JAZ-X Media Provenance Inspector Changelog
======================

= 0.3.4 =
* Final WordPress.org submission packaging and metadata cleanup after a Plugin Check run reported no errors on the 0.3.3 candidate.
* Shortened the plugin header description to the documented display length guidance and removed the non-unique Plugin URI.
* Replaced candidate-stage wording with final-release wording.
* Moved older changelog history out of readme.txt to keep the directory readme compact.
* No database schema or verification-engine change; existing scan and verification records are retained.


= 0.3.3 =
* Reworked prepared database calls so Plugin Check can statically recognize the inline `wpdb::prepare()` calls instead of seeing intermediate query variables.
* Kept `%i` identifier placeholders for custom and core table names; minimum WordPress remains 6.2.
* Added narrow PHPCS no-cache rationale to the three remaining write-through audit-table operations reported by Plugin Check.
* No database schema change; existing scan and verification records are retained.

= 0.3.2 =
* Addressed the first Plugin Check report: translator comments, output escaping, filesystem-scan annotations, prepared SQL identifiers, and LIKE wildcard handling.
* Raised the minimum WordPress version to 6.2 so database identifiers can use the `%i` placeholder supported by `wpdb::prepare()`.
* Removed the optional browser request to the remote C2PA Trust List from the WordPress.org candidate, eliminating the reported offloading errors.
* Remote manifests and OCSP remain disabled; verification remains local and same-origin.
* Added targeted PHPCS rationale for intentional read-only streaming and direct access to JAZ-X Media Provenance Inspector's own audit tables.
* No database schema change; existing scan and verification records are retained.

= 0.3.1 =
* Hardened the WordPress.org candidate for privacy and security review.
* Restricted dashboard, scanning, and verification actions to `manage_options` by default while keeping status display available in Media Library.
* Added explicit opt-in for the external official C2PA Trust List lookup; it is disabled by default.
* Disabled remote C2PA manifest fetching and OCSP network lookups.
* Added WordPress Privacy Policy helper text and detailed external-service disclosure.
* Added earlier input sanitization for browser verification results before persistence.
* Added a complete plugin License URI and WordPress 7.1 tested-up-to declaration.
* Documented third-party source, licenses, versions, and reproduction steps for the bundled C2PA runtime.
* Cleans operational privacy/bulk-scan options on uninstall while preserving provenance audit tables.
* No database schema change; existing scan and verification records are retained.

= 0.3.0 =
* Bundled the official `@contentauth/c2pa-web` 0.15.1 browser runtime and matching C2PA WASM locally with JAZ-X Media Provenance Inspector.
* Removed the jsDelivr executable-code fallback from the production verification path.
* Added a local ESM wrapper and local `highgain` dependency so browser module resolution stays self-hosted.
* Added a local C2PA worker for HTTPS sites; HTTP development sites use the SDK's bundled Blob worker while remaining fully local.
* Compiles the local WASM from same-origin bytes before SDK initialization to avoid server MIME-type dependency on `application/wasm`.
* Added third-party license/source notices for the locally packaged runtime.

= 0.2.5 =
* Added human-readable C2PA integrity findings for common validation codes.
* Separated signed-content integrity failures from signer trust-chain warnings.
* Expanded derivative-loss reporting and integrity summaries.

= 0.2.4 =
* Hardened marker detection so generic JUMBF strings are not treated as C2PA by themselves.
* Added Other JUMBF metadata and No valid manifest states.

= 0.2.3 =
* Added JFIF/JPE support and Missing source classification.
* Added the dedicated C2PA-detected media table.

= 0.2.2 =
* Added automatic large-library scanning, Pause/Resume, retry handling, and state-based unscanned selection.

= 0.2.1 =
* Added complete scan counters and progress reporting.

= 0.2.0 =
* Added browser-side cryptographic C2PA verification and verification-state storage.

= 0.1.0 =
* Initial provenance inventory, marker detection, derivative tracking, and audit dashboard.
