feat/Update_Controllers_to_Allow_for_Premium_Membership

docs/production/production-ai-validation.md

@@ -0,0 +1,35 @@
+# Production AI validation
+
+Updated: 2026-08-02
+
+Status: `BLOCKED`. No production access, deployment, Ollama installation, model pull, benchmark, provider call or configuration change has been performed by this programme.
+
+## Required before any production change
+
+- documented target and access method without credential guessing or discovery scans;
+- backup and tested rollback inventory;
+- CPU, memory, storage, architecture and current service inventory;
+- private-data routing and Pro entitlement gates implemented and verified;
+- durable queue/restart recovery implemented and verified;
+- bounded parser/worker resources and health checks;
+- synthetic benchmark corpus and explicit acceptance thresholds;
+- local-only bind/network proof for Ollama;
+- canary, monitoring and rollback procedure.
+
+Repository-side evidence will be linked here as packages PROD-001 through PROD-004 advance. Until then, production state is unchanged and unverified.
+
+BG-001 tenant-safe owner execution is implemented locally, but job enrichment remains default-off. It must not be enabled until durable operations, Pro entitlement and AI privacy policy pass their own gates; see `docs/verification/bg-001-tenant-workers.md`.
+
+OPS-001A durable operation state is implemented locally. SQLite concurrency/migration checks pass and MariaDB DDL is generated, but no handler or worker is active and MariaDB/production execution remains blocked; see `docs/verification/ops-001a-durable-operations.md`.
+
+OPS-001B persistent terminal notifications are implemented locally. Atomic rollback, owner isolation and SQLite migration checks pass; MariaDB DDL is generated but not executed. No notification email or worker is active; see `docs/verification/ops-001b-notifications.md`.
+
+OPS-001C owner APIs and queue UI are implemented locally. A two-user isolated HTTP matrix and frontend build/tests pass, but browser and production smoke remain blocked. No feature producer or worker is active; see `docs/verification/ops-001c-operation-ui.md`.
+
+POL-001 now enforces Free=no-AI with a live-role Pro policy, stable locked response, frontend locked states and worker execution rechecks. Full backend/frontend regressions pass, but incomplete cross-feature usage accounting, browser checks, Stripe lifecycle verification and production deployment keep it short of verification. Existing internal `Premium` role/config identifiers remain for rollback compatibility and are not public plan names. See `docs/verification/pol-001-free-pro-entitlements.md`.
+
+PROD-002 provides a code-derived P0–P3 workload/privacy inventory and 19-case synthetic evaluation set. Validation passes without any model or provider call. Latency values remain targets—not production measurements—and model selection remains blocked on PROD-001/003. See `docs/verification/prod-002-ai-evaluation.md`.
+
+POL-002 now persists user AI/privacy preferences and requires independent backend/sidecar administrator gates, live Pro entitlement, AI enabled and explicit consent before `/cv/*` can use a configured external provider. The default remains local and mocked routing checks pass. No external/paid provider or production egress was exercised; durable policy snapshots, actual-provider/reason recording, payload minimization, cost controls and local-first fallback triggers remain AI-001/002 rollout gates. See `docs/verification/pol-002-ai-privacy.md`.
+
+AI-001 adds the reusable bounded database-backed admission/worker layer over OPS-001A/B/C. It defaults to one worker and remains switched off; no real handler, model or external provider was invoked. Production activation remains blocked until AI-002 provider controls, AI-003/004 typed handlers, browser verification, MariaDB execution, monitoring and rollback/canary evidence pass. See `docs/verification/ai-001-durable-ai-queue.md`.