timmy-talking-turd/docs/PRODUCT-DECISIONS.md

Product Boundary and Release Authority Decision

• Status: Accepted
• Date: 2026-08-20
• Scope: Photo-assisted bowel logging and release governance

Context

Timmy can make a conservative visual suggestion from a user-selected image, but the available general-purpose model is not clinically validated. The product must preserve manual logging, deterministic red-flag escalation, and user control regardless of model availability or output.

Decision

Observable AI fields

AI may suggest only:

• visible Bristol form (Types 1–7);
• broad color;
• image quality.

Every suggestion is provisional, may abstain, and requires user review or correction before it can enter the journal. Symptoms remain user-entered, and journal saving is separate from training contribution consent.

Prohibited inferences

AI must not infer or claim disease, bleeding, pain, urgency, fever, vomiting, treatment, causation, or whether a food is safe. It must not replace professional care, suppress deterministic red-flag escalation, or present a suggestion as a diagnosis.

Conversational Hermes boundary

Timmy may expose a smart free-text conversation backed by a fully tool-capable Hermes Agent, but only through an authenticated, same-origin, server-side gateway. The browser never receives provider credentials or Hermes session IDs and cannot select the model, provider, tool policy, work directory, or internal session. Browser sessions use opaque HttpOnly cookies, bounded message and ledger sizes, single-flight turns, fixed time/rate/session limits, and sanitized output. Photos are excluded from chat context.

The application’s deterministic urgent-symptom guidance runs before chat and remains authoritative when Hermes is offline, slow, malformed, or conversationally mistaken. Hermes must not diagnose, invent symptoms, override escalation, or take external/destructive actions without explicit user intent and confirmation.

Availability and draft retention

Logging must never depend on AI availability. When the vision worker is offline, disabled, or still unknown, the photo-first flow offers no AI action and no analysis-consent prompt, and manual Bristol entry remains one action away from every photo step. A chosen photo and any entered context are retained as an in-session draft with a visible summary and an explicit start over; drafts are deliberately not persisted to storage, so a photo awaiting consent is never written to disk. The service worker never caches analysis requests or image bodies.

Training contribution consent

Contributing a confirmed photo to training is a second consent, not a side effect of logging. A journal save is never a training contribution; a contribution exists only after the person reads the current consent version and its receipt (contribution id, what is included, what is never included) and accepts it explicitly. The receipt carries the consent version it was accepted under, the confirmed Bristol form and broad color, and no note text, symptom answers, urgency/discomfort ratings, identity, or photo bytes.

Withdrawal is first-class: withdrawal keeps a tombstone naming every derived artifact by contribution id (raw image and confirmed label), so a deletion request can be addressed against the corpus rather than trusted to a promise. Delete-all clears the ledger, saved photos, and contribution receipts together.

This build acknowledges that records the intent and does not transmit a contribution until the corpus pipeline and privacy copy are reviewed in #22 and #25; the section says so in the app rather than implying an upload that does not exist.

Release authority

Hermes/Timmy is the release authority for routine engineering, test, build, deployment, and release-candidate preparation. Automated evidence must remain reproducible and must not overstate model accuracy or safety.

Human gates

Human gates are limited to:

1. clinical and privacy review when language or policy crosses those boundaries;
2. beta consent before participation;
3. RC approval before shipping a release candidate.

Routine provisioning, deployment, label sweeps, and release-candidate assembly are not human-operated gates.

Consequences

• Model output is assistive and fail-closed, never authoritative.
• A generic open-weight VLM can support bootstrap experiments but cannot become the production Bristol classifier without the documented calibration and evaluation evidence.
• Release evidence and demonstrations must use fictional or synthetic data and state the non-diagnostic boundary honestly.

Evidence and governing references

• Product brief and safety boundary
• AI execution evidence
• Sovereign vision decision and measured limitations
• Photo data-flow threat model