timmy
dce668e72b
Logging must never depend on AI availability, and an unsaved entry must not disappear when the user navigates away mid-log. - add src/vision-readiness.js so the photo flow consumes one readiness contract - when the worker is offline/disabled/unknown, offer no AI action and no analysis-consent prompt, and keep manual Bristol entry one action away - add src/draft.js and make the draft own the photo so a chosen photo and entered context survive a recoverable close or navigation, with a visible kept-draft summary and an explicit start over - drafts stay in session memory only: a photo awaiting consent is never persisted, and reload starts clean - service worker now refuses to cache image bodies in addition to analysis requests and no-store responses - tests: 2 new unit files, 3 service-worker privacy assertions (1 hold-out), 1 browser acceptance file, release-demo and CI/package assertions - release demo now visibly replays the vision-offline pass and the retained draft with synthetic data and an in-script assertion
3.6 KiB
Product Boundary and Release Authority Decision
- Status: Accepted
- Date: 2026-08-20
- Scope: Photo-assisted bowel logging and release governance
Context
Timmy can make a conservative visual suggestion from a user-selected image, but the available general-purpose model is not clinically validated. The product must preserve manual logging, deterministic red-flag escalation, and user control regardless of model availability or output.
Decision
Observable AI fields
AI may suggest only:
- visible Bristol form (Types 1–7);
- broad color;
- image quality.
Every suggestion is provisional, may abstain, and requires user review or correction before it can enter the journal. Symptoms remain user-entered, and journal saving is separate from training contribution consent.
Prohibited inferences
AI must not infer or claim disease, bleeding, pain, urgency, fever, vomiting, treatment, causation, or whether a food is safe. It must not replace professional care, suppress deterministic red-flag escalation, or present a suggestion as a diagnosis.
Conversational Hermes boundary
Timmy may expose a smart free-text conversation backed by a fully tool-capable Hermes Agent, but only through an authenticated, same-origin, server-side gateway. The browser never receives provider credentials or Hermes session IDs and cannot select the model, provider, tool policy, work directory, or internal session. Browser sessions use opaque HttpOnly cookies, bounded message and ledger sizes, single-flight turns, fixed time/rate/session limits, and sanitized output. Photos are excluded from chat context.
The application’s deterministic urgent-symptom guidance runs before chat and remains authoritative when Hermes is offline, slow, malformed, or conversationally mistaken. Hermes must not diagnose, invent symptoms, override escalation, or take external/destructive actions without explicit user intent and confirmation.
Availability and draft retention
Logging must never depend on AI availability. When the vision worker is offline, disabled, or still unknown, the photo-first flow offers no AI action and no analysis-consent prompt, and manual Bristol entry remains one action away from every photo step. A chosen photo and any entered context are retained as an in-session draft with a visible summary and an explicit start over; drafts are deliberately not persisted to storage, so a photo awaiting consent is never written to disk. The service worker never caches analysis requests or image bodies.
Release authority
Hermes/Timmy is the release authority for routine engineering, test, build, deployment, and release-candidate preparation. Automated evidence must remain reproducible and must not overstate model accuracy or safety.
Human gates
Human gates are limited to:
- clinical and privacy review when language or policy crosses those boundaries;
- beta consent before participation;
- RC approval before shipping a release candidate.
Routine provisioning, deployment, label sweeps, and release-candidate assembly are not human-operated gates.
Consequences
- Model output is assistive and fail-closed, never authoritative.
- A generic open-weight VLM can support bootstrap experiments but cannot become the production Bristol classifier without the documented calibration and evaluation evidence.
- Release evidence and demonstrations must use fictional or synthetic data and state the non-diagnostic boundary honestly.