Delete README.md

README.md

@@ -1,87 +0,0 @@
-# CLOAK PII API — HF Space
-
-ONNX INT8 CPU inference for `Wardline/CLOAK_V3.10_onnx` (model file
-`model.fused.int8.onnx`) + Gradio demo UI + the REST API the CLOAK server calls.
-
-Override the repo/file without editing code via Space secrets `MODEL_REPO`
-and `MODEL_FILE`.
-
-## Deploy
-1. Copy `app.py` + `requirements.txt` to the Space repo and push.
-2. Space secrets: `HF_TOKEN` (model repo read access) and `API_SECRET`
-   (Bearer token for `/detect`). If `API_SECRET` is unset it falls back to
-   `HF_TOKEN` — works, but don't: that puts your HF account token in CLOAK's
-   settings. Use a dedicated random secret.
-3. Gotchas (learned the hard way):
-   - On a Gradio-SDK Space the Gradio version comes from `sdk_version` in the
-     Space README front-matter — the `requirements.txt` pin is ignored.
-   - HF's image sets `GRADIO_SSR_MODE=true`, which spawns a second server on
-     port 7861 and crashes the mount_gradio_app + uvicorn pattern (exit 3,
-     "address already in use"). `app.py` forces it off before importing gradio.
-
-## Wire up CLOAK
-In the CLOAK dashboard → Settings:
-- **Backend URL** → the Space URL (e.g. `https://<space>.hf.space`)
-- **API key**     → the `API_SECRET` value
-
-The server auto-detects the protocol: it tries `POST /detect` first and falls
-back to the legacy Gradio API if the URL still points at an old Space.
-
-## Contract (must stay in sync with `server/src/detection/pii.ts`)
-- `POST /detect` · `Authorization: Bearer <API_SECRET>` · `{"text": "..."}`
-  → `{entities: [{type, text, start, end, confidence}], nested, redacted_text, model, processing_time_ms}`
-- Failures are real HTTP errors (401 bad key / 422 oversize / 503 inference) —
-  never 200-with-empty, so DSPM records scan **errors**, not false "clean".
-- `MAX_TEXT_CHARS = 30_000` here ↔ `DETECT_MAX_CHARS = 30_000` in `pii.ts`.
-- `GET /health` → `{status, model, engine, threads, classes, max_chars}` —
-  used by the Settings backend-status probe.
-
-## Second path: document classification (`docclass.py`)
-
-`/detect` finds personal details in text. The `/file` paths say what KIND of
-document a file is (26 classes, including `credentials`) and suggest an action.
-CLOAK stores both; neither replaces the other.
-
-| Path | Body | Runs |
-|---|---|---|
-| `POST /file/classify` | `{"text": "...", "column_headers": [...]}` | Layer 3 on text CLOAK already extracted (~5 ms) |
-| `POST /file/analyze` | raw bytes, `Content-Type: application/octet-stream`, `X-Filename: <name>` | Layers 1+2+3: real type from bytes, archive contents, OCR for images and scanned PDFs |
-
-Same `Authorization: Bearer <API_SECRET>` as `/detect`. `/health` reports it
-under `docclass` (loaded, error, threshold, ocr).
-
-Code tree (the handover's layout, unchanged):
-
-```
-docclass.py            router, model loading, OCR concurrency, limits
-src/analyze.py         layers 1 + 2 entry point
-src/layer1_format/     magic-byte identification
-src/layer2_containers/ zip / gzip / 7z unpacking
-src/content_extraction/ pdf · docx · xlsx · csv · text · ocr.py
-src/layer3_doctype/    Layer3DocType — ALWAYS load through this, never the raw pickle
-reference/policy_map.py class -> action table (configuration)
-tests/test_docclass.py contract + HTTP tests
-```
-
-Deploy notes:
-- **The Space must run Python 3.11** — set `python_version: "3.11"` in the Space
-  README front-matter. The model is a scikit-learn pickle built on 3.11.9 and
-  `requirements.txt` pins its exact libraries; other versions can load it and
-  silently behave differently.
-- The model is fetched from `DOCCLASS_REPO` (default: `MODEL_REPO`) /
-  `DOCCLASS_FILE` (default `layer3_25class.joblib`) and **refused unless its
-  SHA-256 matches** `DOCCLASS_SHA256` (pinned in `docclass.py`). Upload a new
-  model → update the hash in the same change.
-- If the model can't load, `/file/*` returns 503 and `/detect` is unaffected.
-- Limits: 25 MB per file, archives 3 levels / 500 entries / 150 MB unpacked,
-  at most 2 OCR jobs at once (`DOCCLASS_OCR_CONCURRENCY`), first 3 pages of a
-  scanned PDF (`DOCCLASS_PDF_OCR_PAGES`).
-- `/file/analyze` receives whole files (including photos of ID cards). For
-  client installs that must not send files to Hugging Face, run this same
-  Space container on their own host and point CLOAK at it.
-
-Test locally:
-
-```bash
-DOCCLASS_MODEL_PATH=path/to/layer3_25class.joblib python -m pytest tests -q
-```