# MILO PROVENANCE STANDARD — V1.0

Version V1.0 · 2026-09-22 · Milo Brand + Interface System

**Who this is for.** Anyone adding an image to Milo — art, nature or generated — and anyone auditing the package. It defines the record schema, the three source kinds and their UI treatment, the validator contract, rights preferences and source quality rules. No image enters the package without a record that passes.

---

## 1. Schema

Manifests: `assets/art/manifest.json`, `assets/nature/manifest.json`, `assets/generated/manifest.json`, each `{collection, version, generated, count, schema, records[]}` with a CSV twin for art and nature.

### 1.1 Required for every record

| Field | Meaning |
|---|---|
| `id` | stable slug; also the file stem |
| `type` | `art` · `nature` · `generated` |
| `title` | as the institution/archive titles it (or the chosen display title for NASA IDs, with `archive_title` kept) |
| `creator` | artist / photographer / agency; for generated, the generator |
| `institution_or_agency` | full institution or archive name |
| `source_url` | the institution's own object page |
| `rights` | the rights statement in words |
| `rights_url` | the institution's rights page (required where one exists) |
| `date_accessed` | ISO date |
| `local_file` | path of the original under `assets/` |
| `source_kind` | `human-created` · `generated` · `computationally-transformed` |

### 1.2 Additional fields

Art: `object_id` (accession number — required), `institution`, `institution_short`, `date`, `medium`, `image_source`, `credit_line`, `theme`.
Nature: `agency`, `location`, `date`, `subject`, `description`, `image_source`.
Generated: `generator`, `model`, `date`, `source_inputs` (list, may be empty but must be present), `transformation_status`, `prompt` (when not sensitive).
Added by the renderer: `thumbnail`, `web`, `dimensions {width, height}`, and `derivatives[]`.

### 1.3 Derivative entries

Every derivative traces to its original:

```json
{ "file": "assets/art/derivatives/<id>--<recipe>.jpg", "recipe": "archive", "label": "MILO / ARCHIVE", "effect": "archive",
  "engine": "milo-image-engine 1.0.0", "config": { …the exact recipe… }, "source": "assets/art/originals/<id>.jpg",
  "source_kind": "computationally-transformed", "rendered": "2026-09-22" }
```

## 2. Three source kinds

| Kind | Meaning | Label in UI | `.source-kind` marker |
|---|---|---|---|
| HUMAN-CREATED SOURCE | a real artwork or photograph by a named person or agency | ORIGINAL | `.human` — filled square |
| COMPUTATIONALLY TRANSFORMED SOURCE | a human-created source passed through the Milo engine with a recorded recipe | MILO COMPUTATIONAL INTERPRETATION | `.transformed` — hatched square, vermilion ink |
| GENERATED SOURCE | produced by a generative model (Codex Image 2.5) | GENERATED · generator · model | `.generated` — circle |

The kinds never blur: a generated image is never run through the engine and then labelled as a transformed photograph; a transformed artwork is never shown without its original reachable in one action (`.artwork-caption .actions`).

## 3. Validator contract (`tools/validate_provenance.py`)

- Loads every manifest; fails (exit 1) on any missing required field from §1.1, on any art record without `object_id`, on any generated record without `generator` and `source_inputs`, on any `local_file` or derivative `file` that does not exist, and on any derivative whose `source` is not a record's `local_file`.
- Prints one line per failure `record-id: field`, then `PASS` or `FAIL` with counts.
- Is the gate before packaging and is mirrored by the JEV `provenance` gate (`tools/jev.py ask provenance --file …`), which records the result in `evidence/jev-decisions.jsonl`.

## 4. Rights preferences (§60)

Preferred: Public Domain, CC0, institutional Open Access permitting reuse, US federal public-domain material. If rights are uncertain, choose another asset; one image never blocks the project. Rights are checked at object level — an artist's death date is not sufficient (the Met's `isPublicDomain: false` on a 1899 Monet is the standing example).

Rights statements in use: AIC and Met "Public Domain (CC0) — … Open Access"; CMA "Public Domain (CC0) — Cleveland Museum of Art Open Access"; SAAM "Public Domain (CC0) — Smithsonian Open Access"; NASA "Public Domain — US federal government work"; LOC Highsmith "No known restrictions on publication — Carol M. Highsmith Archive (donated to the public)".

## 5. Source quality (§58)

Primary institutional sources only: the museum's or agency's own API and image service. Never Pinterest, scraped image sites or aggregators. Prefer high-resolution institutional assets and IIIF; do not download archival masters (LOC TIFFs of 100MB+ are skipped in favour of the service JPEG; AIC is requested at 1686px). Originals are kept in the package but not deployed to the site; the site serves 1200px derivatives and 480px thumbnails.