timmy
29ea045671
Quality gates / quality (pull_request) Successful in 2m4s
- docs/PHOTO-DATAFLOW-THREAT-MODEL.md: browser, API ingress, model worker, transient buffers, training opt-in store, logs, exports, and deletion, with trust boundaries and a numbered threat register - every named abuse case (replay, oversized input, metadata leakage, poisoning, unauthorized training, operator access) carries a mitigation, an owner, a tracked follow-up ticket, and the artifact that will prove it - tests/threat-model.test.js enforces diagram coverage, owner/follow-up presence against ROADMAP ticket numbers, and the non-diagnostic boundary with synthetic-only fixtures - link the model from the accepted product decision record
63 lines
3.7 KiB
Markdown
63 lines
3.7 KiB
Markdown
# Product Boundary and Release Authority Decision
|
||
|
||
- **Status:** Accepted
|
||
- **Date:** 2026-08-20
|
||
- **Scope:** Photo-assisted bowel logging and release governance
|
||
|
||
## Context
|
||
|
||
Timmy can make a conservative visual suggestion from a user-selected image, but the available general-purpose model is not clinically validated. The product must preserve manual logging, deterministic red-flag escalation, and user control regardless of model availability or output.
|
||
|
||
## Decision
|
||
|
||
### Observable AI fields
|
||
|
||
AI may suggest only:
|
||
|
||
- visible Bristol form (Types 1–7);
|
||
- broad color;
|
||
- image quality.
|
||
|
||
Every suggestion is provisional, may abstain, and requires user review or correction before it can enter the journal. Symptoms remain user-entered, and journal saving is separate from training contribution consent.
|
||
|
||
### Prohibited inferences
|
||
|
||
AI must not infer or claim disease, bleeding, pain, urgency, fever, vomiting, treatment, causation, or whether a food is safe. It must not replace professional care, suppress deterministic red-flag escalation, or present a suggestion as a diagnosis.
|
||
|
||
### Conversational Hermes boundary
|
||
|
||
Timmy may expose a smart free-text conversation backed by a fully tool-capable Hermes Agent, but only through an authenticated, same-origin, server-side gateway. The browser never receives provider credentials or Hermes session IDs and cannot select the model, provider, tool policy, work directory, or internal session. Browser sessions use opaque HttpOnly cookies, bounded message and ledger sizes, single-flight turns, fixed time/rate/session limits, and sanitized output. Photos are excluded from chat context.
|
||
|
||
The application’s deterministic urgent-symptom guidance runs before chat and remains authoritative when Hermes is offline, slow, malformed, or conversationally mistaken. Hermes must not diagnose, invent symptoms, override escalation, or take external/destructive actions without explicit user intent and confirmation.
|
||
|
||
### Availability and draft retention
|
||
|
||
Logging must never depend on AI availability. When the vision worker is offline, disabled, or still unknown, the photo-first flow offers no AI action and no analysis-consent prompt, and manual Bristol entry remains one action away from every photo step. A chosen photo and any entered context are retained as an in-session draft with a visible summary and an explicit start over; drafts are deliberately not persisted to storage, so a photo awaiting consent is never written to disk. The service worker never caches analysis requests or image bodies.
|
||
|
||
### Release authority
|
||
|
||
Hermes/Timmy is the release authority for routine engineering, test, build, deployment, and release-candidate preparation. Automated evidence must remain reproducible and must not overstate model accuracy or safety.
|
||
|
||
### Human gates
|
||
|
||
Human gates are limited to:
|
||
|
||
1. clinical and privacy review when language or policy crosses those boundaries;
|
||
2. beta consent before participation;
|
||
3. RC approval before shipping a release candidate.
|
||
|
||
Routine provisioning, deployment, label sweeps, and release-candidate assembly are not human-operated gates.
|
||
|
||
## Consequences
|
||
|
||
- Model output is assistive and fail-closed, never authoritative.
|
||
- A generic open-weight VLM can support bootstrap experiments but cannot become the production Bristol classifier without the documented calibration and evaluation evidence.
|
||
- Release evidence and demonstrations must use fictional or synthetic data and state the non-diagnostic boundary honestly.
|
||
|
||
## Evidence and governing references
|
||
|
||
- [Product brief and safety boundary](../PRODUCT.md)
|
||
- [AI execution evidence](../AI-EVIDENCE.md)
|
||
- [Sovereign vision decision and measured limitations](../research/SELF-HOSTED-STOOL-VISION.md)
|
||
- [Photo data-flow threat model](./PHOTO-DATAFLOW-THREAT-MODEL.md)
|