Merge pull request #91 from abinaze/fix/vendor-d3-locally

fix(frontend): vendor D3.js locally instead of loading from CDN

.gitattributes

@@ -0,0 +1,8 @@
+# Vendored third-party files are committed byte-identical to their upstream
+# source (see NOTICE.md for provenance + SHA-256 of each). Mark them -text
+# so core.autocrlf (commonly on by default on Windows) never rewrites their
+# line endings on checkout -- otherwise a Windows checkout would silently
+# diverge from the documented hash while Linux/macOS/CI checkouts would not,
+# making the file's own provenance record unverifiable on the platform this
+# project's primary users actually develop on.
+frontend/js/vendor/** -text

NOTICE.md

@@ -52,13 +52,29 @@ assumed from memory.
 
 ## Bundled AI models
 
-| Model | Used by | License |
-|---|---|---|
-| `en_core_web_sm` (spaCy) | `ai/nlp_extractor.py` and others | MIT, matching the spaCy models project's stated license |
-| `all-MiniLM-L6-v2` (sentence-transformers) | `ai/shadow_draft_detector.py` | Apache-2.0, per its model card |
-| `paraphrase-multilingual-MiniLM-L12-v2` (sentence-transformers) | `processing/entity_resolver_v2.py` | Apache-2.0, per its model card |
+Following the `model_selector` tiering fix (Findings R-2/R-3/R-4), each of
+these tasks can now load any of its three tier variants depending on the
+detected hardware profile, not just one fixed model -- all three variants
+per task are listed below, not just the one previously hardcoded.
 
-Neither model introduces a copyleft obligation.
+| Model | Used by | Tier | License |
+|---|---|---|---|
+| `xx_ent_wiki_sm` | `ai/nlp_extractor.py` (NER) | low | MIT, per its own model card / `spacy-models` release metadata |
+| `en_core_web_sm` | `ai/nlp_extractor.py` (NER) | medium (and the guaranteed fallback on low/high if the tier-specific model isn't installed) | MIT, matching the spaCy models project's stated license |
+| `en_core_web_trf` | `ai/nlp_extractor.py` (NER) | high | MIT, per its own model card / `spacy-models` release metadata |
+| `paraphrase-MiniLM-L3-v2` | `ai/shadow_draft_detector.py`, `processing/entity_resolver_v2.py` (embeddings) | low | Apache-2.0, per its model card |
+| `all-MiniLM-L6-v2` | `ai/shadow_draft_detector.py`, `processing/entity_resolver_v2.py` (embeddings) | medium | Apache-2.0, per its model card |
+| `paraphrase-multilingual-MiniLM-L12-v2` | `ai/shadow_draft_detector.py`, `processing/entity_resolver_v2.py` (embeddings) | high | Apache-2.0, per its model card |
+
+None of the six introduces a copyleft obligation.
+
+---
+
+## Frontend JavaScript dependencies (vendored files)
+
+| File | Package / version | License | Source | Note |
+|---|---|---|---|---|
+| `frontend/js/vendor/d3.min.js` | `d3` 7.9.0 | ISC (Copyright 2010-2023 Mike Bostock) | `https://registry.npmjs.org/d3/-/d3-7.9.0.tgz`, `dist/d3.min.js` | Resolves Finding N-2/F-14: previously loaded from `cdnjs.cloudflare.com` with no working offline fallback (`window._d3Failed` was set on load failure but never read anywhere). Vendored locally instead -- same exact version as the CDN reference it replaces, so no API-compatibility change. SHA-256 of the vendored file: `f2094bbf6141b359722c4fe454eb6c4b0f0e42cc10cc7af921fc158fceb86539`. ISC is a permissive license functionally equivalent to MIT/BSD-2-Clause -- requires only that the copyright/permission notice (above) be preserved; this file's own header comment already carries it (`// https://d3js.org v7.9.0 Copyright 2010-2023 Mike Bostock`). No copyleft obligation. |
 
 ---
 

frontend/index.html

@@ -28,9 +28,16 @@
 
   <!-- B-25 FIX: wrong SRI hash removed -- browsers refused to load D3 -->
   <!-- breaking ALL graph visualisation (relationship graph, zoom, nodes) -->
-  <script src="https://cdnjs.cloudflare.com/ajax/libs/d3/7.9.0/d3.min.js"
-    onerror="window._d3Failed=true;console.warn('D3 CDN failed')"
-          crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+  <!-- N-2/F-14 FIX: was CDN-loaded (cdnjs.cloudflare.com), which meant the
+       Relationship Graph tab threw an unhandled ReferenceError on load with
+       no working offline fallback (window._d3Failed was set in onerror but
+       never read anywhere -- confirmed by grep). Vendored locally instead
+       of wiring a fallback message, since a real offline-first / desktop
+       build has no good "recover" story for a missing charting library --
+       removing the network dependency entirely is the correct fix, not a
+       better error message for it. Exact same version (7.9.0) as the
+       previous CDN URL; see NOTICE.md for license + provenance. -->
+  <script src="js/vendor/d3.min.js"></script>
 </head>
 <body>