Candidate Is Not Publication: QC, Source, Rights, and Approval Gate

1. The problem: a candidate exists, but it is not yet publishable

A file may render successfully, look polished, and even carry a valid Content Credential while publication is still unauthorized. The source binding may be stale, the license may forbid the intended adaptation, approval may target an older digest, or semantic QC may still be UNKNOWN. CON-018 turns that gap into an auditable gate.

2. The owned CON-018 boundary

This lesson owns the Publication Candidate Gate Decision Record v1. It does not own media-library identity, transform recipes, FFmpeg execution, or the creative variant graph, and CON-022 owns the full multidimensional QA exit. CON-018 asks only whether evidence for this exact candidate and publication context has closed enough for RELEASE_READY or must remain BLOCK/DEFER.

3. Bind the candidate by digest

A filename, directory, or thumbnail is not stable candidate identity. The gate ledger records at least candidate_id, candidate_digest, and gate_profile_version. If candidate bytes change, the digest changes, and any digest-bound approval or QC evidence must be requalified rather than silently inherited.

4. Keep five predicates independent

The mandatory predicates are SOURCE_BOUND, PROVENANCE_VALID, RIGHTS_ALLOWED, APPROVAL_CURRENT, and QC_CLOSED. Release readiness is their conjunction, not an average. Each predicate has its own authority, evidence, and lifecycle; a strong result in one predicate cannot compensate for another.

5. What C2PA says—and does not say

C2PA 2.4 provides a trust and validation model for manifests, signers, and provenance bindings. The specification frames provenance as trust signals interpreted by consumers and explicitly avoids judging whether provenance data is “good” or “bad.” Therefore C2PA_VALID=true can support provenance evidence, but it does not itself establish source suitability, rights clearance, editorial approval, or publication permission.

6. Keep source binding separate from provenance

A manifest can validate while the source authority associated with the candidate is stale or wrong. PROVENANCE_VALID=TRUE must not hide SOURCE_BOUND=STALE. When source binding needs refresh, the disposition remains DEFER and the recheck trigger targets that evidence only.

7. Rights are not a generic boolean

Creative Commons builds six main licenses from BY, NC, ND, and SA conditions. A generic licensed=true field is therefore insufficient. Record the license type/version, intended use, commercial context, adaptation status, attribution obligations, and any separate expiry or permission. This lesson is not legal advice; it preserves the supplied rights evidence without inventing permission.

8. Approval needs scope and digest binding

A useful approval record carries an approval_event_id, approver authority, scope, candidate digest, and validity window. If candidate bytes change and the approval covered only the prior digest, APPROVAL_CURRENT is no longer TRUE—even if the visual difference is tiny. The old approval remains history, not automatic authorization for the new candidate.

9. QC_CLOSED means every required QC slice is closed

CON-018 does not perform the full Media QA procedure, but it consumes the required result as a predicate. If technical QC passes while semantic QC is UNKNOWN, QC_CLOSED remains UNKNOWN. If semantic QC fails, the predicate is FALSE. Visual polish or technical success cannot substitute for missing required evidence.

10. Three bounded dispositions: RELEASE_READY, BLOCK, DEFER

RELEASE_READY is allowed only when all five mandatory predicates are TRUE for the exact candidate/context. BLOCK represents an explicit current failure such as expired rights, approval mismatch, or semantic failure. DEFER represents required evidence that is UNKNOWN, STALE, or PENDING and can be rechecked after a named event.

11. Preserve the blocking gate and reason

The decision record retains blocking_gate, reason, and recheck_trigger. “Not ready yet” is weak. SOURCE_BOUND=STALE → DEFER → REFRESH_SOURCE_BINDING or RIGHTS_ALLOWED=FALSE → BLOCK → OBTAIN_COMPATIBLE_PERMISSION is auditable and keeps repair bounded.

12. Do not average publication gates

Suppose provenance, source, approval, and technical/aesthetic evidence are excellent while rights have expired. A 90/100 readiness score must not produce RELEASE_READY. This lesson uses non-compensatory mandatory predicates: FALSE, UNKNOWN, STALE, EXPIRED, or REVOKED states remain visible in the release decision.

13. Read the diagram and evidence matrix together

The learner-facing diagram shows exact candidate → source/provenance ∧ rights ∧ approval ∧ QC → release state. Table CON-018-T1 turns the same model into an auditable evidence row: digest, source/provenance, rights scope/expiry, approval binding, QC states, blocker, and recheck trigger. No meaning depends on color alone.

14. Lab: eight fixtures and 64 assertions

lab://CON-018/CON018-LAB1 contains eight synthetic fixtures: full closure, rights expiry, approval bound to the old digest, unknown semantic QC, valid C2PA with stale source binding, provenance validation failure, pending approval, and the final transfer with refreshed source/approval but a semantic mismatch. Compute each predicate independently from supplied evidence only.

15. Transfer: source and approval are repaired, semantics still block

In the transfer case, the restricted source is replaced by an allowed source and approval is re-issued for the new digest, but the subtitle introduces a semantic mismatch. Source, provenance, rights, and approval can all be TRUE while QC_CLOSED=FALSE; the result remains BLOCK until semantic repair and recheck. That is the CON-018 discipline: do not invent a new history, and do not inherit stale bindings into a changed candidate.