cesnimda
5eb9b3cb96
Keep external providers behind server consent, task, and prompt-cost gates while persisting actual provider provenance.
37 lines
2.3 KiB
Markdown
37 lines
2.3 KiB
Markdown
# POL-002 verification — AI privacy and external consent
|
|
|
|
Updated: 2026-08-03
|
|
|
|
Status: `IMPLEMENTED — NOT VERIFIED`.
|
|
|
|
## Implemented
|
|
|
|
- Server-persisted per-user AI enable/disable and external-processing consent.
|
|
- Live AI authorization rejects a Pro user who disables AI with the stable `ai_disabled` reason.
|
|
- Optional job enrichment and queued CV processing recheck the live AI-enabled preference.
|
|
- External `/cv/*` processing requires administrator enablement, supported provider configuration, current Pro entitlement, AI enabled and explicit user consent.
|
|
- The sidecar independently rejects external selection unless its administrator gate and the backend permission header are both present.
|
|
- Settings UI explains local-only/default behaviour and cannot opt in while the deployment gate is unavailable.
|
|
- Provider credentials remain environment/server-only.
|
|
|
|
## Automated evidence
|
|
|
|
- Focused backend policy/entitlement/worker/CV tests: 72/72.
|
|
- Focused policy/header tests after final changes: 28/28.
|
|
- Sidecar tests: 18/18, including absent/present permission-header routing.
|
|
- Focused settings/entitlement UI tests: 8/8.
|
|
- Full backend: 576/576.
|
|
- Full frontend: 47/47 suites, 158/158 tests.
|
|
- Frontend production build: pass.
|
|
- EF pending-model check: pass; SQLite script adds `AiEnabled DEFAULT 1` and `ExternalAiProcessingAllowed DEFAULT 0`.
|
|
- `docker compose config --quiet`: pass with expected unset optional-environment warnings.
|
|
- `git diff --check`: pass; line-ending notices only.
|
|
|
|
## Unverified / remaining
|
|
|
|
- Browser verification is blocked by administrator policy.
|
|
- No external provider, paid service, production environment or real private data was used.
|
|
- MariaDB migration execution remains unavailable.
|
|
- Direct clean `dotnet ef database update` fails in the pre-existing historical SQLite migration chain before this migration (`AddJobEntityAndProspectStages` expects a reconciler-added column). The application startup reconciler path was not exercised because the local process-launch command was blocked by execution policy.
|
|
- AI-001/002 now carry admitted/rechecked policy/task context into durable calls, enforce bounded local-first fallback and record actual provider/model/route metadata. AI-003/004 still own task-specific payload minimization, complete cross-feature monthly accounting and real producer verification.
|