{
  "summary": "Adds an embedded local-LLM fallback for privacy-policy/DPA extraction: when no external Ollama is configured, VRM can now download a small llama.cpp runtime and a bundled GGUF model via the license server and run them in a supervised child process, so enrichment works out of the box instead of silently staying disabled. Settings > AI gains a live status indicator for it (starting/ready/error/stopped, updating as you toggle the mode radios rather than only after Save) and a model picker sourced from the license server's actual inventory instead of a free-text field. CSAF advisories are now cross-checked for unfixed vulnerabilities (known_affected/under_investigation, not just known_not_affected suppression) and flagged to the system owner the same way the SBOM/OSV.dev pipeline already does, without double-flagging when both signals are present for the same CVE. Adds a heuristic jurisdiction-detection probe - regex-matching VAT/company-registration-number formats on a vendor's own site - as a fallback signal for SOV-1 when GLEIF has no LEI record for the vendor (e.g. private companies), never overriding a real GLEIF resolution. Fixes a real LDAP-backend regression where hitting a protected page with no session fell back to a bare basic-auth prompt instead of the styled login page, and restyles that login page to match the rest of the admin UI. Also fixes two production gaps found while validating the local-LLM work live: the deploy pipeline never built or shipped the helper binary the local fallback depends on, so it retried a fork/exec failure indefinitely whenever local mode was active; and Settings > AI's GET endpoint fabricated a \"local mode, nothing configured\" guess whenever no admin override had been saved, even when a real external Ollama backend was actually running from the deployed config - risking a blind Save silently switching production away from it."
}