Prompt injection in nitroglycerine NG Nobel-Meissner continuous production nitration temperature mixed acid ratio wash pH AI

Three adversarial injection surfaces in nitroglycerine NG Nobel-Meissner production AI

1. Nitration reactor temperature display AI (Yokogawa EJA110A CSTR coolant temperature SCADA display AI / Emerson Rosemount 644 RTD nitration reactor bulk temperature display AI / ABB TTF300 thermocouple transmitter nitration CSTR temperature SCADA display AI / Endress+Hauser iTEMP TMT82 nitration reactor jacket coolant inlet/outlet temperature display AI / Honeywell STT170 Nobel-Meissner reactor temperature display AI — rendered SCADA nitration reactor temperature display AI classifying the reactor bulk temperature against design range 8–15°C with high alarm at 18°C, high-high alarm at 22°C “automatic reactor dump”, and low alarm at 5°C “glycerin feed freeze risk” — 87th upward attack; FIRST nitroglycerine attack; FIRST Nobel-Meissner process attack; FIRST explosive manufacturing AI attack; FIRST 10-lb PSM TQ attack)

The Nobel-Meissner continuous nitration reactor operates at 8–15°C by design — a temperature range chosen to balance three competing constraints: (1) nitration reaction rate (higher temperature favours faster NO₂⁺ electrophilic addition to glycerin -OH groups; at 8°C the reaction rate is sufficient for complete glycerin trinitration within the 2–4 minute CSTR residence time at the design mixed acid composition); (2) NG stability (NG thermal stability is strongly temperature-dependent; above 20°C, the first-order decomposition rate becomes operationally significant; the Arrhenius parameters for NG thermal decomposition: A = 10¹¹ s⁻¹; E A ≈ 150 kJ/mol; at 20°C rate constant k ≈ 1×10⁻⁹ s⁻¹; at 35°C k ≈ 8×10⁻⁹ s⁻¹ — 8× faster; at 50°C k ≈ 2×10⁻₇ s⁻¹ — rapid decomposition; note: these rate constants mean the “8°C-per-doubling” rule-of-thumb for NG decomposition rate above 20°C is well-established in explosive safety literature — see Cooper & Kurowski, Introduction to the Technology of Explosives, 1996); (3) phase separation (NG and spent acid form a two-phase liquid system at 8–15°C NG: NG density 1.593 g/mL; spent acid density ≈ 1.7–1.8 g/mL for 20 wt% HNO₂ + 65 wt% H₂SO₄ + 15 wt% H₂O spent acid; density difference sufficient for gravity separation in the Nobel-Meissner separator; at T > 40°C, the NG viscosity decreases and the phase separation is accelerated but the decomposition risk increases). The thermal runaway potential of the Nobel-Meissner reactor is the primary process safety concern: the reaction is strongly exothermic (ΔH rxn = −480 kJ/mol NG formed); at a 20 kg/hr NG production rate (MW 227.09 g/mol = 88 mol/hr), heat generation rate = 88 × 480 = 42,240 kJ/hr = 11.7 kW. The cooling system must remove 11.7 kW continuously (chilled water at 2–5°C; nominal design cooling capacity 15–20 kW; safety margin 3–8 kW above heat generation rate). If the cooling water flow decreases (control valve moves from 72% to 45% open in response to AI command), the cooling capacity drops below the heat generation rate: at 45% cooling water flow, cooling capacity = 45/72 × 17.5 kW = 10.9 kW; net heat accumulation = 11.7 − 10.9 = 0.8 kW = 800 J/s in the CSTR (typical CSTR volume 2 L for 20 kg/hr production; NG-acid mixture mass ≈ 3.5 kg; Cp mixture ≈ 1.8 kJ/(kg·°C)); temperature rise rate = 800 / (3,500 × 1.8) = 0.13°C/s = 7.7°C/min. From initial temperature 8°C: reactor reaches 20°C (NG decomposition onset) in (20−8)/7.7 = 1.6 minutes; reaches 35°C in 3.5 minutes. At 35°C, NG decomposition rate (k ≈ 8×10⁻⁹ s⁻¹) is still slow on absolute scale but the autocatalytic decomposition cascade begins: NG → decomposition intermediates including nitrogen dioxide (NO₂) and 2-nitroglycerol (one OH group only partially nitrated product); NO₂ is a potent acid and can further nitrate glycerin intermediates and also react with NG itself (autocatalytic nitration by NO₂: NG + NO₂ → NO₂⁻ + decomposition radical chain); this autocatalytic pathway is the origin of the “red oil” phenomenon: red oil is a dark reddish-brown mixture of decomposition products (2-nitroglycerol, 1-nitroglycerol, nitrous acid HNO₂, nitrogen oxides NO⁺, and glycerol decomposition products including glyoxal and formaldehyde) formed when NG decomposes above ≈25–30°C. Red oil presence in the nitration reactor is an emergency indicator: red oil is more shock-sensitive than NG itself (red oil ESD minimum initiating energy approximately 0.05 J; compared to clean NG 0.45 J) and is also thermally unstable (red oil ΔH decomp ≈ −8,000 kJ/kg — more energetic per kg than NG itself because the decomposition intermediates retain organic energy and are already partially oxidised). The Nobel-Meissner reactor is equipped with an automatic dump system: when the high-high alarm at 22°C is triggered, all reactor contents are dumped to a “drowning vat” (large vessel containing excess water and Na₂CO₂; dilution causes rapid NG decomposition below explosive concentration; detonation risk eliminated in the diluted aqueous phase). The dump system is the last line of defence before potential deflagration-to-detonation transition (DDT) in the confined reactor vessel.

The adversarial upward pixel attack shifts the nitration reactor temperature display from 22°C (actual; the high-high alarm threshold; the automatic dump system should have already actuated; NG in the reactor is at the decomposition onset boundary; red oil may be forming; the AI should be commanding maximum cooling water and preparing for emergency dump) to 5°C (displayed; below the low alarm at 5°C “glycerin feed freeze risk”; AI classification: “nitration reactor temperature 5.0°C; below low alarm 5°C; glycerin feed at risk of freezing (glycerin melting point 17.8°C; glycerin solidifies below 17.8°C, though process glycerin is typically glycerin-water mixture with lower freezing point); reduce cooling water flow by 40% to warm reactor to design range 8–15°C; increase glycerin feed line heat trace to prevent freeze”). The DCS response: cooling water control valve closes from 72% to 43% open; glycerin feed heat trace power increases to 100%. At 43% cooling water: cooling capacity drops to 10.5 kW; net heat surplus = 11.7 − 10.5 = 1.2 kW; temperature rise rate = 1.2 / (3,500 × 1.8 / 1,000) = 0.19°C/s = 11.4°C/min. Reactor temperature progression: 22°C (actual at attack initiation) → 30°C (2.4 min after attack; NG decomposition rate 3× higher than at 20°C) → 35°C (3.8 min; red oil onset; autocatalytic heat generation begins: 88 mol NG/hr × 0.001 mol/mol decomposed × 6,200 kJ/kg NG decomposing × 227 g/mol / 1,000 = additional 0.12 kW from decomposition heat at 0.1% NG decomposition) → 45°C (5.2 min; red oil clearly visible by colour change if operator could see reactor; total heat generation now 11.7 + 0.8 (decomposition) = 12.5 kW; cooling still insufficient); at 50°C (6.5 min): NG decomposition rate is ≈10⁻₇ s⁻¹; thermal runaway condition if cooling cannot be restored. The OSHA PSM TQ for NG is 10 lbs (4.5 kg); the reactor at 20 kg/hr production holds approximately 0.6 kg NG in-process at 2-minute residence time: 0.6 kg = 1.3 lbs — below the PSM TQ in the reactor itself, but the downstream separator and wash vessels together typically hold 15–40 kg NG = 33–88 lbs — 3–9× PSM TQ. This is the 87th upward attack — FIRST nitroglycerine attack; FIRST Nobel-Meissner process attack; FIRST explosive manufacturing AI attack; FIRST 10-lb PSM TQ attack. The Glyphward threshold of 55 for Nobel-Meissner NG production AI is the highest in the upward attack series because the consequence — detonation — is irreversible, has no partial consequence state (detonation either occurs or does not; there is no “near-miss detonation” equivalent to a “near-miss process upset”), and the physics of DDT (deflagration-to-detonation transition) in a confined reactor vessel can occur in milliseconds once the thermal runaway is established, far faster than any manual intervention or PLC-triggered safety response after the AI has erroneously reduced cooling. Free tier — 10 scans/day, no card required.

2. Mixed acid HNO₂ concentration display AI (Yokogawa TDLS710 tunable diode laser HNO₂ concentration mixed acid SCADA display AI / Endress+Hauser Liquiline CM442 mixed acid density/HNO₂ concentration display AI / ABB AWT440 HNO₂ concentration inline mixed acid SCADA display AI / Emerson Rosemount 5081 mixed acid refractometer HNO₂ wt% display AI / Honeywell Analytical AT500 mixed acid HNO₂ concentration SCADA display AI — rendered SCADA mixed acid HNO₂ concentration display AI classifying the mixed acid HNO₂ content against design range 55–62 wt% with low alarm at 52 wt% “under-nitration risk” and high alarm at 65 wt% “excessive nitrating power; phase separator overload risk”)

The mixed acid composition for Nobel-Meissner NG nitration is formulated to deliver a specific Hammett acidity function H₀ that ensures complete glycerin trinitration within the 2–4 minute CSTR residence time while maintaining the reactor temperature within the design 8–15°C range. The nitrating power of the mixed acid is predominantly determined by the HNO₂ concentration and the dehydrating power of H₂SO₄ — H₂SO₄ protonates HNO₂ to form the nitronium ion NO₂⁺ (pK a of HNO₂ in 30–35 wt% H₂SO₄ medium: effectively fully converted to NO₂⁺; NO₂⁺ concentration proportional to HNO₂ loading); the mixed acid water content (the “spent acid factor”) determines how much water can be absorbed before the acid becomes too dilute to maintain NO₂⁺ concentration. Design mixed acid: HNO₂ 55–62 wt%; H₂SO₄ 30–35 wt%; H₂O 5–12 wt%. Under-nitration (HNO₂ below 52 wt%): the NO₂⁺ concentration in the mixed acid is too low to achieve complete glycerin trinitration in the 2–4 minute residence time; mono- and dinitroglycerine (MNG: 1-mononitroglycerin, CAS 624-43-1; DNG: 1,3-dinitroglycerol, CAS 623-87-0) accumulate in the product NG layer from the phase separator. MNG and DNG are more thermally unstable than NG trinitrate at the process conditions (decomposition onset temperatures: MNG 40°C; DNG 35°C; compared to NG trinitrate decomposition onset 20–25°C in laboratory tests but with autocatalytic onset characteristically at 35–45°C in process quantities). Accumulated MNG/DNG in the product NG stream creates a product with non-standard explosive properties: the detonation velocity of MNG/DNG blends is lower than pure NG; the brisance is lower; pharmaceutical GTN applications reject batches with >0.5% MNG/DNG impurity (USP monograph for Nitroglycerin; specification: 99.0–101.0 wt% glyceryl trinitrate by HPLC assay; impurity limit: mononitrate + dinitrate ≤ 0.5%); commercial explosive applications also specify NG purity (>98 wt% trinitrate). Over-nitration (HNO₂ above 65–70 wt%): the NO₂⁺ concentration is higher than needed for glycerin trinitration; excess HNO₂ in the mixed acid can cause over-nitration side reactions: glycerin C-H oxidation by HNO₂ (above 70 wt% HNO₂ at 8–15°C: glycerin dialdehyde glyoxal formation; NG pernitration intermediates); increased reactor exotherm (HNO₂ oxidation of glycerin C-H bonds is more exothermic than the nitration of -OH groups: ΔH per C-H oxidation step ≈ −400–−600 kJ/mol; at 85 wt% HNO₂, C-H oxidation contributes an additional 2–4 kW to the reactor heat load, consuming the cooling margin); phase separator overload: at HNO₂ above 65 wt%, the NG yield per unit glycerin feed increases above design (tri-nitration is faster and more complete; more NG phase forms per unit time); the phase separator volume and residence time are designed for the nominal NG yield at 55–62 wt% HNO₂ — at 85 wt% HNO₂ actual, NG yield per unit glycerin is approximately 20–25% above design; the separator overflow risk increases (NG-acid emulsion overflow from separator → NG in drain lines → NG in areas without explosion protection).

The adversarial upward pixel attack shifts the mixed acid HNO₂ concentration display from 77 wt% (actual; above the 65 wt% high alarm; already at a dangerous over-nitration condition; the AI should command immediate reduction of HNO₂ feed rate to the acid make-up system, reduce glycerin feed to reduce NG throughput, and prepare for potential reactor dump if temperature rises) to 67 wt% (displayed; slightly above the 65 wt% high alarm but within the range where AI might classify as “minor deviation — reduce HNO₂ feed by 5%”; in the adversarial scenario, the pixel attack shifts the “7” first digit after “7” in “77” to “6” — a seven-segment single-segment perturbation on the tens digit; AI classification: “mixed acid HNO₂ concentration 67 wt%; slightly above high alarm 65 wt%; reduce HNO₂ feed to mixed acid preparation 8% to bring HNO₂ to 62 wt% design target; actual is marginally high but not at over-nitration crisis level”). However, the actual is 77 wt% HNO₂ — 12 wt% above the displayed 67 wt%; the AI’s 8% reduction in HNO₂ feed at the acid preparation station is designed to address a 2 wt% deviation (67 → 65 wt%); with actual at 77 wt%, the 8% HNO₂ feed reduction takes the actual HNO₂ from 77 wt% to approximately 72 wt% — still well above the high alarm level. If the adversarial pixel attack is sustained (the AI continues reading 67 wt% as actual rises toward 85 wt% from continued HNO₂ overfeed in the acid prep system due to a separate upstream flow control error that the adversarial display is masking), the AI’s commanded 8% HNO₂ reduction is insufficient to counteract the upstream overfeed; actual HNO₂ reaches 85 wt% while displayed shows approximately 73 wt% — still below the high alarm of 65 wt% in the displayed value interpretation (the AI sees 73 wt% as above 65 wt% high alarm; commands moderate corrective action; fails to recognise that actual 85 wt% requires emergency acid dilution or plant shutdown). At actual 85 wt% HNO₂: the reactor exotherm from C-H oxidation side reactions adds 3–4 kW to the cooling load (total heat generation 15–16 kW vs cooling capacity 17.5 kW; cooling margin now only 1.5–2.5 kW — significantly reduced from design 5–6 kW; any minor cooling disturbance creates net heat accumulation); NG yield per batch is 22–25% above design; phase separator residence time effective reduced 20%; risk of NG-acid emulsion overflow increases dramatically. Free tier — 10 scans/day, no card required.

3. Wash water pH display AI (Mettler-Toledo InPro 3253/SG pH sensor wash water inline SCADA display AI / Endress+Hauser Memosens CPS71D wash water pH display AI / Yokogawa PH202G wash water pH SCADA display AI / ABB TB565 wash water pH inline display AI / Honeywell Durafon HL4 wash water pH SCADA display AI — rendered SCADA wash water pH display AI classifying the NG wash water effluent pH against design range ≥8.5 (wash complete; residual acid neutralised) with low alarm at pH 8.0 “insufficient wash; additional wash cycle required” and low-low alarm at pH 7.0 “acid present; additional Na₂CO₂ wash required before NG transfer”)

After nitration in the CSTR and phase separation in the Nobel-Meissner separator, the crude NG contains dissolved residual mixed acid: approximately 0.5–2.0 wt% HNO₂ and H₂SO₄ (entrapped in the NG liquid phase as dissolved ionic species; HNO₂ has significant solubility in NG: approximately 1.5–3.0 g HNO₂/100 g NG at 10–15°C; H₂SO₄ has lower NG solubility but the spent acid droplets entrained in the NG phase contribute additional acid). The residual acid in crude NG is the primary long-term storage safety hazard of nitroglycerin: acid-catalysed NG decomposition (HNO₂ in NG provides an autocatalytic nitration and decomposition pathway: HNO₂ → NO₂⁺ + H₂O via self-ionisation in NG medium; NO₂⁺ → decomposes NG → nitrogen oxides → autocatalytic chain) lowers the onset temperature of NG thermal decomposition by approximately 8–12°C per 0.5 wt% residual HNO₂: clean NG onset 35–40°C (practical); NG with 0.8 wt% HNO₂ onset ≈ 22–28°C (approaching ambient temperature in tropical storage: EURENCO Bofors tropical sites; Orica Nobel Helidon QLD ambient summer temperature 40–45°C). More critically, residual acid in NG dramatically increases the friction and shock sensitivity: the mechanism is that HNO₂ lowers the initiation energy required for the first NG decomposition event that propagates as a detonation wave. This is expressed in the ESD (electrostatic discharge) sensitivity test (ASTM E2012 or UN Test 3b spark sensitivity): clean NG minimum initiating spark energy = 0.45 J (450 mJ); NG with 0.8 wt% HNO₂ minimum initiating spark energy = 0.03 J (30 mJ) — a 15× reduction in required initiating energy. The friction sensitivity analog (BAM friction apparatus; UN Test 3b; STANAG 4487): clean NG minimum initiating friction load = 120 N; acid-sensitised NG (0.8 wt% HNO₂) minimum initiating friction load = 8 N — a 15× reduction; 8 N friction is within the range of ordinary material handling (a 1 kg object on a 10° inclined metal surface generates approximately 1.5 N normal force; a boot stepping on spilled NG at an incline: 70 kg × sin(10°) = 12 N — exceeding the acid-sensitised NG friction initiation threshold). The wash process removes residual acid by contacting crude NG with wash water (typically 3–5 wash stages: first wash with water; second wash with 1–2 wt% Na₂CO₂ solution (sodium carbonate; pH 11.2 in solution; neutralises HNO₂: 2HNO₂ + Na₂CO₂ → 2NaNO₂ + H₂CO₂ → 2NaNO₂ + H₂O + CO₂↑); additional water washes to remove residual carbonate; final wash water pH ≥8.5 = specification). The pH of the final wash water effluent is the single process parameter that confirms the residual acid has been removed below the sensitisation threshold (specification: wash water effluent pH ≥8.5 at 20°C; residual HNO₂ in NG product <0.1 wt% at pH 8.5 effluent). The wash water pH is measured inline by Mettler-Toledo InPro 3253 pH sensors (glass electrode; Ag/AgCl reference; ±0.05 pH accuracy; response time <30 s for step change; calibrated daily with pH 7.00 and pH 9.18 buffer solutions) or Endress+Hauser Memosens CPS71D (digital Memosens protocol; pH accuracy ±0.1 pH; compensated for temperature variation 5–40°C). The rendered pH meter display image (pH value on SCADA HMI screen; Yokogawa CENTUM VP historian display; typically 4–digit pH reading with decimal: “8.82” or “4.23”) is the input to the wash water pH display AI.

The adversarial upward pixel attack shifts the wash water pH display from 4.2 (actual; strongly acidic; wash is severely incomplete; residual HNO₂ in the NG product is approximately 0.8–1.2 wt%; the AI should command additional wash cycles — at least 3 additional Na₂CO₂ washes and 2 water washes before re-checking pH; the NG should be on product hold; no transfer to absorbing/packaging step) to 8.8 (displayed; above the ≥8.5 specification; AI classification: “wash water effluent pH 8.8; above specification ≥8.5; wash complete; residual acid at specification level; NG product cleared for transfer to absorbing or phlegmatising step”). The pixel perturbation shifts the “4” leading digit of “4.2” to “8” in the rendered seven-segment SCADA display (four pixel segments difference between “4” and “8” in seven-segment notation: “8” has all seven segments illuminated; “4” has four segments — three additional segments activated by the adversarial perturbation; within the pixel perturbation budget of adversarial examples in SCADA display AI evaluated on rendered screenshot images at typical SCADA rendering resolution 800×600 to 1920×1080; a 4-segment change across a 10–15 pixel character height is achievable with L∞ perturbation ε = 8/255 which is below the perceptual detection threshold for human operators reviewing SCADA screenshots). The consequence: NG with 0.8–1.2 wt% residual HNO₂ (pH 4.2 wash water effluent: approximately 0.1 N HNO₂ in the wash water, corresponding to approximately 0.8–1.2 wt% dissolved HNO₂ in the NG product at the wash step partition coefficient) is released from the wash step and transferred to the absorption step (where NG is absorbed into porous prilled ammonium nitrate for ANFO-gel, or mixed with diatomaceous earth for dynamite, or blended with ethylene glycol dinitrate (EGDN) for gelatine explosive). The acid-sensitised NG at 0.8 wt% HNO₂ has: ESD minimum initiating energy 30 mJ (vs 450 mJ clean NG); friction minimum initiating load 8 N (vs 120 N clean NG); shock pressure initiation threshold: acid-sensitised NG detonates at approximately 0.3 GPa shock input (vs 0.9 GPa for clean NG; determined by card gap test per STANAG 4491). In the absorbing step (where NG is pumped through metering nozzles into AN prills or diatomaceous earth: pump impeller friction; nozzle tip friction; spillage on floor with boot traffic), the normal-condition friction load from an operator boot on spilled NG (70 kg × sin(10°) = 12 N) exceeds the acid-sensitised NG friction initiation threshold (8 N) by 50% — a detonation initiation risk from routine operational contact. The normal-condition NG (clean; 120 N friction threshold) is not initiated by this same boot contact. The adversarial wash pH attack at surface 3 is the most insidious of the three Nobel-Meissner attack surfaces because: (a) no immediate symptom appears at the plant level (NG product looks, smells, and flows normally; the sensitisation is invisible without chemical assay); (b) the risk is realised at the absorbing/packaging step or later in transport; (c) the causal chain (SCADA pH display AI → falsified wash completion approval → acid-sensitised NG in product stream → friction detonation at absorbing nozzle) requires forensic accident investigation to establish, since the SCADA historian records the displayed pH 8.8 (not the actual 4.2), providing no contemporaneous alarm. Free tier — 10 scans/day, no card required.

Integration: nitroglycerine NG Nobel-Meissner production AI with Glyphward pre-scan gate

Glyphward integrates as a pre-scan gate at every rendered-image ingestion boundary in the Nobel-Meissner NG production AI pipeline — before the nitration reactor temperature AI processes rendered thermocouple SCADA display images, before the mixed acid HNO₂ concentration AI processes rendered inline analyser display images, and before the wash water pH AI processes rendered pH sensor display images. Threshold 55 for Nobel-Meissner NG production AI is the highest in the upward attack series, reflecting: OSHA PSM TQ 10 lbs (the absolute floor PSM TQ; the CSTR and downstream vessels collectively hold 33–88 lbs NG, 3–9× TQ, from the first minute of production); detonation consequence (irreversible, non-partial); the wash pH attack creates sensitised NG that departs the plant without any contemporaneous alarm record; Dyno Nobel Simsbury CT; Chemring Energetics Perry FL; Orica Nobel Helidon QLD; Nitro Nobel Gyttorp Sweden; EURENCO Bofors Karlskoga Sweden.

import asyncio, base64, hashlib
from datetime import datetime, timezone
from enum import StrEnum, auto
from typing import Any
import httpx

GLYPHWARD_API = "https://api.glyphward.com/v1/scan"
GLYPHWARD_KEY = "gw_prod_***"

# Nobel-Meissner NG production AI contexts: threshold 55
# OSHA PSM nitroglycerin TQ 10 lbs (29 CFR 1910.119 Appendix A).
# NG detonation velocity 7,700 m/s; TNT equivalency 1.48; dH_rxn -480 kJ/mol.
# 87th upward attack: 5C shown when 22C actual (nitration reactor temp)
# -> AI reduces cooling water -> actual rises to 35C
# -> red oil decomposition onset -> exothermic runaway -> DDT risk.
# Wash pH attack: pH 8.8 shown when pH 4.2 actual
# -> no additional wash -> 0.8 wt% HNO3 in NG product
# -> ESD sensitivity drops 0.45J -> 0.03J (15x increase in shock sensitivity).
NG_THRESHOLD = 55

class NGContext(StrEnum):
    NITRATION_REACTOR_TEMP  = auto()  # CSTR temp 8-15C design; >22C auto-dump (87th upward)
    MIXED_ACID_HNO3_CONC    = auto()  # HNO3 wt% in mixed acid 55-62 design; >65 overnitration
    WASH_WATER_PH           = auto()  # Final wash water pH >=8.5 spec; <7.0 acid sensitisation

async def scan_ng_frame(
    frame_b64: str,
    context: NGContext,
    plant_id: str,
    instrument_tag: str,
) -> dict[str, Any]:
    payload = {
        "image_b64": frame_b64,
        "context": context,
        "plant_id": plant_id,
        "instrument_tag": instrument_tag,
        "scan_ts": datetime.now(timezone.utc).isoformat(),
        "image_hash": hashlib.sha256(base64.b64decode(frame_b64)).hexdigest(),
    }
    async with httpx.AsyncClient(timeout=4.0) as client:
        r = await client.post(
            GLYPHWARD_API,
            json=payload,
            headers={"X-Glyphward-Key": GLYPHWARD_KEY},
        )
        r.raise_for_status()
        return r.json()

async def pre_scan_gate_ng(
    frame_b64: str,
    context: NGContext,
    plant_id: str,
    instrument_tag: str,
) -> None:
    result = await scan_ng_frame(frame_b64, context, plant_id, instrument_tag)
    if result["adversarial_score"] >= NG_THRESHOLD:
        raise AdversarialNGImageError(
            f"Adversarial injection detected in {context} (score {result['adversarial_score']}) "
            f"at plant {plant_id} instrument {instrument_tag}. "
            "Frame withheld from Nobel-Meissner NG production AI pipeline."
        )

class AdversarialNGImageError(RuntimeError):
    pass