cesnimda
5eb9b3cb96
Keep external providers behind server consent, task, and prompt-cost gates while persisting actual provider provenance.
38 lines
4.2 KiB
Markdown
38 lines
4.2 KiB
Markdown
# Production AI validation
|
||
|
||
Updated: 2026-08-02
|
||
|
||
Status: `BLOCKED`. No production access, deployment, Ollama installation, model pull, benchmark, provider call or configuration change has been performed by this programme.
|
||
|
||
## Required before any production change
|
||
|
||
- documented target and access method without credential guessing or discovery scans;
|
||
- backup and tested rollback inventory;
|
||
- CPU, memory, storage, architecture and current service inventory;
|
||
- private-data routing and Pro entitlement gates implemented and verified;
|
||
- durable queue/restart recovery implemented and verified;
|
||
- bounded parser/worker resources and health checks;
|
||
- synthetic benchmark corpus and explicit acceptance thresholds;
|
||
- local-only bind/network proof for Ollama;
|
||
- canary, monitoring and rollback procedure.
|
||
|
||
Repository-side evidence will be linked here as packages PROD-001 through PROD-004 advance. Until then, production state is unchanged and unverified.
|
||
|
||
BG-001 tenant-safe owner execution is implemented locally, but job enrichment remains default-off. It must not be enabled until durable operations, Pro entitlement and AI privacy policy pass their own gates; see `docs/verification/bg-001-tenant-workers.md`.
|
||
|
||
OPS-001A durable operation state is implemented locally. SQLite concurrency/migration checks pass and MariaDB DDL is generated, but no handler or worker is active and MariaDB/production execution remains blocked; see `docs/verification/ops-001a-durable-operations.md`.
|
||
|
||
OPS-001B persistent terminal notifications are implemented locally. Atomic rollback, owner isolation and SQLite migration checks pass; MariaDB DDL is generated but not executed. No notification email or worker is active; see `docs/verification/ops-001b-notifications.md`.
|
||
|
||
OPS-001C owner APIs and queue UI are implemented locally. A two-user isolated HTTP matrix and frontend build/tests pass, but browser and production smoke remain blocked. No feature producer or worker is active; see `docs/verification/ops-001c-operation-ui.md`.
|
||
|
||
POL-001 now enforces Free=no-AI with a live-role Pro policy, stable locked response, frontend locked states and worker execution rechecks. Full backend/frontend regressions pass, but incomplete cross-feature usage accounting, browser checks, Stripe lifecycle verification and production deployment keep it short of verification. Existing internal `Premium` role/config identifiers remain for rollback compatibility and are not public plan names. See `docs/verification/pol-001-free-pro-entitlements.md`.
|
||
|
||
PROD-002 provides a code-derived P0–P3 workload/privacy inventory and 19-case synthetic evaluation set. Validation passes without any model or provider call. Latency values remain targets—not production measurements—and model selection remains blocked on PROD-001/003. See `docs/verification/prod-002-ai-evaluation.md`.
|
||
|
||
POL-002 now persists user AI/privacy preferences and requires independent backend/sidecar administrator gates, live Pro entitlement, AI enabled and explicit consent before `/cv/*` can use a configured external provider. The default remains local and mocked routing checks pass. No external/paid provider or production egress was exercised; durable policy snapshots, actual-provider/reason recording, payload minimization, cost controls and local-first fallback triggers remain AI-001/002 rollout gates. See `docs/verification/pol-002-ai-privacy.md`.
|
||
|
||
AI-001 adds the reusable bounded database-backed admission/worker layer over OPS-001A/B/C. It defaults to one worker and remains switched off; no real handler, model or external provider was invoked. Production activation remains blocked until AI-002 provider controls, AI-003/004 typed handlers, browser verification, MariaDB execution, monitoring and rollback/canary evidence pass. See `docs/verification/ai-001-durable-ai-queue.md`.
|
||
|
||
AI-002 now enforces sequential local-first routing, explicit task/consent/config/prompt-cost gates, a bounded process-local circuit and actual provider/model/route provenance. Backend 588/588 and sidecar fake-transport 22/22 pass. This is repository evidence only: no model/provider call or production egress occurred, the worker remains off, and PROD-001/003 plus AI-003/004 remain mandatory before any rollout. See `docs/verification/ai-002-provider-routing.md`.
|