# HXP-008 — Conservation-Safe Attachment Profiles

Status: Validation Protocol 0.1
Public article edition: 2026-09-09

## Attachment is part of the evidence

A physical carrier becomes useful only when its relationship to the work is clear. Attaching it to a frame, sewing it across a seam, or retaining it in a rigid housing creates different relationships. Those choices affect security, handling, repair, and the meaning of a later verification result. An attachment profile makes the relationship explicit instead of treating every installation as equivalent.

The title describes the objective of the artwork-related qualification program. It is not a blanket claim that the candidate profiles have been proven conservation-safe. Material compatibility, removal behavior, and long-term effects need evaluation for the actual substrate and assembly. No universal adhesive claim exists.

This article describes four candidate families and the evidence required to use them responsibly. It provides a framework for decisions with the owner, installer, and conservator. It does not prescribe a proprietary installation recipe or authorize direct treatment of an artwork.

## Candidate profile families

| Profile | Intended attachment concept | Boundary of the relationship |
| --- | --- | --- |
| `RIGID-M1` | Recessed or mechanically retained frangible capsule for hard goods | The evaluated housing and its qualified host material |
| `FLEX-S1` | Sewn or webbed anchor crossing a qualified leather or textile seam | The evaluated seam and anchor assembly |
| `ART-M1` | Attachment to a frame, backing, mount, case, or transport capsule by default | The identified supporting component and its documented association with the work |
| `CLOSURE-B1` | Carrier bridging a package opening | The commissioned package-to-item relationship and evaluated closure state |

These identifiers organize candidate use cases. They do not certify every assembly using the same general concept. A metal recess with a particular finish and retention geometry is not interchangeable with an arbitrary plastic housing. A seam construction that behaves acceptably in one textile may be unsuitable for another.

The profile therefore needs a specific revision and a dossier before an installation can inherit a qualified claim. Marketing names and visual similarity are insufficient substitutes for that traceability.

## What every profile must declare

Each profile identifies the substrate family, preparation, geometry, service envelope, removal mechanism, destructive signals, permitted repair, and validation dossier. An evaluator needs enough information to determine what was tested and which variations are covered. Sensitive fabrication details can remain controlled, but the scope of the claim must be understandable to the person relying on it.

| Declaration | Why it matters |
| --- | --- |
| Host and supporting component | Prevents a claim about a frame from being mistaken for direct surface identity |
| Installation constraints | Defines which assemblies can use the profile's evidence |
| Service conditions | Limits unsupported extrapolation across temperature, moisture, handling, and age |
| Required continuity signals | Tells the verifier which observations are necessary |
| Repair and retirement policy | Preserves the distinction between original and replacement assemblies |
| Dossier and review status | Shows whether the concept is proposed, evaluated, or independently qualified |

Installation documentation should be proportionate. A useful record captures the relationship and permitted conditions without publishing private owner information, precise storage locations, or confidential handling arrangements.

## Hard goods and flexible materials

`RIGID-M1` places a frangible capsule in a recess or mechanically retained assembly. The relevant question is whether a transfer can preserve the identity-bearing components while defeating the intended continuity signal. Qualification must consider both the capsule and the surrounding retention system. Testing only a loose component does not evaluate the assembled relationship.

`FLEX-S1` uses a sewn or webbed anchor crossing a qualified seam. Flexible materials add repeated bending, tension, abrasion, and material variability. A profile should distinguish ordinary movement from destructive removal and identify whether the anchor's behavior affects the host's usability or appearance. Security performance on a rigid substrate cannot establish these properties.

Neither family implies that a field installer may improvise materials or geometry while retaining the same qualified claim. A change that affects the removal mechanism, observation, or host interaction needs an explicit compatibility assessment. Where evidence is absent, the profile remains a candidate for that installation.

## Artwork defaults to a supporting component

`ART-M1` defaults to a frame, backing, mount, case, or transport capsule. This approach keeps the original artwork surface outside the default attachment operation. It also requires honest description of what has been bound: the system has evidence about an identified supporting assembly associated with a work, not necessarily an inseparable connection to the work itself.

For a framed painting, documentation can associate the credential, the work evidence, and the installed frame-mounted carrier. If the painting is later removed from that frame, the old carrier may still be readable. Its readability alone cannot establish that the currently framed object is the same painting. The history of handling and any fresh intrinsic evidence remain relevant.

This distinction is especially important for loans, exhibitions, and transport. A case can identify a commissioned shipment assembly without proving that its contents were continuously observed. The public result should state the supported relationship and avoid extending it to unobserved facts.

## Direct application requires a separate decision

Direct adhesive application to artwork is prohibited under the default approach. A separate profile requires a named conservator, material assessment, owner authorization, reversible-treatment plan, and substrate-specific validation. These conditions make direct application an explicit conservation decision rather than a routine interface option.

An industrial destructible adhesive must not be described as conservation-safe merely because it provides visible tamper evidence. Irreversible damage can be a useful property in a disposable carrier and an unacceptable property on an original surface. A profile must identify where damage occurs, how the work is protected, and what removal or future treatment would require.

The [Canadian Conservation Institute guidance on paper objects](https://www.canada.ca/en/conservation-institute/services/preventive-conservation/guidelines-collections/paper-objects.html) documents material risks relevant to attachments and tapes. Its [guidance on framing works on paper](https://www.canada.ca/en/conservation-institute/services/conservation-preservation-publications/canadian-conservation-institute-notes/framing-works-art-paper.html) provides additional conservation context. These references inform caution; they do not validate a Helix assembly or replace a conservator's assessment.

## Closures and the contents problem

`CLOSURE-B1` bridges a package opening and authenticates the commissioned package-to-item relationship. Its continuity signal is meaningful only in relation to the evaluated opening and assembly. An intact closure does not independently prove the identity of everything inside, especially where the package could be accessed in another way or where contents were never adequately documented.

Commissioning should therefore distinguish the recorded item, the package, and the closure event. The relevant physical dossier evaluates the declared access boundaries rather than assuming every possible opening is protected. Later verification combines the closure observation with the digital record and any required inspection of the work.

For a transport capsule, an authorized opening can end the previous closure claim without invalidating the original credential. A new closure is a new documented relationship. Preserving that sequence is more informative than trying to keep one permanent “intact” status through legitimate handling.

## Installation, inspection, and service

A profile's lifecycle includes installation, baseline observation, ordinary service, inspection, and eventual retirement or replacement. Each stage has a different purpose. The baseline records the commissioned assembly; inspection evaluates its present condition; replacement establishes a new relationship. These stages should not be collapsed into a single tag-generated event.

Inspection may reveal a functional problem, a material concern, or a continuity failure. An unreadable carrier is not automatically evidence of deliberate interference. The report should identify the failed or unavailable signal, the observation conditions, and any next action supported by the profile. It should not invent an explanation that the measurement cannot establish.

Permitted servicing also needs limits. Cleaning, tightening, resewing, or replacing a support may affect the evaluated assembly. If an intervention falls outside the profile's repair allowance, the previous continuity claim should not silently continue. The authorized record should explain the intervention and whether new enrollment or qualification is needed.

## Reframing example

An owner approves reframing a work whose carrier is attached to the old frame. The digital credential and its original evidence remain available. The old assembly is documented as retired, the work is inspected under the applicable process, and the new supporting component is associated through an authorized event.

A future viewer should be able to understand both assemblies in the history. The new carrier does not impersonate the old carrier, and the older record does not disappear. If no qualified intrinsic comparison was performed during the intervention, the history should not claim that it was. Accurate documentation is valuable even when some physical evidence is unavailable.

## Qualification and related articles

Qualification combines material compatibility, service behavior, transfer resistance, and the actual verification procedure. It must be specific enough to keep a result from one material or installation from becoming a universal assertion. Independent review and clearly stated limitations are part of the intended evidence standard, not labels supplied automatically by the software.

Read [HXP-007](/standards/tamper) for environmental and transfer evaluation, [HXP-006](/standards/optical-puf) for unit correspondence, and [HXP-009](/standards/conformance) for qualification gates. [HXP-003](/standards/open-verifier) explains how a verifier can preserve useful digital evidence while reporting an attachment claim as unvalidated or indeterminate.