Add MIT license and model refresh plan

AGENTS.md

@@ -52,10 +52,11 @@ explicit product and privacy decision.
 
 ## Git and authorization boundary
 
-- This repository now has the user-authorized local `develop` baseline and an
-  isolated `release/schema3-v1` branch, but no configured remote. Do not
-  initialize a remote, push, publish an image, or change live Cloudflare
-  resources outside the explicitly authorized release sequence and the gates
+- This repository has the user-authorized public GitHub remote
+  `https://github.com/moinsen-dev/vibecoder_idea_map.git`; local `develop`
+  tracks `origin/develop`, and `release/schema3-v1` remains isolated. Do not
+  push new commits or tags, publish an image, merge a pull request, or change
+  live Cloudflare resources without explicit user authorization and the gates
   recorded in `STATE.md`.
 - Preserve user work and reference assets. Never reset, discard, or overwrite
   unrelated changes to manufacture a clean tree.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ulrich Diedrichsen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -139,3 +139,14 @@ CLIENT_HASH_SECRET=test-only-secret-change-me CONTACT_EMAIL=business@moinsen.dev
 ```
 
 The complete evidence contract is in `docs/03-acceptance.md`.
+
+## License
+
+Idea Map's project-authored source code and documentation are available under
+the [MIT License](LICENSE). Third-party packages, data, fonts, and separately
+downloaded model weights remain under their respective licenses. Qwen model
+weights are not included in this repository and are not relicensed by Idea
+Map's MIT license.
+
+The current local-model baseline and the evidence-gated refresh candidates are
+documented in `docs/18-local-model-refresh.md`.

STATE.md

@@ -1,6 +1,6 @@
 # Idea Map Project State
 
-Last updated: 2026-08-10, Europe/Berlin.
+Last updated: 2026-08-11, Europe/Berlin.
 
 ## Executive state
 
@@ -77,6 +77,23 @@ dragging available but disables inertia and automatic rotation. No server,
 database, analytics, identity, or privacy field changed. This behavior is not
 deployed or publicly verified.
 
+On 2026-08-11 the user authorized a public source repository at
+`https://github.com/moinsen-dev/vibecoder_idea_map`. `develop` was pushed at
+`76187f8`; this source publication did not deploy the application, migrate the
+database, publish a container, or change Cloudflare. The current follow-up adds
+an MIT license for project-authored source/documentation and explicitly keeps
+third-party packages, data, fonts, and separately downloaded model weights
+under their own licenses.
+
+A same-day local-model review selected `qwen3.5:4b` as the first A/B candidate,
+not as the runtime default. Official Qwen/Ollama artifacts put the candidate at
+3.4 GB with Apache 2.0 weights; `qwen3.5:9b` is the fallback, while Qwen 3.6
+starts at a much larger 27B official Ollama artifact. No model was downloaded,
+configured, evaluated, deployed, or publicly exercised by this review.
+`qwen2.5:3b` and its existing `20/20` corpus evidence remain authoritative
+until the full corpus, schema, publication, latency, memory, container, and
+production-shaped gates in `docs/18-local-model-refresh.md` pass.
+
 Commit `b0dc5fa` closes the independently runnable local T5 technical checks.
 The real `qwen2.5:3b` corpus matched `20/20`, a full authenticated local-model
 publication produced one schema-7 idea/revision without private/raw-source
@@ -153,8 +170,10 @@ end-to-end proof.
   green, but `LEGAL_REVIEW_OPEN` remains a separate release gate and any
   review-driven executable changes must be re-tested before deployment.
 - Local baseline: `19092e0`, tagged `baseline-schema7-t2-20260808`.
-- No Git remote is configured. Nothing was pushed and no container image was
-  published to a registry.
+- Public Git remote `origin` is
+  `https://github.com/moinsen-dev/vibecoder_idea_map.git`; local `develop`
+  tracks public `origin/develop` at `76187f8`. The isolated release branch and
+  tags were not pushed, and no container image was published to a registry.
 - No production code, schema, Cloudflare configuration, or public content was
   changed by the 2026-08-10 preparation. The earlier successful OTP proof
   created the expected minimal private actor and authentication identity in

docs/18-local-model-refresh.md

@@ -0,0 +1,75 @@
+# Idea Map — Local model refresh evaluation
+
+Status: candidate selection only; no runtime default, Compose file, production
+model, public behavior, or privacy processor changed.
+Review date: 2026-08-11
+
+## Current proven baseline
+
+Idea Map currently pins `qwen2.5:3b` through local Ollama. It receives only
+bounded extracted source text, has no tools or network access, runs with
+thinking disabled and temperature zero, and must return the existing JSON
+schema. The last real-model corpus result remains `20/20`; one schema-7
+publication smoke also passed. Those results remain the release baseline until
+a replacement passes the same gates.
+
+Qwen2.5 was released on 2024-09-19. The official
+[`Qwen2.5-3B-Instruct` model card](https://huggingface.co/Qwen/Qwen2.5-3B-Instruct)
+labels its weights `qwen-research`, not Apache 2.0. Idea Map does not distribute
+those weights, and the repository's MIT license does not relicense them.
+
+## Current official candidates
+
+| Candidate | Official Ollama artifact | Download size | Weight license | Role in this evaluation |
+| --- | --- | ---: | --- | --- |
+| `qwen3.5:4b` | [Qwen 3.5 tags](https://ollama.com/library/qwen3.5/tags) | 3.4 GB | [Apache 2.0](https://huggingface.co/Qwen/Qwen3.5-4B) | Primary drop-in candidate |
+| `qwen3.5:9b` | [Qwen 3.5 tags](https://ollama.com/library/qwen3.5/tags) | 6.6 GB | [Apache 2.0](https://huggingface.co/Qwen/Qwen3.5-9B) | Quality fallback if 4B misses the corpus |
+| `qwen3.6:27b` | [Qwen 3.6 tags](https://ollama.com/library/qwen3.6/tags) | 17 GB | [Apache 2.0](https://github.com/QwenLM/Qwen3.6) | Not the first replacement: much larger and aimed primarily at agentic coding |
+
+Qwen 3.5's small 4B and 9B weights were released in March 2026. Qwen 3.6 is
+newer, but its official open-weight Ollama family starts at 27B. Idea Map's
+task is bounded multilingual classification and schema-constrained extraction,
+not repository-level coding, so model generation alone is not a sufficient
+reason to accept the much larger footprint.
+
+## Evaluation decision
+
+Test `qwen3.5:4b` first. It is the closest current small-model successor, has a
+clear Apache 2.0 weight license, and its 3.4 GB Ollama artifact is a bounded
+increase over the installed 1.9 GB `qwen2.5:3b` artifact. If it does not match
+the baseline, test `qwen3.5:9b`; do not jump directly to Qwen 3.6.
+
+The development Mac has enough memory to run both Qwen 3.5 candidates, but
+that does not prove acceptable production-server latency or memory use. The
+production-shaped runtime must be measured independently.
+
+## Required A/B gate
+
+1. Keep `qwen2.5:3b` installed and record a fresh baseline run.
+2. Pull only `qwen3.5:4b`; do not change any checked-in default yet.
+3. Run the same full corpus with thinking disabled, temperature zero, the same
+   schema, prompt, timeout, and bounded inputs.
+4. Record exact match count, invalid-schema count, timeouts, warm latency,
+   peak memory, and artifact size. A replacement must match `20/20`, return no
+   malformed output, and remain inside the 90-second job boundary.
+5. Run the authenticated real-model publication smoke and confirm that raw
+   source/private fields do not enter SQLite, logs, or the public response.
+6. Repeat on a production-shaped host or container before changing the
+   production default.
+7. Only after the gate passes, update every model default, Compose setup/pull
+   command, health expectation, acceptance document, privacy model name, and
+   release evidence in one reviewed change.
+
+Suggested local comparison command after an operator starts Ollama and approves
+the model download:
+
+```bash
+ollama pull qwen3.5:4b
+OLLAMA_URL=http://127.0.0.1:11434 \
+OLLAMA_MODEL=qwen3.5:4b \
+AI_TIMEOUT_MS=90000 \
+npm run ai:eval
+```
+
+No model was downloaded or selected by this review. Until the complete A/B
+gate passes, `qwen2.5:3b` remains the supported and release-tested default.

package.json

@@ -1,6 +1,7 @@
 {
   "name": "idea-map",
   "version": "0.1.0",
+  "license": "MIT",
   "private": true,
   "type": "module",
   "engines": {