8000 feat(ai): evidence-bound observations (partial #92) by shroominic · Pull Request #70 · shroominic/OpenGlucose · GitHub
[go: up one dir, main page]
Skip to content

feat(ai): evidence-bound observations (partial #92) - #70

Open
shroominic wants to merge 3 commits into
mainfrom
feature/ai-evidence-safety-contract
Open

feat(ai): evidence-bound observations (partial #92)#70
shroominic wants to merge 3 commits into
mainfrom
feature/ai-evidence-safety-contract

Conversation

@shroominic
@shroominic shroominic commented Aug 24, 2026 •
edited
Loading
Copy link
Copy Markdown
Owner

Scope

Partial implementation of #92. This PR does not close #92.

  • Adds a versioned, aggregate-only context and evidence-reference contract for remote observations.
  • Uses observation contract v2: a provider may return only a declarative evidence template, one cited evidence ID, and its matching numeric claim. OpenGlucose renders visible values and units locally; provider-authored display prose is rejected.
  • Requires a one-use real-generation consent receipt bound to the exact endpoint, model, prepared aggregate snapshot, and disclosed categories. A changed, mismatched, or reused receipt fails before provider I/O. The confirmation dialog shows the exact endpoint.
  • Names the shipped protocol truthfully as OpenAI-compatible chat completions. Native Anthropic Messages is not implemented or claimed.
  • Adds provider capability/config validation, bounded request limits and response bytes, generic non-reflective provider errors, no redirects, and a synthetic no-health-data connection test.
  • Persists statement-level evidence/numeric mappings and non-secret generation provenance. ADR 0004 and privacy documentation state the boundary and its limits.

R2 risk and rollback

Risk: a user-approved remote provider can receive aggregate health context, and a selected deterministic aggregate can still be a weak wellness observation. This code is not a medical-safety or production-readiness claim.

Rollback: disable cloud AI and remove the stored API key to stop future remote calls. There is no automatic remote fallback. Existing insights remain local repository records; complete product delete/export verification remains separate work.

Remaining #92 work

  • Approved retention/legal basis and complete delete/export verification.
  • Exact host OS-runtime capture.
  • Expanded adversarial evaluation and an accountable privacy/safety owner.
  • Independent R2 privacy/safety review before merge or public-distribution claims.

Verification

  • Core Dart analysis and focused provider/output/insight tests.
  • Full Flutter analysis and focused settings/transport tests.
  • Full make test-unit.
  • Normal pre-commit and full normal pre-push make check, including iOS and macOS native lanes.

Review request

Independent R2 review is required. Please verify the remote data boundary, receipt lifecycle, exact endpoint disclosure, structured-output safety boundary, privacy wording, and rollback claim.

@shroominic shroominic added area:ai AI providers, safety, grounding, and insight surfaces risk:R2 Health data, persistence, integration, AI, accessibility, or native risk labels Aug 24, 2026
@shroominic shroominic changed the title feat(ai): evidence-bound observations (partial #39) feat(ai): evidence-bound observations (partial #92) Sep 1, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned
5616

Labels

area:ai AI providers, safety, grounding, and insight surfaces risk:R2 Health data, persistence, integration, AI, accessibility, or native risk

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Feature] AI evidence, safety, and provider contract hardening

1 participant

@shroominic
0