Implement the EXIF writing pipeline with hash verification #31

New issue

Open

opened 2026-07-28 04:57:30 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-07-28 04:57:30 +00:00

Context

Spec section 12.3 defines exactly how an approved date becomes EXIF metadata, with
different rules per precision level. This is the step that makes exported photos useful
in any ordinary photo application, and the rules exist to avoid asserting more precision
than the evidence supports.

Scope

The EXIF writing pipeline with per-precision rules and post-write hash verification.

Implementation notes

Write DateTimeOriginal per the precision rules in spec section 12.3:
- day â€” the exact approved day
- month â€” first day of the approved month, with month-level precision recorded separately
- year â€” January 1 of the approved year, with year-level precision recorded separately
- decade â€” do not synthesize a capture date; auxiliary metadata and manifest only
- undated â€” no EXIF capture date at all
Record precision and the original approved low/high range in UserComment or equivalent.
Without this, a month-precision date is indistinguishable from a day-precision one once
exported, and the nuance the whole product preserves is lost at the last step.
Write the attribution note to ImageDescription.
Preserve existing metadata wherever practical â€” do not strip metadata as a side effect
of adding a date.
Post-write hash verification on every file. Abort and alert on mismatch (spec 12.3
and 6.6). Record both sha256_original and sha256_exported for the manifest.
Writes apply only to exported derivative files, never to originals.
Handle formats that cannot carry EXIF gracefully â€” record the limitation in the manifest
rather than failing the run or silently skipping.

Done when

Each precision level writes exactly what the spec prescribes
Decade and undated photos receive no synthesized capture date
Precision and range are recorded in auxiliary metadata
Every exported file is hash-verified after write, with mismatch aborting the run
Pre-existing metadata survives the write
Originals are untouched

References

docs/circa-spec.md sections 12.3, 6.6
backend/app/services/exif_extractor.py (read side already exists)

Depends on: export execution.

## Context Spec section 12.3 defines exactly how an approved date becomes EXIF metadata, with different rules per precision level. This is the step that makes exported photos useful in any ordinary photo application, and the rules exist to avoid asserting more precision than the evidence supports. ## Scope The EXIF writing pipeline with per-precision rules and post-write hash verification. ## Implementation notes - Write `DateTimeOriginal` per the precision rules in spec section 12.3: - `day` â€” the exact approved day - `month` â€” first day of the approved month, with month-level precision recorded separately - `year` â€” January 1 of the approved year, with year-level precision recorded separately - `decade` â€” **do not** synthesize a capture date; auxiliary metadata and manifest only - `undated` â€” no EXIF capture date at all - Record precision and the original approved low/high range in `UserComment` or equivalent. Without this, a month-precision date is indistinguishable from a day-precision one once exported, and the nuance the whole product preserves is lost at the last step. - Write the attribution note to `ImageDescription`. - Preserve existing metadata wherever practical â€” do not strip metadata as a side effect of adding a date. - **Post-write hash verification on every file. Abort and alert on mismatch** (spec 12.3 and 6.6). Record both `sha256_original` and `sha256_exported` for the manifest. - Writes apply only to exported derivative files, never to originals. - Handle formats that cannot carry EXIF gracefully â€” record the limitation in the manifest rather than failing the run or silently skipping. ## Done when - [ ] Each precision level writes exactly what the spec prescribes - [ ] Decade and undated photos receive no synthesized capture date - [ ] Precision and range are recorded in auxiliary metadata - [ ] Every exported file is hash-verified after write, with mismatch aborting the run - [ ] Pre-existing metadata survives the write - [ ] Originals are untouched ## References - `docs/circa-spec.md` sections 12.3, 6.6 - `backend/app/services/exif_extractor.py` (read side already exists) Depends on: export execution.

claude-bot added this to the v0.5.0 milestone

2026-07-28 04:57:30 +00:00

claude-bot added the

enhancement

backend

labels

2026-07-28 04:57:30 +00:00

claude-bot referenced this issue

2026-07-28 06:06:09 +00:00

Story-preserving export: XMP sidecars and a self-describing archive #120