Load the classifier from Devseis/devseis-ai-act-classifier-v6 (pinned) instead of the bundled copy

The model repo's download count now shows how many browsers ran the check. Pinned to 7c594f6; outputs checked identical to the bundled copy with transformers.js 3.0.0. Privacy page updated.

HANDBOOK.md

@@ -18,7 +18,7 @@ certificate. It is a **demo and marketing tool, not a compliance tool and not le
 ### On the Hugging Face Hub (organisation `Devseis`)
 | Repo | What it is | Licence |
 |---|---|---|
-| [`spaces/Devseis/Caveat`](https://huggingface.co/spaces/Devseis/Caveat) | The live page (static Space). Loads a runtime copy of the model from `models/devseis-ai-act-classifier-v6/`. | page CC BY 4.0; model folder CC BY-SA 4.0 |
+| [`spaces/Devseis/Caveat`](https://huggingface.co/spaces/Devseis/Caveat) | The live page (static Space). Loads the model from `Devseis/devseis-ai-act-classifier-v6` at commit `7c594f6` (`MODEL_REVISION`); the old copy in `models/` is no longer used. | page CC BY 4.0; model folder CC BY-SA 4.0 |
 | [`Devseis/devseis-ai-act-classifier-v6`](https://huggingface.co/Devseis/devseis-ai-act-classifier-v6) | **Current model**: weights, int8 ONNX, card, evaluation reports | **CC BY-SA 4.0** (required, see §5) |
 | [`datasets/Devseis/devseis-ai-act-classifier-v6-data`](https://huggingface.co/datasets/Devseis/devseis-ai-act-classifier-v6-data) | Current training/val/test data | CC BY 4.0 |
 | `Devseis/devseis-ai-act-classifier-v5` (+ `-v5-data`) | Previous version, removed 2026-10-12: its test rows are all in v6-data (`test_v6.csv`) and its change notes in `CHANGES_v5.md` there | — |

README.md

@@ -59,9 +59,11 @@ points there), so the page makes no third-party CDN requests.
   HTML/CSS/vanilla JS, no framework, no build step.
 - **Part 1 (fine-tuned classifier)**: runs **entirely in the visitor's
   browser**. No server call. Devseis AI Act Classifier v6 (fine-tuned from
-  `nlpaueb/legal-bert-small-uncased` on `data_v6_systems`) ships **inside this Space** at
-  `models/devseis-ai-act-classifier-v6/`. [`@huggingface/transformers`](https://github.com/huggingface/transformers.js)
-  3.0.0 loads it with `env.localModelPath = "./models/"` and `dtype: "q8"`,
+  `nlpaueb/legal-bert-small-uncased` on `data_v6_systems`) is loaded from its repo
+  [`Devseis/devseis-ai-act-classifier-v6`](https://huggingface.co/Devseis/devseis-ai-act-classifier-v6), pinned to
+  commit `7c594f6` (`MODEL_REVISION` in `index.html`), so the repo's download count shows how many browsers ran the
+  check (the browser caches the files after the first use). [`@huggingface/transformers`](https://github.com/huggingface/transformers.js)
+  3.0.0 loads it with `dtype: "q8"`,
   which fetches `onnx/model_quantized.onnx` (~36MB, int8), and runs it with WASM.
   The int8 file matches the PyTorch model on 98.6% of test rows under
   `onnxruntime-web`. The full model card is on the Hub, at `Devseis/devseis-ai-act-classifier-v6`.

index.html

@@ -693,10 +693,12 @@
   import { pipeline, env } from "./vendor/transformers-3.0.0/transformers.min.js";   // self-hosted, byte-identical to npm 3.0.0
   import { gpaiCheck } from "./gpai_rule.js";
 
-  // Part 1's model ships inside this Space (models/devseis-ai-act-classifier-v6/, a copy of Devseis/devseis-ai-act-classifier-v6), so nothing is fetched from another repo.
-  env.allowLocalModels = true;
-  env.allowRemoteModels = false;
-  env.localModelPath = "./models/";
+  // Part 1's model is loaded from its own repo, Devseis/devseis-ai-act-classifier-v6, pinned to a tested commit
+  // (MODEL_REVISION), and kept in the browser cache after the first use. Hugging Face counts that first download, so the
+  // repo's download count shows how many browsers ran the check. Outputs were checked identical to the copy this Space
+  // used to ship in models/ (8 test texts, transformers.js 3.0.0).
+  env.allowLocalModels = false;
+  env.allowRemoteModels = true;
   // The WebAssembly engine is self-hosted too (the library would otherwise fetch it from jsDelivr).
   env.backends.onnx.wasm.wasmPaths = new URL("./vendor/transformers-3.0.0/", location.href).href;
 
@@ -862,7 +864,8 @@
   const runBtn = $("runBtn"), runHint = $("runHint");
   // The trained model (~36 MB, plus the ~22 MB engine) is downloaded only when someone shows intent to use the
   // checker — focusing the text box, tapping an example, or pressing Check — not for visitors who only read.
-  const MODEL_ID = "devseis-ai-act-classifier-v6";
+  const MODEL_ID = "Devseis/devseis-ai-act-classifier-v6";
+  const MODEL_REVISION = "7c594f61c40b1c1aa4a7c45a397a64f765b2f323";
   // Below this top probability the trained model's answer is shown as "uncertain". A stricter cut-off was tested on
   // validation data and rejected: this model's mistakes are mostly confident, so it would hide more right answers than wrong ones.
   const UNSURE_BELOW = 0.5;
@@ -872,6 +875,7 @@
     if (!modelPromise) {
       runHint.textContent = "Preparing the model in your browser…";
       modelPromise = pipeline("text-classification", MODEL_ID, {
+        revision: MODEL_REVISION,
         dtype: "q8",
         progress_callback: (pr) => {
           if (pr.status === "progress" && pr.file && /\.(onnx|wasm)$/.test(pr.file) && pr.total) {

privacy.html

@@ -50,7 +50,7 @@
 <div class="wrap">
   <a href="index.html" class="back">← Back to Caveat</a>
   <h1>Privacy</h1>
-  <p class="updated">Last updated: 30 September 2026</p>
+  <p class="updated">Last updated: 23 October 2026</p>
 
   <div class="card good">
     <p style="margin:0"><strong>The short version.</strong> No account, no sign-up. The trained model runs <b>in your browser</b>, so your
@@ -71,7 +71,7 @@
           <td>Hugging Face hosts the page. Like any web host, it processes technical data such as your IP address and browser type to deliver the files and keep the service secure.</td>
           <td>Legitimate interest in running the site (GDPR Art. 6(1)(f))</td></tr>
         <tr><td><b>Trained model</b></td>
-          <td>The model files and the code that runs them (transformers.js and ONNX Runtime) are served from this site. <b>Your text is processed only on your device</b> and is not sent anywhere.</td>
+          <td>The first time you use the check, your browser downloads the model files from Devseis's model page on Hugging Face (<a href="https://huggingface.co/Devseis/devseis-ai-act-classifier-v6">huggingface.co/Devseis/devseis-ai-act-classifier-v6</a>) and keeps them for later visits. Hugging Face counts that download in the model's public download total, which does not identify you. The code that runs the model (transformers.js and ONNX Runtime) is served from this site. <b>Your text is processed only on your device</b> and is not sent anywhere.</td>
           <td>Legitimate interest in providing the check you ask for (Art. 6(1)(f))</td></tr>
         <tr><td><b>Reasoning AI</b></td>
           <td>When you press Check, your text is sent to a Devseis Cloudflare Worker, which passes it to Cloudflare Workers AI for one answer. Devseis's code does not log or store your text. Cloudflare processes the request as the service provider.</td>