---
id: "20260713-0230-do-c2pa-open-policy"
title: "Do C2PA, Open Policy Agent, and study preregistration match the append-only-log-as-truth criterion, or only the broader 'gate at admission, verdict elsewhere' pattern?"
type: "capture"
status: "promoted"
promoted_to: ["30-notes/claim-opa-decision-is-stateless-computation-not-log-derived.md","30-notes/claim-c2pa-manifest-store-is-genuine-append-only-chain.md","30-notes/claim-preregistration-is-frozen-snapshot-not-append-only-log.md","30-notes/claim-only-c2pa-matches-narrow-append-only-log-criterion-among-three.md"]
not_promoted: ["C2PA §6.8 redaction / 'cancel slips' rhyme (Further leads, bullet 1) — a future-capture idea, not an atomic claim; noted as a watch_flag in claim-c2pa-manifest-store-is-genuine-append-only-chain instead.","OPA Gatekeeper cluster-state awareness (Further leads, bullet 2) — explicitly unverified against a Tier 1-2 source in the capture; not load-bearing on the kept OPA claim (which is scoped to core OPA architecture), so folded into that note's commentary as a watch_flag rather than routed to a new question.","Nosek et al. 2018 PNAS as an upgrade path for the preregistration claim (Further leads, bullet 3) — nice-to-have tier upgrade, not required verification (the OSF primary source already clears the Tier 1 floor); folded into claim-preregistration-is-frozen-snapshot-not-append-only-log's commentary as a watch_flag rather than routed to a new question.","Registered Reports as a distinct preregistration variant (Further leads, bullet 4) — tangential, not explored, not a claim; left in the inbox."]
promotion_date: "2026-07-15T00:00:00.000Z"
promoted_by: "claude-sonnet-5"
origin: "batch"
writer_model: "claude-sonnet-5"
date_created: "2026-07-13T00:00:00.000Z"
provenance: "Batch web research run, 2026-07-13"
derived_from: []
tags: ["c2pa","open-policy-agent","preregistration","append-only-log","event-sourcing","provenance","admission-control","verdict-separation","cross-domain-bridge"]
source_tier: "1 (primary specs/docs for all three core claims)"
---


Tests three candidate systems against the resolution criterion tracked by
[[question-append-only-ledger-cross-domain-convergence]] — a system whose
mechanism is genuinely "append-only-log-as-truth with judgment held outside the
log," as already confirmed for CANONIC
([[claim-canonic-deliverable-is-an-append-only-evidence-ledger]]), ActiveGraph
([[claim-activegraph-rebuilds-babyagi-on-event-log]]), and R-LAM
([[claim-rlam-third-noncitng-subfield-append-only-log-with-verdict-separation]]).
The finding: the three systems split. One matches the narrow log criterion; the
other two match only the looser "gate at admission, verdict elsewhere" shape
without an append-only log underneath it.

## Claim: Open Policy Agent's decisions are computed statelessly per query; its optional decision logs are a peripheral audit feature, not the mechanism that produces the decision

Open Policy Agent (OPA) is used as a Kubernetes admission controller: "The
Kubernetes API Server is configured to query OPA for admission control decisions
when objects (e.g., Pods, Services, etc.) are created, updated, or deleted"
(openpolicyagent.org/docs/kubernetes). This is the "gate at admission" half of
the pattern. But the decision itself is not produced by consulting or replaying a
log — OPA's own architecture page states: "OPA decouples policy decision-making
from policy enforcement. When your software needs to make policy decisions it
queries OPA and supplies structured data (e.g., JSON) as input" and OPA evaluates
that input against currently-loaded policies and data to return a decision.
Decision logging is listed as one of several optional add-on management
capabilities ("Decision telemetry") alongside bundle distribution, status
reporting, and discovery — management-plane features layered on top of the
evaluator, not the substrate the evaluator reads from to decide. [Tier 1 —
openpolicyagent.org official documentation]

> [!note] Seek's commentary:
> This is close to the inverse of the pattern the vault has been tracking. CANONIC/ActiveGraph/R-LAM all made the log itself the ground truth and pushed judgment to a layer above it. OPA does the opposite: the *decision* is a live, stateless computation, and the *log* (when enabled at all) is the layer above, added for audit rather than as truth-source. Structurally it is "gate at admission, verdict computed fresh each time" — no persistent append-only substrate is load-bearing.

## Claim: C2PA's manifest store is a genuine append-only chain — each edit adds a new manifest without deleting prior ones, and the "active" manifest is defined as the last entry in that list

The C2PA technical specification states: "Each time an asset is changed, the
existing provenance of the asset is preserved, with each new change being added
to the provenance" (§1.1, Overview). The "active manifest" — the one whose
content bindings are validated — is defined as "The last manifest in the list of
C2PA Manifests inside of a C2PA Manifest Store" (§2.3.7). Redaction of an
assertion does not delete a manifest; per §6.8, "an update manifest should be
used to document the redaction... to indicate that digital content was not
changed" — the redaction itself becomes a new appended entry rather than an
erasure. [Tier 1 — spec.c2pa.org, official C2PA technical specification]

> [!note] Seek's commentary:
> This is the one of the three that structurally matches the narrow criterion: an ordered, additive list functioning as the record of truth for an asset's history. But C2PA does not "gate at admission" the way OPA or preregistration do — nothing stops non-C2PA content from being created or published; the manifest is opt-in metadata carried by the asset, not a checkpoint anything must clear. C2PA supplies the append-only-log half without the admission-gate half, and the authenticity *verdict* (is this trustworthy) is still rendered externally — by a relying party checking the claim signature against a trust list — not by the manifest chain itself.

## Claim: Study preregistration produces a single frozen, time-stamped, read-only snapshot document, not a continuously appended log

The Center for Open Science's own description of the practice: "Preregistration is
the practice of posting a time-stamped, read-only version of your study plan to a
public repository before beginning data collection or analysis" (OSF Support,
"Welcome to Registrations & Preregistrations!"). Once submitted, that document is
frozen: "Once you submit a registration, you will not be able to edit or make
changes to it or any associated files," and a registration is "a frozen version
of your project that can never be edited or deleted, but you can issue a
withdrawal of it later, leaving behind basic metadata." [Tier 1 — help.osf.io,
Center for Open Science / OSF official support documentation, primary source
describing its own registry system]

> [!note] Seek's commentary:
> This is the clearest non-match to the log criterion of the three. Preregistration gates admission (you must register the plan before the study counts as confirmatory) and the verdict — whether the results held up, what got published — is rendered elsewhere and later, so the broader pattern fits cleanly. But the artifact itself is one immutable snapshot, not a growing append-only sequence of entries. OSF's "Updates" mechanism lets researchers document post-hoc deviations, but it is an optional annotation layer, not the core architecture, and nothing about it resembles deterministic replay over a log.

## Claim: Of the three, only C2PA's mechanism matches the narrow append-only-log-as-truth criterion; OPA and preregistration match only the broader "gate at admission, verdict elsewhere" pattern

Putting the three sourced mechanisms side by side: C2PA is structurally an
append-only, additive manifest chain functioning as the asset's record of truth,
but it lacks an admission gate. OPA is an admission gate (Kubernetes objects,
API requests) whose verdict is a stateless live computation, with logging as an
optional bolt-on rather than the truth-bearing substrate. Preregistration is an
admission gate (must register before the study counts as confirmatory) whose
artifact is a single frozen document, not a log. None of the three reproduces the
full CANONIC/ActiveGraph/R-LAM shape — "the log is the ground truth AND the log
is what gets consulted for judgment is pushed elsewhere." The broader "gate at
admission, verdict elsewhere" description covers OPA and preregistration; the
narrower append-only-log-as-truth description covers only C2PA's record-keeping
half, and even there without the admission-gate component. [Synthesis drawn
directly from the three sourced claims above; not itself resting on an
independent source.]

> [!note] Seek's commentary:
> This complicates rather than extends the CANONIC/ActiveGraph/R-LAM convergence story. Those three are genuine multiple-discovery instances of one shape. C2PA, OPA, and preregistration were selected here precisely because they *sound* like they might be a fourth, fifth, and sixth instance — and testing them shows the two criteria (narrow log-as-truth vs. broad gate-then-verdict-elsewhere) are doing different work and should not be conflated when counting instances toward [[question-append-only-ledger-cross-domain-convergence]]. Worth flagging for whoever tends that question: don't count OPA or preregistration as log-as-truth instances without this caveat attached.

## Further leads

- C2PA's redaction mechanism (§6.8, "update manifest") looks like it might rhyme with the vault's "correct by surrounding, never by erasing" thread (compare [[claim-early-modern-printers-corrected-print-with-cancel-slips]]) — worth a dedicated capture if pursued.
- OPA Gatekeeper "brings awareness of the cluster's state, not just the single object under evaluation at admission time" (per Kubernetes.io blog on OPA Gatekeeper) — suggests some admission-control deployments of OPA do consult broader state; not verified against a Tier 1-2 source in this pass, worth checking whether that state is itself log-structured.
- The Nosek et al. 2018 PNAS "The Preregistration Revolution" is the standard academic primary source for the definitional claims here but was paywalled (403) during this session; a future pass should fetch it via an institutional-access route or the PMC/OSF preprint mirror to upgrade the preregistration claims from OSF-org-documentation to peer-reviewed-primary.
- Registered Reports (a preregistration variant with peer review of the plan itself, before results are known) came up in search results (AJE, RMIT/Surrey library guides) as a related but distinct mechanism from plain preregistration — not explored this pass.