What to Settle Before Watermarked Claude Text Ships Inside Your App

Sort what you ship into four buckets

Once the test was settled, the next job was policy per artifact. Everything that leaves my machine falls into four buckets, and each one has a fixed handling rule.

The column that matters most is the last one. If you only record yes or no, the version of you working late six months from now will not remember why, and the boundary will quietly move. On days when I work through thirty-plus review replies in one sitting, the pull to send a draft verbatim is real. A one-line reason gives you something to argue back with.

For the mechanics of producing multilingual listings in the first place, I covered that separately in Generating localized App Store listing metadata within character limits using the Claude API. This piece is about what happens to those artifacts afterward.

On the image side, I measured where the metadata dies

Provenance metadata follows C2PA and arrives cryptographically signed, which makes tampering detectable. It is a solid mechanism. The trouble is that indie screenshot pipelines rarely preserve the conditions it depends on.

Store screenshots are almost never the original file. They get resized per device class, composited into device frames, and converted for size. I checked whether metadata survives each of those steps, embedding C2PA-equivalent custom metadata into a PNG on Linux and running it through representative export operations.

from PIL import Image, PngImagePlugin
 
# 1. Build a source image carrying provenance-style text chunks
img = Image.new("RGB", (1290, 2796), (30, 40, 60))
meta = PngImagePlugin.PngInfo()
meta.add_text("c2pa", '{"claim_generator":"Claude","signature":"..."}')
meta.add_itxt("XML:com.adobe.xmp", "<x:xmpmeta><c2pa:manifest/></x:xmpmeta>")
img.save("source.png", pnginfo=meta)
 
def probe(path):
    """Report which metadata keys survived the save"""
    info = Image.open(path).info
    return sorted(k for k in info if k not in ("jfif", "jfif_density", "jfif_unit", "jfif_version"))
 
# 2-a. Resize for a different device class
Image.open("source.png").resize((1242, 2688)).save("resized.png")
 
# 2-b. Convert to JPEG to cut file size
Image.open("source.png").convert("RGB").save("converted.jpg", quality=90)
 
# 2-c. Composite into a device frame
canvas = Image.new("RGB", (1290, 2796), (255, 255, 255))
canvas.paste(Image.open("source.png").resize((1100, 2382)), (95, 207))
canvas.save("composited.png")
 
# 2-d. Resize while explicitly carrying metadata forward
src = Image.open("source.png")
keep = PngImagePlugin.PngInfo()
for key, value in src.info.items():
    if isinstance(value, str):
        keep.add_text(key, value)
src.resize((1242, 2688)).save("resized_keep.png", pnginfo=keep)
 
for name in ("source.png", "resized.png", "converted.jpg", "composited.png", "resized_keep.png"):
    print(f"{name:18} {probe(name)}")

Here is what came back on my run:

source.png         ['XML:com.adobe.xmp', 'c2pa', 'xmp']
resized.png        []
converted.jpg      []
composited.png     []
resized_keep.png   ['XML:com.adobe.xmp', 'c2pa', 'xmp']

Resize, convert, composite: metadata gone in every case. The only survivor was the run where I wrote the carry-forward explicitly. This is not a Pillow quirk so much as the default across image libraries — metadata read on open is not written on save unless you say so.

Two practical consequences follow. First, treat any image that has been through a screenshot pipeline as carrying no provenance metadata, because it almost certainly does not. Second, the reverse inference collapses too. Absent metadata is not evidence that an image avoided AI, because a stripped file and a hand-made file are indistinguishable once written to disk.

So the presence of a mark cannot serve as your record-keeping. Record-keeping has to exist separately, on your side.

Keep a provenance ledger and run it as a gate

That is what the ledger is for. The mechanism is deliberately plain: enumerate everything that ships, declare an origin for each file, and stop the submission when a declaration and the file disagree.

#!/usr/bin/env python3
"""Provenance gate for shipped artifacts. Blocks undeclared files and silent human-only edits."""
import hashlib
import json
import sys
from pathlib import Path
 
SHIP_ROOT = Path("ship")          # only artifacts that actually reach the store
LEDGER = Path("provenance.json")  # the single place a human reviews
TARGET_SUFFIXES = {".txt", ".strings", ".xml"}
ORIGINS = {"human-only", "claude-assisted", "claude-generated"}
 
 
def sha256(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()
 
 
def load_ledger() -> dict:
    if not LEDGER.exists():
        return {}
    return json.loads(LEDGER.read_text(encoding="utf-8"))
 
 
def main() -> int:
    ledger = load_ledger()
    failures, notices = [], []
 
    for path in sorted(SHIP_ROOT.rglob("*")):
        if not path.is_file() or path.suffix not in TARGET_SUFFIXES:
            continue
        key = path.as_posix()
        entry = ledger.get(key)
 
        if entry is None:
            failures.append(f"UNDECLARED  {key}  no origin recorded in the ledger")
            continue
        if entry.get("origin") not in ORIGINS:
            failures.append(f"BAD_ORIGIN  {key}  origin={entry.get('origin')!r}")
            continue
 
        digest = sha256(path)
        if entry.get("sha256") == digest:
            continue
 
        # human-only asserts "this never went through Claude" - changed content needs a fresh assertion
        if entry["origin"] == "human-only":
            failures.append(
                f"REDECLARE   {key}  human-only content changed "
                f"({entry['sha256'][:8]} -> {digest[:8]})"
            )
        else:
            notices.append(f"UPDATED     {key}  origin={entry['origin']} (refresh the ledger hash)")
 
    for line in notices:
        print("  " + line)
    for line in failures:
        print("NG " + line)
 
    if failures:
        print(f"\nProvenance gate: {len(failures)} unresolved. Submission halted.")
        return 1
    print(f"\nProvenance gate: passed ({len(notices)} notices)")
    return 0
 
 
if __name__ == "__main__":
    sys.exit(main())

The ledger itself is unremarkable JSON keyed by path:

{
  "ship/metadata/ja-JP/description.txt": {
    "origin": "human-only",
    "sha256": "371619c6...",
    "note": "Product description, written by hand"
  },
  "ship/metadata/en-US/description.txt": {
    "origin": "claude-assisted",
    "sha256": "0000...",
    "note": "Hand-written Japanese translated with Claude"
  },
  "ship/ios/Localizable.strings": {
    "origin": "claude-generated",
    "sha256": "9f2b41d0..."
  }
}

Run it with two files deliberately left out of the ledger and you get:

  UPDATED     ship/metadata/en-US/description.txt  origin=claude-assisted (refresh the ledger hash)
NG UNDECLARED  ship/android/values-ja/strings.xml  no origin recorded in the ledger
NG UNDECLARED  ship/metadata/ja-JP/review_reply_tpl.txt  no origin recorded in the ledger
 
Provenance gate: 2 unresolved. Submission halted.

Note that claude-assisted drift is a notice, not a failure. Generated copy is supposed to change. The only hard stop is a missing declaration. Tighten that any further and the ledger becomes an obstacle people route around, which defeats the purpose entirely.

The hash is what actually protects human-only

The rule that earns its place is the human-only check. Change a single character in that same file and re-run:

NG REDECLARE   ship/metadata/ja-JP/description.txt  human-only content changed (371619c6 -> 2c7abe29)

human-only is an assertion to yourself that a file never went through Claude, and the assertion only covers the content that existed when you made it. If the bytes changed, you owe yourself a fresh statement that the change was your own hand.

That looks excessive on paper, and I ran it as a warning at first. What moved it to a hard failure was an evening spent refining a description while reading Claude's suggestions in another window, when I overwrote the shipping file with the scratch buffer and did not notice until the next morning. I had no intention of pasting the response in. It ended up there anyway.

Deliberate violations are not the risk when you work alone. Mix-ups are. A hash tells you about them before submission rather than the next morning.

The ledger belongs in your local release routine before it belongs in CI. Mine runs once ahead of the Fastlane invocation, and since then "we cannot reconstruct where this came from" has stopped happening.

The false positives come from encoding and line endings

The first thing that broke once this was running was a Localizable.strings file failing with REDECLARE when nobody had touched it. The cause was encoding. iOS string files are sometimes stored as UTF-16, and a single pass through an editor or a conversion script turns them into UTF-8. Not one character changed; the bytes are completely different.

I saved the same single line three ways to confirm it:

utf-8       bytes=  35  sha256=1c5798128d73b031
utf-16      bytes=  52  sha256=121c18994f6a858e
utf-8+CRLF  bytes=  36  sha256=4b88f272788ef77a

Line endings do the same thing. Pull in a file that came from a Windows machine, get CRLF, get a different hash.

A few of those in a row and people stop reading human-only warnings altogether, which is the worst state a gate can be in. The fix was to hash normalized text rather than raw bytes:

def stable_digest(path: Path) -> str:
    """Hash text in a way that ignores BOM and line-ending differences"""
    data = path.read_bytes()
    if data[:2] in (b"\xff\xfe", b"\xfe\xff"):   # UTF-16 BOM
        text = data.decode("utf-16")
    else:
        text = data.decode("utf-8-sig")          # also strips a UTF-8 BOM
    normalized = text.replace("\r\n", "\n").rstrip("\n")
    return hashlib.sha256(normalized.encode("utf-8")).hexdigest()

With that substitution all three variants above collapse to the same digest (1c5798128d73b031...). Binary assets cannot go through this path, so I branch on suffix and apply it only to text assets such as .strings and .xml.

One caveat worth stating. rstrip("\n") absorbs trailing-newline differences but leaves leading whitespace alone. It is tempting to normalize indentation away too, and I would advise against it: loosen that far and you can no longer distinguish "reformatted" from "rewritten." Reducing false positives and preserving the meaning of the assertion pull against each other, and the balance has to sit somewhere. Trailing newlines only is where I have found it comfortable in practice.

A mark is not a disclosure

One last distinction worth keeping sharp.

The marks Anthropic applies are part of Anthropic's own transparency work. If you ship a product built on Claude, what your product needs to disclose is a separate assessment, and their help center says as much: evaluate your own obligations independently.

So you cannot point at a watermark and call disclosure handled. Whether disclosure is required depends on the platform terms you distribute under, the law that applies to you, and how much of the work you actually delegated. I am not a lawyer, and where the answer is unclear I would get it checked. What I can say is that the time that check takes depends almost entirely on whether you kept records.

Which is the real payoff of the ledger. When someone asks who wrote a particular line, you answer from a record instead of from memory. For an indie developer, that is the difference between a few minutes and half a day.

What to do next

Pick one directory to stand in for ship/ and move only the strings and images that actually reach the store into it. The act of gathering them is itself an audit, and you will reliably surface a handful of files whose origin you can no longer recall. I found five. That is where to start.

Watermarking turned out to be less of a constraint for me than a prompt to finish an inventory I had been postponing. Once you can state where the line falls from records rather than from memory, using the tools gets easier, not harder.