Quality gates / quality (pull_request) Successful in 2m57s
The demo now picks a committed text fixture that only claims to be a photo, asserts on camera that nothing was posted to /api/analyze, and keeps manual entry in the same scene. The builder requires that caption to have painted and records image_ingress_refusal in the manifest; the threat model names each implemented control, its module, and the tests that enforce it.