Practical Article 50 CI guide C2PA delivery regression guide Commission guidelines Regulation EU placement guidance
Founding offer · 30-day monitored launch

€500 one time

One product. One working release gate.

The open-source software remains free to self-serve. €500 buys delivery and accountability—not access to the code.

  • Working release gate for one product and up to five declared checks
  • Configuration and one GitHub Actions workflow integrated
  • Reproducible baseline run and evidence delivered: a confirmed pass or product failure
  • Up to three distinct failed-run causes triaged during the 30-day window
  • Agreed configuration, workflow, evidence index, and runbook handoff

Each browser disclosure assertion, optional first-interaction control, or C2PA provenance item counts as one check.

Check monitored launch fit Read the exact delivery scope

Public 60-second fit check. No product URLs, media, repository access, private details, or payment. Preliminary fit or no-fit comes first; private intake requires explicit opt-in. Daily or weekly monitoring is asynchronous, with no on-call or response-time SLA. Engineering delivery only: no legal advice or certification, C2PA creation or embedding, trust determination, or product fixes. Evidence is handed off; hosted custody is not included.