Code is private: the container fetches bundle 4020cf8439e2d6d7 from the private repo at start-up (public files e539f215a4cf7cd7)

Release: display score + provenance fix + heatmap spotlight + web bundle with policy pages (a-eye f1f73c2edcd4)

S6: weights load from the private repo (pinned revision + SHA-256, plain HTTPS); /api/version reports weights_source / weights_repo_reachable (a-eye e5781ef)

Deploy hardened backend: upload guards, provenance fix, CORS allowlist, camera fix, v6-ready, rebuilt webapp (a-eye f543fe4)