Six groups. One signature.
A passport is not metadata attached for convenience. It is the difference between telling an auditor what a system believed and showing them what it observed.
What actually answered?
The URL requested, the URL finally served, the redirect chain between them, the resolved address and the certificate presented. A fact attributed to a domain must be traceable to the endpoint that really answered.
| Field | Proves |
|---|---|
| requested_url | what was asked for |
| final_url | what answered, after redirects |
| redirects | hops taken |
| host_resolved_ip | address actually reached |
| tls_certificate_sha256 | certificate presented |
When was it true, and was it live?
The moment of observation from a time source that is not our own wall clock, plus the cache posture. This is the field most systems get wrong: a cached response reported as current is the most common way a machine ends up defending a fact that was never fresh.
| Field | Proves |
|---|---|
| observed_at | instant of observation |
| observed_at_source | how time was established |
| freshness | live or cache |
| cache.upstream_age_s | age at the upstream |
| duration_ms | time on the wire |
How was it obtained?
Plain request, rendered browser, or API call; whether JavaScript executed; whether anything was interacted with. Two observations of the same URL by different methods are two different facts, and any serious dispute turns on which one you held.
| Field | Proves |
|---|---|
| transport | https_get, headless_browser, api |
| agent | collector build |
| javascript_executed | was the DOM rendered |
| interaction | clicks, scrolls, form steps |
| execution_provider | who executed it |
From where, into which market?
Egress region, network class and the market frame of the observation. The open web is not one place: prices, availability and content are routinely a function of where the observer stands. A fact without its vantage point is not reproducible.
| Field | Proves |
|---|---|
| egress_region | where the request left from |
| egress_asn | network it left through |
| egress_class | datacenter, residential, mobile |
| market_context | venue, instrument, currency, locale |
How strong is this fact?
Status, content hash and size, plus corroboration — independent observations of the same thing and how far they diverged. Provenance answers where a fact came from; corroboration answers whether one source should have been enough.
| Field | Proves |
|---|---|
| http_status | response status |
| content_sha256 | hash of the bytes |
| content_bytes | payload size |
| corroboration | independent observations and agreement |
| anomalies | anything that looked wrong |
What may be done with it next?
The legal envelope travelling with the fact: the basis, the terms it was collected under (hashed, so the version is pinned), permitted and prohibited uses, retention and jurisdiction. This is the field that decides whether a fact may enter a model, a report, or a courtroom.
| Field | Proves |
|---|---|
| basis | publisher terms, licence, agreement |
| terms_url / terms_sha256 | the exact terms version |
| permitted_use | what is allowed |
| prohibited_use | what is not |
| retention_max_days | how long it may be kept |
| jurisdiction | governing regime |
A complete, signed specimen.
Specimen record. Field values are illustrative; the signature over them is real and verifiable.