[alpha_factory] Fix Insight v1 demo readiness and CSP-safe bootstrap

[MontrealAI]

Motivation

• The Insight v1 demo failed offline readiness checks due to CDN dependencies, inline scripts blocked by a strict Content Security Policy (CSP), and an unresolved d3 module specifier, so the page must be usable offline and CSP-compliant for automated verification.

Description

• Replaced remote Tailwind/DaisyUI CDN usage with the local bundled stylesheet by switching index.html to load style.css so the demo no longer depends on network assets.
• Removed CSP-blocked inline runtime code and added an external docs/alpha_agi_insight_v1/bootstrap.js that defines required globals, provides a resilient window.toast, and performs guarded service-worker registration with SHA-384 integrity checks.
• Kept the import map available but made it inline and added a sha256 CSP entry so the import map and module imports (e.g., d3) resolve without violating CSP.
• Updated docs/alpha_agi_insight_v1/index.html to reference bootstrap.js, the inline import map, and the local style.css to ensure offline, CSP-safe startup.

Testing

• Ran python scripts/verify_demo_pages.py and the script reported all demos ready, including alpha_agi_insight_v1 (pass).
• Installed browsers with python -m playwright install chromium and system deps with python -m playwright install-deps chromium to enable Playwright checks (completed successfully).
• pre-commit run --files docs/alpha_agi_insight_v1/index.html docs/alpha_agi_insight_v1/bootstrap.js could not be executed in this environment because the pre-commit binary is not installed (not run here).

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e7bc82539f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve SW_HASH assignment in index for build tooling

Moving the service-worker hash constant out of index.html into bootstrap.js breaks the docs build pipeline, because scripts/build_insight_docs.sh still runs python scripts/ensure_insight_sw_hash.py "$DOCS_DIR" (line 97) and that updater only scans index.html for SW_HASH (scripts/ensure_insight_sw_hash.py lines 13 and 32-33). In this commit, index.html no longer contains any SW_HASH assignment, so the updater raises ValueError("SW_HASH not found in index.html") and aborts the build/deploy flow.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7165028372

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore SHA-384 CSP hashes for inline scripts

scripts/ensure_insight_csp.py and tests/security/test_csp.py both treat inline script allowlists as SHA-384 entries ('sha384-...'), but this script-src now only lists SHA-256 hashes. That means the test’s computed SHA-384 hashes for the inline scripts are never permitted, so the CSP integrity check fails and the docs build helper will keep rewriting this tag back to SHA-384-based values.

Useful? React with 👍 / 👎.