jobtrackingapp/docs/verification/pol-002-ai-privacy.md at b67a531af4be441cdc1ebbdfe74363de9993d665

Files

T

cesnimda 5eb9b3cb96 feat(ai): enforce local-first routing

Keep external providers behind server consent, task, and prompt-cost gates while persisting actual provider provenance.

2026-08-09 12:30:11 +02:00

Updated: 2026-08-03

Status: IMPLEMENTED — NOT VERIFIED.

Implemented

Server-persisted per-user AI enable/disable and external-processing consent.
Live AI authorization rejects a Pro user who disables AI with the stable ai_disabled reason.
Optional job enrichment and queued CV processing recheck the live AI-enabled preference.
External /cv/* processing requires administrator enablement, supported provider configuration, current Pro entitlement, AI enabled and explicit user consent.
The sidecar independently rejects external selection unless its administrator gate and the backend permission header are both present.
Settings UI explains local-only/default behaviour and cannot opt in while the deployment gate is unavailable.
Provider credentials remain environment/server-only.

Focused backend policy/entitlement/worker/CV tests: 72/72.
Focused policy/header tests after final changes: 28/28.
Sidecar tests: 18/18, including absent/present permission-header routing.
Focused settings/entitlement UI tests: 8/8.
Full backend: 576/576.
Full frontend: 47/47 suites, 158/158 tests.
Frontend production build: pass.
EF pending-model check: pass; SQLite script adds AiEnabled DEFAULT 1 and ExternalAiProcessingAllowed DEFAULT 0.
docker compose config --quiet: pass with expected unset optional-environment warnings.
git diff --check: pass; line-ending notices only.

Browser verification is blocked by administrator policy.
No external provider, paid service, production environment or real private data was used.
MariaDB migration execution remains unavailable.
Direct clean dotnet ef database update fails in the pre-existing historical SQLite migration chain before this migration (AddJobEntityAndProspectStages expects a reconciler-added column). The application startup reconciler path was not exercised because the local process-launch command was blocked by execution policy.
AI-001/002 now carry admitted/rechecked policy/task context into durable calls, enforce bounded local-first fallback and record actual provider/model/route metadata. AI-003/004 still own task-specific payload minimization, complete cross-feature monthly accounting and real producer verification.