Merge feat/hf-spaces-demo into main; deploy config adapted to src/ layout

main now combines the Gold-RAP restructure (dev/refactor-cleancode, the spine) with the
Hugging Face Spaces deploy config (feat/hf-spaces-demo):

- Dockerfile rewritten for the new layout: installs the package via `pip install ".[app]"`
(deps from pyproject.toml) + `spacy download en_core_web_lg`, runs `streamlit run
streamlit_app.py` (was app/streamlit_app.py).
- README keeps the HF front-matter (sdk: docker, app_port 8501) on top of the restructured body.
- DEPLOY_HF_SPACES.md updated: push `main` to the Space; entry point is streamlit_app.py.

Dependencies consolidated to a single source of truth:
- Remove requirements.txt; pyproject.toml [project.dependencies] + [app]/[dev] extras is canonical.
CI (`pip install -e .[dev]`) and the Dockerfile (`pip install .[app]`) both build from pyproject.

Verified: ruff clean; 23 tests pass; src imports OK.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -7,7 +7,7 @@ data leaves a Trust. Encode Club "Trusted Data & AI Infrastructure" hackathon; f
 ```bash
 # Setup (Windows PowerShell)
 python -m venv .venv; .\.venv\Scripts\Activate.ps1
-pip install -r requirements.txt; python -m spacy download en_core_web_lg
+pip install -e ".[app,dev]"; python -m spacy download en_core_web_lg
 
 python tests/run_eval.py --compare --limit 300   # VERIFIABLE SIGNAL: rules vs presidio+rules -> output/results.json
 python -m src.trust_demo                          # two NHS Trusts share only de-identified data -> output/

DEPLOY_HF_SPACES.md

@@ -0,0 +1,46 @@
+# Deploy the live demo on Hugging Face Spaces
+
+The repo ships everything an HF **Docker Space** needs (HF's create API only accepts
+`gradio | docker | static`, so the Streamlit app runs via Docker):
+
+1. **`Dockerfile`** — installs the package (`pip install ".[app]"`) + `en_core_web_lg`, then runs
+   `streamlit run streamlit_app.py` on port 8501.
+2. **`README.md` front-matter** — `sdk: docker`, `app_port: 8501` (the Space card config).
+
+The Space downloads the NHS dataset from Hugging Face at first run; if that fails it falls back to
+paste-only mode.
+
+## One-time deploy
+
+```bash
+# 1) log in (HF token with WRITE scope: https://huggingface.co/settings/tokens)
+hf auth login
+
+# 2) create the Space (Docker SDK, free cpu-basic) — or use https://huggingface.co/new-space
+hf repos create <HF_USERNAME>/noteguard --repo-type space --space-sdk docker
+
+# 3) push main to the Space's main branch
+git remote add space https://huggingface.co/spaces/<HF_USERNAME>/noteguard
+git push space main
+```
+
+> Uses the `hf` CLI from `huggingface_hub` >= 1.0 (`huggingface-cli` still works as a deprecated alias).
+
+The Space builds the image (Presidio + spaCy + `en_core_web_lg`, ~3–5 min the first time), then serves
+the app at `https://huggingface.co/spaces/<HF_USERNAME>/noteguard`.
+
+## Updating an existing Space
+
+After any change on `main`:
+
+```bash
+git push space main      # the Space rebuilds automatically
+```
+
+The `Dockerfile` is the single source of truth for the entry point (`streamlit_app.py`) and the model,
+so renames in the repo never require changing Space settings — just push.
+
+## Notes
+- **Resource-constrained?** If the build is slow or the Space OOMs, change `en_core_web_lg` to
+  `en_core_web_sm` in the `Dockerfile`.
+- Front-matter lives at the top of `README.md`; GitHub renders it as a small table — harmless.

Dockerfile

@@ -0,0 +1,27 @@
+# Hugging Face Spaces (Docker SDK) — serves the NoteGuard Streamlit app.
+# HF's create API only accepts gradio|docker|static, so Streamlit runs via Docker.
+FROM python:3.11-slim
+
+# Non-root user (HF Spaces convention) -> gives a writable HOME for model/dataset caches.
+RUN useradd -m -u 1000 user
+USER user
+ENV HOME=/home/user \
+    PATH=/home/user/.local/bin:$PATH \
+    PYTHONUNBUFFERED=1
+
+WORKDIR $HOME/app
+
+# Install the package (deps come from pyproject.toml) + the spaCy model. Copy only what pip
+# needs first, for Docker layer caching.
+COPY --chown=user pyproject.toml README.md ./
+COPY --chown=user src ./src
+RUN pip install --no-cache-dir --upgrade pip && \
+    pip install --no-cache-dir ".[app]" && \
+    python -m spacy download en_core_web_lg
+
+# App code (data/ and .venv are gitignored, so the app downloads the dataset at runtime).
+COPY --chown=user . .
+
+EXPOSE 8501
+CMD ["streamlit", "run", "streamlit_app.py", \
+     "--server.port=8501", "--server.address=0.0.0.0", "--server.headless=true"]

README.md

@@ -1,3 +1,15 @@
+---
+title: NoteGuard — NHS De-Identification Gate
+emoji: 🛡️
+colorFrom: blue
+colorTo: indigo
+sdk: docker
+app_port: 8501
+pinned: false
+license: mit
+short_description: Sanitise-at-source PII removal for NHS notes
+---
+
 # 🛡️ NoteGuard
 
 **Automatic PII sanitisation for NHS clinical notes — clean data in, no identifiers out.**
@@ -36,7 +48,7 @@ layer** Presidio leaves to you:
 ## Results — residual leakage drops as we layer detection
 
 *Known identifiers (joined from the structured tables) still present after sanitisation. Measured on all
-**1,602 notes** (1,027 known-PII occurrences). Reproduce with `python run_eval.py --compare`.*
+**1,602 notes** (1,027 known-PII occurrences). Reproduce with `python tests/run_eval.py --compare`.*
 
 | Detector | NHS number F1 | PERSON recall | **Residual leakage** |
 |---|---|---|---|

requirements.txt

@@ -1,9 +0,0 @@
-presidio-analyzer
-presidio-anonymizer
-spacy>=3.7,<3.9
-faker
-ftfy
-huggingface_hub
-pandas
-streamlit
-pytest