[crandmck]

WIP.

These were extracted from Discord: https://deploy-preview-459--cai-open-source.netlify.app/docs/technical-faqs/

[netlify]

✅ Deploy Preview for cai-open-source ready!

Name	Link
🔨 Latest commit	abe2c3f
🔍 Latest deploy log	https://app.netlify.com/projects/cai-open-source/deploys/6af4e732b34af07062708da8
😎 Deploy Preview	https://deploy-preview-459--cai-open-source.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

🚀 Deployed on https://deploy-preview-459--cai-open-source.netlify.app

[crandmck]

Co-pilot review vs the rest of the docs:

1. High: The Rust trust-anchor example uses a removed API. The tech-faq-rust.md:26 calls Settings::from_toml. The release notes state that this API was removed in 0.92.0. Replace the example with settings attached to a Context, then construct the reader or builder from that context.
   FIXED

2. Medium: The Node PEM-only answer is too absolute. The FAQ says file paths are not accepted. The README.md:591 documents inline PEM or local file paths for Context settings. Distinguish that interface from the older raw-settings API. The FAQ’s Builder.withJson(..., settings) examples also remain supported but are now deprecated; current guidance recommends Context and withJsonAsync.
   FIXED

3. Medium: Trust-list membership is described too narrowly. The tech-faq-certificates.md:15 and tech-faq-conformance.md:19 require a CA’s root to appear on the list. The trust-lists.mdx:12 explicitly permits root or subordinate CA trust anchors. Say the signing certificate must chain to an appropriate trust anchor on the C2PA Trust List.
   FIXED

4. Medium: The ICA answer omits an important trust requirement. tech-faq-cawg.md:13 explains the aggregation service requirement but not issuer trust. The cawg-identity.md:5 says ICA issuers are untrusted by default and require an explicit DID allow-list. Add this distinction: a valid ICA signature, or a Trusted enclosing manifest, does not establish trusted creator identity.

5. Medium: Recommended timestamp endpoints conflict with your security policy. The tech-faq-conformance.md:159 recommends HTTP endpoints. This triggers Global Security Rule 3, which requires secure protocols for external communication. Verify provider-supported HTTPS endpoints before recommending replacements; do not assume changing the scheme works. This is a policy conflict, not proof that the historical endpoint information is false.

Unresolved Checks

• Several FAQs prescribe trust.trust_anchors, whereas the context-settings.md:405 now shows trust.anchors[]. The documentation is inconsistent; pin the supported SDK versions and verify compatibility before presenting one schema as universal.
• The reading-cawg-id.md:15 says ICA signing is unsupported. Clarify whether “ICA support” means validation, embedding a service-issued credential, or issuing that credential.

Other TO DO (Rand):

• Review questions in the conformance FAQ page to see if they are more general and would fit better elsewhere. Several of them are not relevant only to conformance but could go into General or another page.
• Consider if it makes sense to add a new "Manifest FAQs" page as a new container.