[P1][Media Trust] Add rights, consent, face/voice safeguards, audio provenance, and publication blockers for creative media

[Ankit6149]

Parent epics

#151, #64

Product outcome

SignalFlow does not treat every uploaded/generated media asset as automatically cleared for publication or every image/video instruction as permission to materially alter a real person's identity.

This issue adds the media-specific trust layer for rights, consent, sensitive transformations and audio provenance.

Canonical docs

• docs/MEDIA_INTELLIGENCE_AND_CREATIVE_PRODUCTION.md
• docs/CREATIVE_MEDIA_DOMAIN_CONTRACTS.md
• docs/INFERENCE_AND_PRIVACY_ARCHITECTURE.md

Rights state

At minimum support statuses such as:

USER_CREATED
ORGANIZATION_OWNED
CLIENT_OWNED_WITH_PERMISSION
LICENSED
PUBLIC_DOMAIN_OR_COMPATIBLE
GENERATED
UNKNOWN
RESTRICTED

Uploaded does not mean unrestricted rights.

Identity-sensitive capabilities

Treat these separately from routine crop/caption/layout operations:

FACE_MATERIAL_EDIT
FACE_REPLACEMENT
VOICE_CLONING
LIP_SYNC
AVATAR_GENERATION

They require explicit authorization/policy and must not be inferred from vague prompts such as "make me look better" or "fix this video".

Audio/music provenance

Represent:

• original clip audio;
• user-recorded narration;
• generic synthetic narration;
• approved user synthetic voice;
• licensed/user-provided music;
• platform-library music requiring external/manual handoff;
• no audio.

Never silently add unknown copyrighted music.

Publication blockers

A media revision may be blocked when:

• rights are unknown/restricted under active policy;
• public-use permission is false;
• face/voice consent is missing;
• confidential/private material remains visible;
• music/audio provenance is invalid;
• destination-specific usage rights are unmet.

A blocker must remain visible in review/Today until resolved; do not silently omit or replace user media without explanation.

Acceptance criteria

• Rights status is preserved with relevant Assets/derived media.
• Unknown/restricted rights can block or warn according to explicit policy.
• Identity-sensitive transformations require explicit capability/consent state.
• Routine non-identity edits remain usable without unnecessary friction.
• Audio/music source and rights provenance is stored for publication-ready media.
• Platform-library audio can be represented as a truthful manual/finalization handoff when APIs cannot apply it.
• Privacy/rights/consent blockers prevent exact media approval/publication when required.
• Generated media preserves provider/generation provenance.
• Revoking permission marks dependent future publication intents invalid/blocked where appropriate.
• No raw face/voice embeddings or sensitive media content is written to generic logs/analytics.

Non-goals

• no legal-rights marketplace;
• no automated legal opinion;
• no unrestricted voice/face generation feature;
• no assumption that every social platform exposes the same audio rights/API behavior.

Definition of done

Close only when SignalFlow can distinguish ordinary editing from identity-sensitive transformation, preserve media/audio rights provenance, and technically prevent a blocked media revision from being treated as publication-ready.