Overcast Provenance

overcast-provenance

Use this skill to answer "is this clip real / where did it come from?": given a suspect video, find the oldest copy and who posted it first. It is the inverse of overcast-copycat-sweep — searching backward toward the origin rather than forward for rips — and reuses its geometry-gating and verdict conventions. This skill answers WHERE a clip came from (origin / earliest copy); for whether it was ALTERED (manipulation/authenticity — C2PA, EXIF re-save, ELA overlays, a shadow check) use the complementary overcast-verify-media. Origin and authenticity are distinct, non-overlapping questions — the leading verify/exif pass below establishes provenance signals, not a fakery verdict. Use the broad overcast skill and overcast/reference/verbs.md for exact flags.

Workflow

1. Check embedded provenance FIRST, then fingerprint the suspect clip. C2PA Content Credentials (verify) and EXIF capture metadata (exif) are the most direct origin evidence when present — a signed manifest names the creator + edit history. They're often stripped on re-upload, so also fingerprint distinctive frames (which survive the re-encodes, crops, and watermarks that defeat exact hashes AND that strip metadata):

overcast doctor --sources --json
overcast case init --json
overcast verify ./suspect.mp4 --json         # C2PA / Content Credentials: signer + edit manifest (needs c2patool)
overcast exif ./suspect.mp4 --json           # capture device/time, editing software, GPS (needs exiftool)
overcast watch ./suspect.mp4 --json          # content + transcript into memory
overcast index create origin --type image-ransac --local --json
overcast image add ./distinctive-frame.png --index <index-id> --json

2. Reverse-image-search the frames and sweep sources with topic keywords — crucially with NO --since floor, since older results sit closer to the origin:

overcast source add "lens:./distinctive-frame.png" --json
overcast source add "x:video:<topic keywords>" --json
overcast source add "youtube:search:<topic keywords>" --json
overcast source add "web:<topic keywords>" --json
overcast scan --limit 20 --json

3. Triage on metadata alone: sort candidate hits by published ASC — the earliest dates are your origin candidates; carry author + URL forward.

4. Capture the oldest few and confirm they are the SAME content (not a look-alike) — frame match plus transcript:

overcast capture <earliest-scan-hit-id> --json
overcast image match <captured-file> --index <index-id> --draw --json   # --draw writes the RANSAC overlay proof
overcast listen <captured-file> --json

5. Record the origin verdict. --ref the image match record so its overlay rides into the brief; ALWAYS leave a tldr note with the date chain — even "undetermined":

overcast finding create "origin: earliest confirmed copy is @<author> <date> (frame match 88 inliers, transcript identical); the viral <date2> post is a re-upload" --ref <image-match-record-id> --confidence high --json
overcast note "swept lens + x + youtube + web (no recency floor); <n> candidates; earliest confirmed <date> by @<author>; verdict: re-upload" --tag tldr --json
# Wait for the note result before exporting, so the TL;DR is included.
overcast brief --export ./provenance.html --json

Output

An origin verdict — original / re-upload-of- / undetermined — with the date chain, the earliest confirmed poster and URL, which layers agreed (frame + transcript), and the strongest record.id + media.at citations. "Undetermined" is honest when the earliest copy can't be confirmed as the same content.

Caveats

The earliest date you FIND is a floor, not proof of origin — deleted posts and platforms you didn't search may predate it; say so. Confirm same-content with the gated image match (a high inlier count on a degenerate homography is the main false positive — eyeball the --draw overlay) plus transcript; a shared topic or a look-alike frame is not the same clip. Face similarity is 0–100; image match is an inlier count + a 0–1 ratio, never a 0–100 score. Apify sources bill per result. lens ignores --since.