AABC × SDA Bocconi · v0.4

Digital Passport for Artworks

An artwork with uncertain provenance is invisible. Surfacing it exposes its holder to legal and reputational risk, so it stays in the dark — unlent, unstudied, unclaimable. The DPA lets a holder register an object pseudonymously, prove the registration is immutable and time-stamped, and then disclose different amounts of it to different parties.

This repository is the v0.4 consolidation: one pipeline assembled from five separate working prototypes.

See a passport through five roles →Why a low score means two things Read the plan

Five working systems, and that was the problem

The framework prototype defined the shape of the problem. Student teams then outran it on substance — building better evidence gathering, better forensics, a complete lifecycle, and a real consumer product. None of them could talk to each other.

Before v0.4

Three confidence scores that disagreed about the same object
Four passport formats, none validating against each other
Two incompatible cryptographic trust models
Two duplicate evidence stacks hitting the same sources
Role-gated disclosure in exactly one repo — the private one
Coverage epistemics in exactly one other repo

v0.4

One scorer — accumulation, from a base of 30
One passport envelope, signed over one canonicalisation
Two issuer classes, deliberately — pseudonymity and accreditation
One evidence service behind one connector interface
Disclosure enforced at the boundary, for every field
Coverage mandatory on every passport, never folded into the score

The core finding. The five projects were never competing implementations. They are the consecutive stages of one pipeline that nobody had drawn.

The pipeline

Identify

@dpa/identity

image → object. Fingerprints, duplicate detection, forensics, Vision identification.

Investigate

@dpa/evidence

object → sourced claims. One connector interface, tiered register checks.

Assess

@dpa/assess

claims → confidence score AND coverage class, computed independently.

Issue

@dpa/issue

one signed envelope, two issuer classes — pseudonymous wallet or accredited institution.

Govern

@dpa/govern

confidentiality envelope + on-chain notarisation of the hash only.

Maintain

@dpa/lifecycle

revocation, amendment, claims, human review.

Present

apps/web

role-gated views, the 3D exhibit, and VANGO as an external consumer.

Three numbers, never combined

A recurring failure across the upstream repos was one number carrying several meanings. v0.4 names three and forbids merging them.

confidenceScore

How much sourced provenance evidence exists?

0–100, accumulated from 30. Never adjusted by coverage.

coverageClass

Could that evidence ever have existed?

Never reduced to a number. Never folded into the score.

forgeryRisk

Is this image what it claims to be?

A different question from “was this looted?”. Same scale, unrelated.

What was consolidated

Repository	What it is	What v0.4 takes
arts-provenance-agent Most mature	Peer-reviewed research agent. Grounded evidence, tiered register checks, signed JSON-LD passport, x402 micropayments.	Passport envelope · coverage model · canonical scorer
provenance-search Deployed	Eight-source provenance lookup with Gemini Vision identification and in-museum camera capture.	Evidence connectors · image identification · field capture
digital-passport-artworks Complete lifecycle	The full lifecycle, client-side: issue, revoke, reinstate, verify, plus image forensics and duplicate detection.	Lifecycle + revocation · institutional CA chain · forensics
VANGO Not folded in	Visitor-facing art passport. QR stamps, three languages, a physical-to-digital bridge.	Stays a separate client of the public tier (ADR-007)
dpa-prototype The framework	The framework reference implementation: role-gated disclosure, EAS notarisation, 3D exhibit.	Confidentiality envelope · notarisation spine · exhibit

Every vendored module carries a provenance header naming its origin. Full credit in ATTRIBUTION.md.

What this is not

Not a certificate

No register check in this system can return clear. The strongest available negative is no-evidence-found. Colonial and archaeological material was never inventoried, so a “clean” verdict would be issued most confidently for exactly the objects most likely to be problematic.

Not validated

Everything here runs on committed fixtures. The scorer is real and the sources are real and cited, but no live register was queried, no attestation was written to a chain, and the scoring has not been validated against ground truth. That is the first open item in the backlog.