See the versions object on every JSON report. The same file may interpret differently after standard updates, so versions are mandatory.
Docs
C2PA validation methodology
The Reader loads the Manifest; validation_state maps onto fields; the Trust List is cached daily. Remote fetches are SSRF-constrained.