What a stamp proves

1. Identity of bytes. The file's SHA-256 and its Filecoin PieceCID are fixed in the StampRegistry contract. Anyone holding a bit-for-bit copy can prove it with sha256sum; anyone downloading the piece re-derives both.
2. Device signature. An enrolled device key signed the capture claim over those identifiers. The registry checked the signature on chain and stored it, so the check can be re-run forever from the chain alone — this site re-runs it in your browser.
3. Time (upper bound). The claim was included at a chain epoch whose timestamp is exact. The file existed no later than that instant. The device's capture time is a claim, shown separately.
4. Storage. The file is a piece of one or more live Filecoin data sets, challenged several times per proving period, and Stamper's retrieval probe downloads and re-hashes it.
5. Assurance level. The chain sets the level from the device key's endorsement by a governed registrar and either a per-capture countersignature or a hardware signature. Nothing else can raise a level.

What it does not prove

• Not that the scene happened as shown (screens, prints and staging defeat any camera).
• Not that the phone was uncompromised (root exploits defeat attestation).
• Not that the clock or location was honest.
• Not that the person stamping consented, or is who an account says.
• Not that the earliest stamp belongs to the creator.
• Not that an unstamped file, or one that differs from the original, is fake.