WHFE v0.2: A Reference Implementation and an Extended Signature Scope for Structural Media Provenance

WHFE v0.1 proposed a five-field structural metadata schema (what, who, for, everyone, meta) for embedding origin, authorship, purpose, and authenticity directly into media files, together with an Ed25519 origin signature and a per-format embedding rule (PNG, WebP, AVIF, MP4). No reference implementation accompanied that paper. This report closes that gap for one container format: we implement the schema, sign and embed it into real PNG files, and extract it back without ever decoding pixel data — a direct, code-level demonstration of WHFE's founding claim that a consumer (human or AI) can determine what a medium is for from structure alone, never from interpreting its content. In the process we identify a real gap in v0.1's own specification: its signature covers only four provenance fields (content hash, creator, creation time, source URL), leaving the descriptive fields (what, for, everyone) — exactly the fields a consumer would rely on to judge a medium's purpose — unprotected against tampering. We extend the signed payload to cover the full metadata object, and verify with a concrete forgery scenario that v0.1's narrower scope would have missed the tamper while the extended scope catches it. A multi-signer (k-of-n) extension to the Origin Signature, motivated by an independent concern about single-authority capture, is scoped as a documented but unimplemented extension point.