---
name: wdy-provenance-submit
description: Submit a work's fingerprint and metadata to WDY Certified.
version: 1.2.0
author: UNM (WDY)
license: Proprietary
platforms: [linux, macos, windows]
metadata:
  hermes:
    tags: [WDY, provenance, certified, submission]
    related_skills: [wdy-provenance-workflow, wdy-site-operations]
---

# WDY Certified — Submit a Work (distribution edition)

Submit a work's **fingerprint and metadata** to WDY Certified and receive a public, permanently addressable verify page and record number.
**Originals are never uploaded** — this entire flow handles only SHA-256 values and metadata.

> Host-neutral: this file assumes no specific agent implementation. Wherever it says "run a shell command", run it however your environment runs commands (Hermes / Claude Code / Codex / Cursor / WorkBuddy — any locally-executing agent). If your environment **cannot read local files** (browser-only chat assistants), go straight to branch C in §2.

## 1. When to Use

Use when the user says: "certify this file / prove this is mine / register the origin / I need a time proof / I need AI-content traceability".

Not for: copyright registration (WDY does not determine ownership), digital watermarking (out of scope), legal advice.

## 2. Branch check (ask three questions first — don't force it)

| Branch | Condition | What to do |
|---|---|---|
| **A — full auto** | can read local files + can send HTTPS | hash → assemble draft → POST → report receipt |
| **B — semi-auto** | can read files, network restricted | produce draft JSON + full email text; user pastes into webmail to **hello@wdy.org** (subject CERTIFIED) |
| **C — guided** | cannot read local files | say so plainly; direct the user to https://wdy.org/submit — the page fingerprints in the browser, works offline |

## 3. Branch A: submit (most common)

### 3.1 Fingerprint

```
Windows      certutil -hashfile "file path" SHA256
macOS/Linux  shasum -a 256 "file path"
```

Take the 64-char lowercase hex result; also record the byte size (Windows `dir` / `stat -c%s`).

### 3.2 Submit

```
curl -sS -X POST https://wdy.org/api/submit \
  -H "Content-Type: application/json" \
  -d @manifest.json
```

Success returns `{"ok":true,"receipt":"WDY-R-YYYYMMDD-XXXXXX","next":"…"}`.

### 3.3 Payload fields (missing one → 422)

```json
{
  "manifest_version": "0.1",
  "record_id": "(assigned by WDY at issuance)",
  "title": "Work title",
  "content_type": "video|script|storyboard|poster|report|document|dataset|webpage",
  "file": {"filename": "master file name", "size_bytes": 24576, "sha256": "<64-char lowercase hex>"},
  "provenance": {"production_mode": "ai|live|hybrid|authored",
                 "ai_generated_ratio": 0.35, "live_action_ratio": 0.65},
  "ai_disclosure": {"visible_label": true, "metadata_marking": true,
                    "basis": "EU AI Act Art.50; NRTA Order No.16 Art.34; AI-content labelling measures"},
  "rights_claims": [{"role": "producer", "party": "Party name", "basis": "production contract", "scope": "distribution rights"}],
  "contact": {"name": "Contact name", "email": "reachable@example.com", "org": "Company"},
  "request": {"evidence_tier": "standard|tsa|judicial"},
  "created_at": "2026-09-15T02:00:00Z"
}
```

Rules (server-enforced):
- `ai_generated_ratio + live_action_ratio` **must = 1.0**; `mode=ai` → ai ratio 1.0; other modes → 0.0
- `mode=ai|hybrid` with `visible_label=false` → **rejected** (NRTA Order No.16 Art.34 requires a visible AI label on every episode of an AI micro-drama — add the label first, don't work around it)
- `rights_claims` use **colons** as separators; no commas inside fields
- **the draft must not carry `signature`** — co-signing happens in WDY review
- `contact.email` must be real and reachable (record number + verify link go there)

### 3.4 Pre-submit self-check (7 items — if any fails, don't send)

1. sha256 is 64-char lowercase hex and matches a recompute of the file
2. both ratios sum to 1.0 and match the declared `production_mode`
3. `mode=ai|hybrid` → `visible_label = true`
4. title / contact.name / contact.email non-empty; email valid
5. `content_type` within the 8-value enum
6. no `signature` in the draft; `record_id` is a placeholder
7. same fingerprint not submitted before

## 4. After submission

- The receipt (`WDY-R-…`) is a **queue id, not issuance**; the official record number `WDY-YYYY-NNNN-XXXXXX` is assigned after review.
- Review completes within 5 business days; the result is mailed to the submitter and the page goes live at `https://wdy.org/certified/verify/<record id>/`.
- Give the client a one-line re-verify command (proves the file is unchanged):
  - Windows `certutil -hashfile FILE SHA256`; macOS/Linux `shasum -a 256 FILE`
  - matching the SHA-256 on the verify page = byte-identical to the day it was certified

## 5. Public-wording red lines

- ✅ Allowed: provenance record, publicly re-verifiable, public verify page after review, five-anchor evidence model (blockchain / timestamp / Bitcoin / physical postal / trail).
- ❌ Not allowed: copyright certification, ownership determination, judicial recognition, notary replacement, "TSA-certified", un-overturnable records.
- Regulation whitelist: EU AI Act Art.50; US FRE 901(b)(4)/902(13)-(14); NRTA Order No.16 Art.34 + AI-content labelling measures; online litigation rules §16. **Never cite GB/T 44474.**

## 5·5 Core differences & unique value (one-breath version)

> One line: others = "deposit a copy with one institution you have to trust"; WDY = "**one record, usable across regimes — and re-verifiable without trusting WDY**."

| Dimension | Common practice | The WDY difference |
|---|---|---|
| Regime coverage | single scheme (one registry, one chain, one platform) | **one pack, three regimes**: the same record stands for NRTA Order No.16 §34 · EU AI Act Art.50 · US FRE 901/902 |
| Re-verification | must go back to the provider (depends on a live service) | **offline, independent re-verification**: file vs. record page (or postal card) — no trust in WDY, no chain, no server required |
| Evidence form | pure digital record | **five anchors**: chain + timestamp + Bitcoin + physical **postal card** (a third-party date proof you can hold) + trail |
| Original privacy | usually requires uploading the original | **originals never leave the machine** — SHA-256 and metadata only |
| Pricing | opaque, one-off quotes | **transparent tiers**: $1 first record / $4.9 standard / $9.9 timestamped / from $49 judicial-grade — you pay by risk, not by "strength ranking" |
| Stance | sells endorsement on the side | **discipline**: records are never deleted, fields never renamed, endorsement never sold; the service **refuses** AI works without the visible label (= a free compliance check) |

Note: these are value statements, not commitments — the §5 red lines still govern any outward promise.

## 6. Install & online access

**Online (downloadable)**
- English edition: https://wdy.org/skills/wdy-provenance-submit/SKILL.md
- 中文版 Chinese edition: https://wdy.org.cn/skills/wdy-provenance-submit/SKILL.md

**Three ways to install (pick one)**
1. **Any locally-executing assistant (recommended)** — hand it this line:
   `Install this skill and use it to certify my file: https://wdy.org/skills/wdy-provenance-submit/SKILL.md`
2. **Hermes**: `hermes skills install https://wdy.org/skills/wdy-provenance-submit/SKILL.md`
3. **One terminal line** (Claude Code / Codex / Cursor …):
   `mkdir -p ~/.claude/skills/wdy-provenance-submit && curl -fsSL -o ~/.claude/skills/wdy-provenance-submit/SKILL.md https://wdy.org/skills/wdy-provenance-submit/SKILL.md`

**Per-host placement**
| Host | Where it goes |
|---|---|
| Hermes | `hermes skills install <URL above>` or drop at `skills/wdy-provenance-submit/SKILL.md` |
| Claude Code | `.claude/skills/wdy-provenance-submit/SKILL.md` (project) or `~/.claude/skills/` (global) |
| WorkBuddy | import via its Skills menu |
| Anything else | agree with the agent: one line in `AGENTS.md` pointing at this file (or its URL) |

## 7. Pitfalls

- **`403 error code 1010`**: the site's Cloudflare browser-integrity check blocks unusual user agents (notably the default `Python-urllib` UA). Since 2026-09-15 the `/api/*` paths carry a WAF skip rule — default UAs get through (tested 200). If you still see 403, set an explicit `User-Agent` (any value, e.g. `WDY-Agent/1.0`). Static pages deliberately keep blocking bot UAs — don't scrape the site with a browser UA.
- **No MCP needed**: submission is one HTTPS POST; no MCP server, no resident process.
- **Never upload originals**: metadata only; payloads over 64 KB get 413. Don't stuff media into the payload.
- **Don't mint record numbers**: `record_id` must be a placeholder (or a local `WDYP-…` temp id). Official-looking numbers (`WDY-2026-0005`) get rejected with 422.
- **Don't promise beyond WDY's stated SLA**: review is manual, 5 business days.
- Page submission and API submission run through the **same review path** — fully equivalent.