Timmy
a50afa6722
All checks were successful
Quality gates / quality (pull_request) Successful in 1m24s
58 lines
3.1 KiB
Markdown
58 lines
3.1 KiB
Markdown
# Product Boundary and Release Authority Decision
|
||
|
||
- **Status:** Accepted
|
||
- **Date:** 2026-08-20
|
||
- **Scope:** Photo-assisted bowel logging and release governance
|
||
|
||
## Context
|
||
|
||
Timmy can make a conservative visual suggestion from a user-selected image, but the available general-purpose model is not clinically validated. The product must preserve manual logging, deterministic red-flag escalation, and user control regardless of model availability or output.
|
||
|
||
## Decision
|
||
|
||
### Observable AI fields
|
||
|
||
AI may suggest only:
|
||
|
||
- visible Bristol form (Types 1–7);
|
||
- broad color;
|
||
- image quality.
|
||
|
||
Every suggestion is provisional, may abstain, and requires user review or correction before it can enter the journal. Symptoms remain user-entered, and journal saving is separate from training contribution consent.
|
||
|
||
### Prohibited inferences
|
||
|
||
AI must not infer or claim disease, bleeding, pain, urgency, fever, vomiting, treatment, causation, or whether a food is safe. It must not replace professional care, suppress deterministic red-flag escalation, or present a suggestion as a diagnosis.
|
||
|
||
### Conversational Hermes boundary
|
||
|
||
Timmy may expose a smart free-text conversation backed by a fully tool-capable Hermes Agent, but only through an authenticated, same-origin, server-side gateway. The browser never receives provider credentials or Hermes session IDs and cannot select the model, provider, tool policy, work directory, or internal session. Browser sessions use opaque HttpOnly cookies, bounded message and ledger sizes, single-flight turns, fixed time/rate/session limits, and sanitized output. Photos are excluded from chat context.
|
||
|
||
The application’s deterministic urgent-symptom guidance runs before chat and remains authoritative when Hermes is offline, slow, malformed, or conversationally mistaken. Hermes must not diagnose, invent symptoms, override escalation, or take external/destructive actions without explicit user intent and confirmation.
|
||
|
||
### Release authority
|
||
|
||
Hermes/Timmy is the release authority for routine engineering, test, build, deployment, and release-candidate preparation. Automated evidence must remain reproducible and must not overstate model accuracy or safety.
|
||
|
||
### Human gates
|
||
|
||
Human gates are limited to:
|
||
|
||
1. clinical and privacy review when language or policy crosses those boundaries;
|
||
2. beta consent before participation;
|
||
3. RC approval before shipping a release candidate.
|
||
|
||
Routine provisioning, deployment, label sweeps, and release-candidate assembly are not human-operated gates.
|
||
|
||
## Consequences
|
||
|
||
- Model output is assistive and fail-closed, never authoritative.
|
||
- A generic open-weight VLM can support bootstrap experiments but cannot become the production Bristol classifier without the documented calibration and evaluation evidence.
|
||
- Release evidence and demonstrations must use fictional or synthetic data and state the non-diagnostic boundary honestly.
|
||
|
||
## Evidence and governing references
|
||
|
||
- [Product brief and safety boundary](../PRODUCT.md)
|
||
- [AI execution evidence](../AI-EVIDENCE.md)
|
||
- [Sovereign vision decision and measured limitations](../research/SELF-HOSTED-STOOL-VISION.md)
|