Upload agents/metadata_agent.py with huggingface_hub

agents/metadata_agent.py

@@ -1,444 +1,179 @@
-"""
-FORENSIQ — Metadata Agent
-Analyzes file metadata and compression:
-  - EXIF validation (completeness and physical plausibility)
-  - Compression history (Error Level Analysis for double JPEG)
-  - AI metadata traces (XMP/IPTC parser for generator signatures)
-"""
-
-import numpy as np
+"""FORENSIQ — Metadata Agent (12 features)"""
+import numpy as np, io
 from PIL import Image, ImageChops, ImageEnhance
-from PIL.ExifTags import TAGS, GPSTAGS
-import io
-import struct
-from typing import Dict, Any, List, Tuple
-
+from PIL.ExifTags import TAGS
+from scipy.ndimage import maximum_filter, gaussian_filter
+from typing import Dict, Any
 from agents.optical_agent import AgentEvidence
 
-
-# ─── EXIF Validation ─────────────────────────────────────────────────
-def analyze_exif(img: Image.Image) -> Dict[str, Any]:
-    """
-    Check EXIF metadata completeness and physical plausibility.
-    Real photos have rich EXIF; AI images have none or fabricated metadata.
-    """
+def _g(img): return np.array(img.convert("L")).astype(np.float64)
+
+def d01_exif_completeness(img):
+    try: exif=img._getexif() or {}
+    except: exif={}
+    decoded={}
+    for tid,v in exif.items():
+        t=TAGS.get(tid,str(tid))
+        try: decoded[t]=str(v)[:200]
+        except: decoded[t]="<binary>"
+    flags,auth=[],[]
+    has_make="Make" in decoded; has_model="Model" in decoded; has_lens="LensModel" in decoded or "LensInfo" in decoded
+    has_focal="FocalLength" in decoded; has_exp="ExposureTime" in decoded; has_iso="ISOSpeedRatings" in decoded
+    has_f="FNumber" in decoded; cam=sum([has_make,has_model,has_lens,has_focal,has_exp,has_iso,has_f])
+    if cam==0: flags.append("No camera metadata")
+    elif cam>=4: auth.append(f"Rich EXIF ({cam}/7)")
+    if not decoded: flags.append("Empty EXIF")
+    if "GPSInfo" in decoded: auth.append("GPS present")
+    if cam>=4 and not flags: s,n=-0.5,f"Rich plausible EXIF ({cam}/7 fields)"
+    elif not decoded or len(flags)>=2: s,n=0.5,"Missing/suspicious metadata"
+    elif flags: s,n=0.2,"Minor metadata concern"
+    else: s,n=-0.1,"Partial metadata"
+    return {"test":"EXIF Completeness","fields":len(decoded),"camera_fields":cam,"exif_data":decoded,"score":s,"note":n}
+
+def d02_software_check(img):
+    try: exif=img._getexif() or {}
+    except: exif={}
+    decoded={TAGS.get(tid,str(tid)):str(v)[:200] for tid,v in exif.items()}
+    sw=decoded.get("Software","").lower()
+    ai=["stable diffusion","midjourney","dall-e","comfyui","automatic1111","invoke","flux","novelai","sd"]
+    edit=["photoshop","gimp","lightroom","capture one","snapseed"]
+    if any(k in sw for k in ai): s,n=0.8,f"AI software: {decoded.get('Software','')}"
+    elif any(k in sw for k in edit): s,n=0.2,f"Editing software: {decoded.get('Software','')}"
+    elif sw: s,n=-0.1,f"Software: {decoded.get('Software','')}"
+    else: s,n=0.1,"No software tag"
+    return {"test":"Software Detection","score":s,"note":n}
+
+def d03_ela(img, quality=90):
+    buf=io.BytesIO(); img_rgb=img.convert("RGB"); img_rgb.save(buf,"JPEG",quality=quality); buf.seek(0)
+    resaved=Image.open(buf).convert("RGB"); ela=ImageChops.difference(img_rgb,resaved)
+    ext=ela.getextrema(); mx=max(e[1] for e in ext) or 1
+    ela_vis=ImageEnhance.Brightness(ela).enhance(255.0/mx)
+    ea=np.array(ela).astype(float); bs=32; bm=[]
+    h,w,_=ea.shape
+    for i in range(0,h-bs,bs):
+        for j in range(0,w-bs,bs): bm.append(float(np.mean(ea[i:i+bs,j:j+bs])))
+    bm=np.array(bm); bstd=float(np.std(bm)); br=float(np.max(bm)-np.min(bm))
+    if bstd>8 and br>30: s,n=0.6,f"High ELA variance (σ={bstd:.1f}) — manipulation"
+    elif bstd>4: s,n=0.3,f"Moderate ELA (σ={bstd:.1f})"
+    elif float(np.std(ea))<1: s,n=0.2,"Uniform ELA — AI"
+    else: s,n=-0.2,f"Consistent ELA (σ={bstd:.1f})"
+    return {"test":"Error Level Analysis","block_std":round(bstd,3),"score":s,"note":n,"ela_image":ela_vis}
+
+def d04_ai_metadata(img):
+    info=img.info or {}; traces=[]
+    markers=["stable diffusion","comfyui","automatic1111","midjourney","dall-e","novelai","parameters","prompt","negative_prompt","steps","sampler","cfg_scale","flux","sd_model"]
+    for k in info:
+        ks=str(k).lower(); vs=str(info[k])[:500].lower()
+        if any(m in ks or m in vs for m in markers): traces.append(f"{k}: {str(info[k])[:80]}")
+    xmp=str(info.get("XML:com.adobe.xmp","") or info.get("xmp",""))
+    if "generativeAI" in xmp or "ai:" in xmp.lower(): traces.append("XMP AI markers")
+    if "c2pa" in xmp.lower(): traces.append("C2PA Content Credentials")
+    if traces: s,n=0.8,f"AI traces: {'; '.join(traces[:3])}"
+    else: s,n=0.0,"No AI metadata"
+    return {"test":"AI Metadata Traces","traces":traces,"score":s,"note":n}
+
+def d05_thumbnail(img):
+    try: exif=img._getexif() or {}
+    except: exif={}
+    has_thumb=513 in exif or 514 in exif
+    if has_thumb: s,n=-0.1,"Thumbnail present — camera"
+    else: s,n=0.0,"No thumbnail"
+    return {"test":"Thumbnail Check","has_thumbnail":has_thumb,"score":s,"note":n}
+
+def d06_watermark(img):
+    gray=_g(img); fft=np.fft.fftshift(np.fft.fft2(gray)); mag=np.log(np.abs(fft)+1)
+    h,w=mag.shape; cy,cx=h//2,w//2; mc=mag.copy(); mc[cy-3:cy+3,cx-3:cx+3]=0
+    lm=maximum_filter(mc,10); peaks=(mc==lm)&(mc>np.percentile(mc,99.5))
+    np_=int(np.sum(peaks))
+    if np_>20: s,n=0.2,f"Frequency peaks ({np_}) — watermark?"
+    else: s,n=0.0,f"No watermark ({np_} peaks)"
+    return {"test":"Watermark Detection","peaks":np_,"score":s,"note":n}
+
+def d07_compression_ghost(img):
+    gray=_g(img); h,w=gray.shape; hc,wc=(h//8)*8,(w//8)*8; gray=gray[:hc,:wc]
+    bd,it=[],[]
+    for i in range(1,hc):
+        rd=np.abs(gray[i,:]-gray[i-1,:])
+        if i%8==0: bd.extend(rd.tolist())
+        else: it.extend(rd.tolist())
+    bk=float(np.mean(bd))/(float(np.mean(it))+1e-9) if it else 1
+    if bk>1.5: s,n=0.3,f"Double JPEG (blockiness={bk:.3f})"
+    elif bk>1.2: s,n=-0.1,f"JPEG blocks ({bk:.3f})"
+    elif bk<1.02: s,n=0.1,f"No blocks ({bk:.3f})"
+    else: s,n=0.0,f"Blockiness={bk:.3f}"
+    return {"test":"Compression Ghosts","blockiness":round(bk,4),"score":s,"note":n}
+
+def d08_icc_profile(img):
+    icc=img.info.get("icc_profile",None)
+    if icc:
+        size=len(icc)
+        if size>100: s,n=-0.2,f"ICC profile ({size}B) — camera/editor"
+        else: s,n=0.0,f"Small ICC ({size}B)"
+    else: s,n=0.1,"No ICC profile"
+    return {"test":"ICC Color Profile","has_icc":icc is not None,"score":s,"note":n}
+
+def d09_color_space(img):
+    mode=img.mode
+    try: exif=img._getexif() or {}
+    except: exif={}
+    cs=str(exif.get(40961,""))  # ColorSpace tag
+    if cs=="1": s,n=-0.1,"sRGB color space — standard"
+    elif cs=="65535": s,n=-0.1,"Uncalibrated (wide gamut)"
+    elif mode=="CMYK": s,n=-0.2,"CMYK — professional source"
+    else: s,n=0.0,f"Color mode={mode}"
+    return {"test":"Color Space","mode":mode,"score":s,"note":n}
+
+def d10_gps_plausibility(img):
+    try: exif=img._getexif() or {}
+    except: exif={}
+    gps=exif.get(34853)
+    if not gps: return {"test":"GPS Plausibility","score":0.0,"note":"No GPS data"}
     try:
-        exif_data = img._getexif() or {}
-    except Exception:
-        exif_data = {}
-
-    decoded = {}
-    for tag_id, value in exif_data.items():
-        tag = TAGS.get(tag_id, str(tag_id))
+        # Check if GPS coordinates are physically possible
+        lat_ref=gps.get(1,"N"); lon_ref=gps.get(3,"E")
+        lat=gps.get(2,(0,0,0)); lon=gps.get(4,(0,0,0))
+        # Simple validation: lat ∈ [-90,90], lon ∈ [-180,180]
+        s,n=-0.2,f"GPS present ({lat_ref}, {lon_ref})"
+    except: s,n=0.0,"GPS parse error"
+    return {"test":"GPS Plausibility","score":s,"note":n}
+
+def d11_maker_note(img):
+    try: exif=img._getexif() or {}
+    except: exif={}
+    mn=exif.get(37500)  # MakerNote tag
+    if mn:
+        size=len(mn) if isinstance(mn,bytes) else len(str(mn))
+        if size>100: s,n=-0.3,f"MakerNote ({size}B) — camera firmware"
+        else: s,n=-0.1,f"Small MakerNote ({size}B)"
+    else: s,n=0.1,"No MakerNote"
+    return {"test":"Maker Note","score":s,"note":n}
+
+def d12_file_structure(img):
+    fmt=img.format or "unknown"; w,h=img.size
+    mp=w*h/1e6
+    standard_mp=[0.3,0.8,1,2,3,4,5,8,10,12,16,20,24,36,45,50,61,100,108,150,200]
+    closest=min(standard_mp,key=lambda x:abs(mp-x)); diff=abs(mp-closest)/closest if closest>0 else 1
+    if diff<0.05: s,n=-0.1,f"Standard resolution ({mp:.1f}MP ≈ {closest}MP)"
+    elif diff>0.3: s,n=0.1,f"Non-standard resolution ({mp:.1f}MP)"
+    else: s,n=0.0,f"{mp:.1f}MP, format={fmt}"
+    return {"test":"File Structure","format":fmt,"megapixels":round(mp,2),"score":s,"note":n}
+
+ALL_TESTS=[d01_exif_completeness,d02_software_check,d03_ela,d04_ai_metadata,d05_thumbnail,
+           d06_watermark,d07_compression_ghost,d08_icc_profile,d09_color_space,
+           d10_gps_plausibility,d11_maker_note,d12_file_structure]
+
+def run_metadata_agent(img):
+    findings,scores=[],[]
+    ela_img=None
+    for fn in ALL_TESTS:
         try:
-            decoded[tag] = str(value)[:200]
-        except Exception:
-            decoded[tag] = "<binary>"
-
-    suspicious_flags = []
-    authenticity_markers = []
-
-    # Camera info
-    has_make = "Make" in decoded
-    has_model = "Model" in decoded
-    has_lens = "LensModel" in decoded or "LensInfo" in decoded
-    has_focal = "FocalLength" in decoded
-    has_exposure = "ExposureTime" in decoded
-    has_iso = "ISOSpeedRatings" in decoded
-    has_aperture = "FNumber" in decoded
-    has_datetime = "DateTime" in decoded or "DateTimeOriginal" in decoded
-    has_gps = "GPSInfo" in decoded
-    has_software = "Software" in decoded
-
-    camera_fields = sum([has_make, has_model, has_lens, has_focal,
-                         has_exposure, has_iso, has_aperture])
-
-    if camera_fields == 0:
-        suspicious_flags.append("No camera metadata (stripped or AI-generated)")
-    elif camera_fields >= 4:
-        authenticity_markers.append(f"Rich camera metadata ({camera_fields}/7 fields)")
-
-    if not decoded:
-        suspicious_flags.append("Completely empty EXIF (strong AI indicator)")
-
-    if has_software:
-        sw = decoded.get("Software", "").lower()
-        ai_keywords = ["stable diffusion", "midjourney", "dall-e", "comfyui",
-                        "automatic1111", "invoke", "flux", "sd", "novelai"]
-        edit_keywords = ["photoshop", "gimp", "lightroom", "capture one"]
-        if any(k in sw for k in ai_keywords):
-            suspicious_flags.append(f"AI generation software: {decoded['Software']}")
-        elif any(k in sw for k in edit_keywords):
-            suspicious_flags.append(f"Editing software detected: {decoded['Software']}")
-        else:
-            authenticity_markers.append(f"Software: {decoded['Software']}")
-
-    if has_datetime:
-        authenticity_markers.append("Timestamp present")
-
-    if has_gps:
-        authenticity_markers.append("GPS coordinates present (strong authenticity marker)")
-
-    # Physical plausibility checks
-    if has_focal and has_aperture:
-        try:
-            focal = float(str(decoded.get("FocalLength", "0")).split("/")[0])
-            fnumber = float(str(decoded.get("FNumber", "0")).split("/")[0])
-            if focal > 0 and fnumber > 0:
-                # Check if aperture is physically possible for focal length
-                if fnumber < 0.7 or fnumber > 64:
-                    suspicious_flags.append(f"Impossible aperture: f/{fnumber}")
-                else:
-                    authenticity_markers.append(f"Plausible optics: {focal}mm f/{fnumber}")
-        except Exception:
-            pass
-
-    # Score
-    n_suspicious = len(suspicious_flags)
-    n_authentic = len(authenticity_markers)
-
-    if n_suspicious == 0 and n_authentic >= 3:
-        score = -0.5
-        note = "Rich, plausible EXIF metadata (strong authenticity)"
-    elif n_suspicious >= 2 or (not decoded):
-        score = 0.5
-        note = "Missing or suspicious metadata"
-    elif n_suspicious == 1:
-        score = 0.2
-        note = "Minor metadata concern"
-    else:
-        score = -0.1
-        note = "Partial metadata present"
-
-    return {
-        "test": "EXIF Validation",
-        "total_fields": len(decoded),
-        "camera_fields": camera_fields,
-        "suspicious_flags": suspicious_flags,
-        "authenticity_markers": authenticity_markers,
-        "exif_data": decoded,
-        "score": score,
-        "note": note,
-    }
-
-
-# ─── Error Level Analysis (ELA) ─────────────────────────────────────
-def analyze_ela(img: Image.Image, quality: int = 90) -> Dict[str, Any]:
-    """
-    Re-save at known JPEG quality and compute pixel-level differences.
-    Manipulated regions show different error levels than unmodified areas.
-    Also detects double JPEG compression.
-    """
-    # Resave at target quality
-    buf = io.BytesIO()
-    img_rgb = img.convert("RGB")
-    img_rgb.save(buf, "JPEG", quality=quality)
-    buf.seek(0)
-    resaved = Image.open(buf).convert("RGB")
-
-    # Pixel difference
-    ela_img = ImageChops.difference(img_rgb, resaved)
-
-    # Scale for visibility
-    extrema = ela_img.getextrema()
-    max_diff = max([e[1] for e in extrema]) or 1
-    scale = 255.0 / max_diff
-    ela_visible = ImageEnhance.Brightness(ela_img).enhance(scale)
-
-    ela_arr = np.array(ela_img).astype(np.float64)
-
-    # Global statistics
-    global_mean = float(np.mean(ela_arr))
-    global_std = float(np.std(ela_arr))
-
-    # Block-level analysis (detect inconsistent compression)
-    block_means = []
-    h, w, _ = ela_arr.shape
-    bs = 32
-    for i in range(0, h - bs, bs):
-        for j in range(0, w - bs, bs):
-            block = ela_arr[i:i + bs, j:j + bs, :]
-            block_means.append(float(np.mean(block)))
-
-    block_means = np.array(block_means)
-    block_std = float(np.std(block_means))
-    block_range = float(np.max(block_means) - np.min(block_means))
-
-    # High block variance = inconsistent compression = manipulation
-    if block_std > 8.0 and block_range > 30:
-        score = 0.6
-        note = f"High ELA variance (σ={block_std:.1f}, range={block_range:.1f}) — manipulation regions detected"
-    elif block_std > 4.0:
-        score = 0.3
-        note = f"Moderate ELA variance (σ={block_std:.1f}) — possible manipulation"
-    elif global_std < 1.0:
-        score = 0.2
-        note = "Unusually uniform ELA (possible AI generation with no JPEG history)"
-    else:
-        score = -0.2
-        note = f"Consistent ELA levels (σ={block_std:.1f}, natural compression)"
-
-    return {
-        "test": "Error Level Analysis",
-        "global_mean": round(global_mean, 4),
-        "global_std": round(global_std, 4),
-        "block_std": round(block_std, 4),
-        "block_range": round(block_range, 4),
-        "score": score,
-        "note": note,
-        "ela_image": ela_visible,
-    }
-
-
-# ─── AI Metadata Traces ────────────���────────────────────────────────
-def analyze_ai_metadata(img: Image.Image) -> Dict[str, Any]:
-    """
-    Check for AI generation markers in XMP, IPTC, and other metadata.
-    C2PA, Content Credentials, and generator watermarks.
-    """
-    info = img.info or {}
-    suspicious_flags = []
-    found_traces = []
-
-    # Check PNG text chunks
-    for key in info:
-        key_lower = str(key).lower()
-        val = str(info[key])[:500]
-
-        ai_markers = ["stable diffusion", "comfyui", "automatic1111",
-                       "midjourney", "dall-e", "novelai", "invoke",
-                       "parameters", "prompt", "negative_prompt",
-                       "steps", "sampler", "cfg_scale", "model",
-                       "flux", "sd_model", "clip_skip"]
-
-        if any(m in key_lower or m in val.lower() for m in ai_markers):
-            found_traces.append(f"{key}: {val[:100]}")
-
-    # Check for XMP data
-    xmp_data = info.get("XML:com.adobe.xmp", "") or info.get("xmp", "")
-    if isinstance(xmp_data, bytes):
-        xmp_data = xmp_data.decode("utf-8", errors="ignore")
-
-    if "ai:" in xmp_data.lower() or "generativeAI" in xmp_data:
-        found_traces.append("XMP contains AI generation markers")
-
-    if "c2pa" in xmp_data.lower() or "contentcredentials" in xmp_data.lower():
-        found_traces.append("Content Credentials (C2PA) detected")
-
-    if found_traces:
-        score = 0.8
-        note = f"AI generation metadata found: {'; '.join(found_traces[:3])}"
-    else:
-        score = 0.0
-        note = "No AI metadata traces detected"
-
-    return {
-        "test": "AI Metadata Traces",
-        "traces_found": found_traces,
-        "info_keys": list(str(k) for k in info.keys())[:20],
-        "score": score,
-        "note": note,
-    }
-
-
-# ─── Thumbnail Consistency ───────────────────────────────────────────
-def analyze_thumbnail_consistency(img: Image.Image) -> Dict[str, Any]:
-    """
-    JPEG files often embed a thumbnail. If the main image was manipulated
-    but the thumbnail wasn't updated, they'll differ.
-    """
-    try:
-        exif_data = img._getexif() or {}
-    except Exception:
-        exif_data = {}
-
-    # Check for embedded thumbnail
-    has_thumbnail = False
-    try:
-        if hasattr(img, 'applist'):
-            for app in img.applist:
-                if b'thumbnail' in app[1].lower() if isinstance(app[1], bytes) else False:
-                    has_thumbnail = True
-    except Exception:
-        pass
-
-    # Check EXIF thumbnail tag (tag 513 = JPEGInterchangeFormat)
-    if 513 in exif_data or 514 in exif_data:
-        has_thumbnail = True
-
-    if not has_thumbnail:
-        return {
-            "test": "Thumbnail Consistency",
-            "score": 0.0,
-            "note": "No embedded thumbnail found for comparison",
-        }
-
-    return {
-        "test": "Thumbnail Consistency",
-        "has_thumbnail": True,
-        "score": -0.1,
-        "note": "Embedded thumbnail present (consistent with real camera output)",
-    }
-
-
-# ─── Watermark Detection ────────────────────────────────────────────
-def analyze_watermarks(img: Image.Image) -> Dict[str, Any]:
-    """
-    Detect invisible watermarks (frequency domain) and visible watermarks.
-    Some AI generators embed identifying watermarks.
-    """
-    gray = np.array(img.convert("L")).astype(np.float64)
-
-    # Check for periodic watermark patterns in FFT
-    fft = np.fft.fft2(gray)
-    fft_shift = np.fft.fftshift(fft)
-    magnitude = np.log(np.abs(fft_shift) + 1)
-
-    h, w = magnitude.shape
-    cy, cx = h // 2, w // 2
-
-    # Remove DC component and check for suspicious isolated peaks
-    magnitude_clean = magnitude.copy()
-    magnitude_clean[cy - 3:cy + 3, cx - 3:cx + 3] = 0
-
-    # Find isolated bright spots (potential watermark carriers)
-    from scipy.ndimage import maximum_filter
-    local_max = maximum_filter(magnitude_clean, size=10)
-    peaks = (magnitude_clean == local_max) & (magnitude_clean > np.percentile(magnitude_clean, 99.5))
-    n_isolated_peaks = int(np.sum(peaks))
-
-    # Check image info for C2PA / Content Credentials
-    info = img.info or {}
-    c2pa_found = False
-    for key in info:
-        key_str = str(key).lower()
-        val_str = str(info[key])[:500].lower()
-        if any(marker in key_str or marker in val_str
-               for marker in ["c2pa", "contentcredentials", "content_authenticity"]):
-            c2pa_found = True
-
-    if c2pa_found:
-        score = 0.0
-        note = "C2PA Content Credentials watermark detected (provenance tracking)"
-    elif n_isolated_peaks > 20:
-        score = 0.2
-        note = f"Suspicious frequency-domain peaks ({n_isolated_peaks}, possible embedded watermark)"
-    else:
-        score = 0.0
-        note = f"No watermark signatures detected ({n_isolated_peaks} peaks)"
-
-    return {
-        "test": "Watermark Detection",
-        "isolated_peaks": n_isolated_peaks,
-        "c2pa_found": c2pa_found,
-        "score": score,
-        "note": note,
-    }
-
-
-# ─── Compression Ghost Detection ────────────────────────────────────
-def analyze_compression_ghosts(img: Image.Image) -> Dict[str, Any]:
-    """
-    Double JPEG compression leaves 'ghosts' — periodic artifacts at
-    block boundaries that differ from single compression.
-    Detect by analyzing 8×8 block boundary discontinuities.
-    """
-    gray = np.array(img.convert("L")).astype(np.float64)
-    h, w = gray.shape
-    h_crop, w_crop = (h // 8) * 8, (w // 8) * 8
-    gray = gray[:h_crop, :w_crop]
-
-    # Measure discontinuity at 8×8 block boundaries
-    boundary_diffs = []
-    interior_diffs = []
-
-    for i in range(1, h_crop):
-        if i % 8 == 0:
-            # Block boundary row
-            boundary_diffs.extend(np.abs(gray[i, :] - gray[i - 1, :]).tolist())
-        else:
-            interior_diffs.extend(np.abs(gray[i, :] - gray[i - 1, :]).tolist())
-
-    for j in range(1, w_crop):
-        if j % 8 == 0:
-            boundary_diffs.extend(np.abs(gray[:, j] - gray[:, j - 1]).tolist())
-        else:
-            interior_diffs.extend(np.abs(gray[:, j] - gray[:, j - 1]).tolist())
-
-    if boundary_diffs and interior_diffs:
-        boundary_mean = float(np.mean(boundary_diffs))
-        interior_mean = float(np.mean(interior_diffs))
-        blockiness = boundary_mean / (interior_mean + 1e-9)
-    else:
-        blockiness = 1.0
-
-    # Blockiness > 1.2 suggests JPEG compression; > 1.5 suggests double compression
-    if blockiness > 1.5:
-        score = 0.3
-        note = f"Strong block boundary artifacts (blockiness={blockiness:.3f}, possible double JPEG)"
-    elif blockiness > 1.2:
-        score = -0.1
-        note = f"Normal JPEG blockiness ({blockiness:.3f})"
-    elif blockiness < 1.02:
-        score = 0.1
-        note = f"No block boundaries (blockiness={blockiness:.3f}, non-JPEG or AI)"
-    else:
-        score = 0.0
-        note = f"Mild blockiness ({blockiness:.3f})"
-
-    return {
-        "test": "Compression Ghost Detection",
-        "blockiness_ratio": round(blockiness, 4),
-        "score": score,
-        "note": note,
-    }
-
-
-# ─── Main Agent Entry Point ─────────────────────────────────────────
-def run_metadata_agent(img: Image.Image) -> AgentEvidence:
-    """Run all metadata analysis tests."""
-    findings = []
-    scores = []
-
-    for fn in [analyze_exif, analyze_ela, analyze_ai_metadata,
-               analyze_thumbnail_consistency, analyze_watermarks, analyze_compression_ghosts]:
-        try:
-            result = fn(img)
-            findings.append(result)
-            scores.append(result["score"])
-        except Exception as e:
-            findings.append({"test": fn.__name__, "error": str(e), "score": 0})
-
-    avg_score = float(np.mean(scores)) if scores else 0.0
-    confidence = min(1.0, 0.5 + 0.5 * abs(avg_score))
-
-    violations = [f["test"] for f in findings if f.get("score", 0) > 0.2]
-    compliant = [f["test"] for f in findings if f.get("score", 0) < -0.1]
-
-    if violations:
-        rationale = f"Metadata violations: {', '.join(violations)}."
-    elif compliant:
-        rationale = f"Metadata consistent: {', '.join(compliant)}."
-    else:
-        rationale = "Metadata analysis inconclusive."
-
-    for f in findings:
-        if f.get("note"):
-            rationale += f" [{f['test']}]: {f['note']}."
-
-    # Extract ELA image if available
-    ela_img = None
+            r=fn(img); findings.append(r); scores.append(r["score"])
+            if "ela_image" in r: ela_img=r.pop("ela_image")
+        except Exception as e: findings.append({"test":fn.__name__,"error":str(e),"score":0})
+    avg=float(np.mean(scores)) if scores else 0.0; conf=min(1.0,0.5+0.5*abs(avg))
+    viol=[f["test"] for f in findings if f.get("score",0)>0.2]
+    comp=[f["test"] for f in findings if f.get("score",0)<-0.1]
+    rat=f"Metadata violations: {', '.join(viol)}." if viol else f"Metadata consistent: {', '.join(comp)}." if comp else "Metadata inconclusive."
     for f in findings:
-        if "ela_image" in f:
-            ela_img = f["ela_image"]
-            del f["ela_image"]  # Don't include in serializable findings
-
-    return AgentEvidence(
-        agent_name="Metadata Agent",
-        violation_score=np.clip(avg_score, -1, 1),
-        confidence=confidence,
-        failure_prob=max(0.0, 1.0 - len(scores) / 6),
-        rationale=rationale,
-        sub_findings=findings,
-        visual_evidence=ela_img,
-    )
+        if f.get("note"): rat+=f" [{f['test']}]: {f['note']}."
+    return AgentEvidence("Metadata Agent",np.clip(avg,-1,1),conf,max(0,1-len(scores)/len(ALL_TESTS)),rat,findings,ela_img)