Merge v12 polish: bundle igv.min.js + drop regen entries for deleted files

Eliminates the cold-cache race where regens running in parallel produced
HTMLs with CDN <script> tags instead of inlined IGV.js. Bundles
igv.min.js as a package resource (chorus/analysis/static/igv.min.js)
with resolution order bundled → legacy cache → CDN → HF. Also drops
the two ENFORMER_EXAMPLES entries that wrote to files deleted in
f15d926.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lucapinello

chorus/analysis/_igv_report.py

@@ -17,44 +17,55 @@
 
 logger = logging.getLogger(__name__)
 
-# IGV.js: prefer local cached copy (inlined), fall back to CDN.
+# IGV.js is bundled as a package resource at
+# ``chorus/analysis/static/igv.min.js`` so every install has an offline-
+# usable copy without any network round-trip. The legacy CDN + HF
+# fallback paths remain as secondary options in case a downstream
+# consumer stripped the static file from the wheel.
 #
-# The committed HTML reports need IGV.js to render the embedded genome
-# browser. To stay robust when the viewer is offline / behind a proxy / on
-# a network that MITMs TLS (observed during the 2026-04-16 audit:
-# `net::ERR_CERT_AUTHORITY_INVALID` on 2/19 reports), we lazy-download
-# the bundle once into ``~/.chorus/lib/igv.min.js`` the first time
-# ``build_igv_html`` runs on a machine, then inline the JS into every
-# subsequent report. If the download fails we silently fall back to the
-# CDN <script> tag so report generation still succeeds.
+# Inlining the JS into every report makes the committed HTMLs
+# self-contained (viewable offline, through SSL-MITM proxies, on air-gapped
+# hosts). The CDN <script> fallback is the last resort and only triggers
+# when both the bundled copy and both network paths fail.
 _IGV_CDN = "https://cdn.jsdelivr.net/npm/igv@3.1.1/dist/igv.min.js"
 _IGV_LOCAL = Path.home() / ".chorus" / "lib" / "igv.min.js"
-# HuggingFace mirror — secondary fallback for environments where the
-# institutional proxy MITMs TLS and breaks stdlib ``urllib`` but leaves
-# ``huggingface_hub`` (httpx + certifi) working. Requires the file to
-# exist in the dataset; gracefully no-ops if it doesn't.
+_IGV_BUNDLED = Path(__file__).parent / "static" / "igv.min.js"
+# HuggingFace mirror — tertiary fallback for unusual installs where the
+# bundled resource is missing (e.g. stripped by a packer) and stdlib
+# urllib is blocked by a MITM proxy.
 _IGV_HF_REPO = "lucapinello/chorus-backgrounds"
 _IGV_HF_FILENAME = "igv.min.js"
 
 
 def _ensure_igv_local() -> Path | None:
-    """Ensure ``_IGV_LOCAL`` exists; download it on first use.
-
-    Tries (1) the CDN via stdlib ``urllib`` (``download_with_resume``),
-    then (2) the HuggingFace mirror via ``huggingface_hub`` if the CDN
-    path fails (typical on SSL-MITM institutional networks where
-    stdlib ``urllib`` rejects the proxy's self-signed cert but
-    ``httpx + certifi`` accepts it).
-
-    Returns the local path when the file is available, ``None`` if
-    both downloads failed (callers then fall back to a CDN <script>
-    tag in the rendered HTML).
+    """Return a path to ``igv.min.js`` that callers can read + inline.
+
+    Resolution order:
+      1. ``chorus/analysis/static/igv.min.js`` — bundled with the
+         package. Always present in a standard install; no network
+         touched.
+      2. ``~/.chorus/lib/igv.min.js`` — legacy cache from earlier chorus
+         versions. Kept for continuity.
+      3. CDN via stdlib ``urllib`` (``download_with_resume``).
+      4. HuggingFace dataset mirror via ``huggingface_hub``.
+
+    Returns the local path when the file is available, ``None`` if all
+    four sources failed (callers then fall back to a CDN ``<script>``
+    tag in the rendered HTML — reports remain viewable online).
     """
+    # 1. Bundled package resource (fast path — no I/O beyond the stat).
+    if _IGV_BUNDLED.exists() and _IGV_BUNDLED.stat().st_size > 0:
+        return _IGV_BUNDLED
+
+    # 2. Legacy user cache from pre-v13 installs.
     if _IGV_LOCAL.exists() and _IGV_LOCAL.stat().st_size > 0:
         return _IGV_LOCAL
+
+    # Bundled file missing (stripped by a packer?) and no legacy cache.
+    # Fall back to the download paths to stay functional.
     _IGV_LOCAL.parent.mkdir(parents=True, exist_ok=True)
 
-    # Attempt 1: CDN via stdlib urllib.
+    # 3. CDN via stdlib urllib.
     try:
         from chorus.utils.http import download_with_resume
         download_with_resume(_IGV_CDN, _IGV_LOCAL, label="igv.min.js")
@@ -64,8 +75,8 @@ def _ensure_igv_local() -> Path | None:
     except Exception as exc:
         logger.debug("CDN fetch of igv.min.js failed (%s); trying HF mirror.", exc)
 
-    # Attempt 2: HuggingFace mirror (works through SSL-MITM proxies
-    # where stdlib urllib fails — huggingface_hub uses httpx+certifi).
+    # 4. HuggingFace mirror (works through SSL-MITM proxies where stdlib
+    # urllib fails — huggingface_hub uses httpx + certifi).
     try:
         from huggingface_hub import hf_hub_download
         downloaded = hf_hub_download(
@@ -74,8 +85,6 @@ def _ensure_igv_local() -> Path | None:
             repo_type="dataset",
             local_dir=str(_IGV_LOCAL.parent),
         )
-        # hf_hub_download returns the actual local path; move to
-        # canonical _IGV_LOCAL if different.
         dp = Path(downloaded)
         if dp != _IGV_LOCAL and dp.exists():
             dp.replace(_IGV_LOCAL)
@@ -84,8 +93,8 @@ def _ensure_igv_local() -> Path | None:
             return _IGV_LOCAL
     except Exception as exc:
         logger.warning(
-            "Could not pre-cache igv.min.js from CDN or HF mirror (%s); "
-            "reports will reference %s at view time.",
+            "igv.min.js unavailable: bundled resource missing, CDN and HF "
+            "mirror both failed (%s); reports will reference %s at view time.",
             exc, _IGV_CDN,
         )
     return None