suggest() records a grade lower than the current disclosure

Problem/motivation

DisclosureRecorder::suggest() does not compare the proposed grade with the current one, while apply() and applyProfile() refuse a downgrade through wouldDowngrade(). On a test site, a media item disclosed as ai_deepfake got a pending ai_generated_autonomous suggestion from Content Credentials. IPTC trainedAlgorithmicMedia maps to both grades, so a C2PA reader cannot tell them apart.

The AI Act puts this outside what a reader can decide. A deep fake depends on what the content shows: AI-generated or manipulated media "that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful" (Art. 3(60) of Regulation (EU) 2024/1689). The deployer "shall disclose that the content has been artificially generated or manipulated" (Art. 50(4)). Provenance metadata records the generator and says nothing about resemblance. Accepting the suggested grade would drop a label that Art. 50(4) requires.

docs/media/images.md and docs/usage/suggestions.md say the reader "proposes the same grade", which a deep fake does not get.

Steps to reproduce

  1. Disclose a media item as ai_deepfake.
  2. Call suggest() on it with ai_generated_autonomous, as Content Credentials does after reading a C2PA manifest.
  3. The suggestions page lists a pending downgrade.

Proposed resolution

suggest() records nothing for a grade strictly less severe than the current one, the same rule apply() follows. Equal severity still goes through, as in #102 (closed). The two doc passages say what a deep fake gets back.

Remaining tasks

  • Review of the merge request.
  • Follow-up, outside this fix: the ai_deepfake description reads "Synthetic media of events that never happened", while Art. 3(60) also covers persons, objects, places and entities. Only the wording would change.

API changes

DisclosureRecorder::suggest() keeps its signature. For a grade strictly less severe than the current one it now returns without recording. Content Credentials calls it from CredentialSuggester: a downgrade from the reader is dropped quietly, and an upgrade or an equal grade still arrives, so its code does not change. @Maurice1969, a heads-up in case you rely on that suggestion appearing.

cc @Marcus_Johansson, since the grades come from the original plan.

AI Compliance

🤖 Generated with the help of an LLM, reviewed and approved by me before posting.