Workspace AI consent

Workspace AI is an explicit opt-in owned by the workspace. Creation starts unchecked. Workspace Settings → AI edits a draft; Save publishes the confirmed choice, Cancel discards it, and concurrent saves cannot restore an older choice.

Authoritative policy

The sync-server workspace row stores ai_consent_state (unset, disabled, enabled), ai_disclosure_version, ai_consent_revision, and a server change timestamp. Only enabled state with disclosure version 1 authorizes inference. Missing, malformed, loading or unreadable policy is off. Local settings imports, workspace templates, device defaults and cached key sessions confer no consent.

Migration 0042_workspace_ai_consent.sql adds the columns. Applying that schema remotely and deployment require a separate authorized operation. This feature has not applied remote schema or reset any data.

Creation records the policy and immutable genesis name/consent recipe in the same insert. Provisioning retries compare the original recipe, even after a rename or consent change. A retry cannot overwrite later revocation. Policy updates use compare-and-swap against the opening revision; metadata-only updates leave consent unchanged. Enable transitions are never queued for offline replay.

Requests and durable execution

Assistant ingress retains authenticated server-minted conversation identities. Before quota or conversation admission it validates the owner, workspace binding, confirmed consent and revision. The quota statement checks the policy again in its atomic write. Inline requests require the same workspace/revision binding. Authenticated static history, abort and deletion remain available while off. App-owned proposal application carries the captured consent revision to its automation document write; generic document writes remain independent.

The pinned Flue 2.0.3 public hooks reconstruct execution identity from immutable useInitialData() and the ingress-authored workspace-user-request signal read by useDelivery(). Its revision travels in model configuration through the supported model/provider seam (with the real model’s context limits preserved), never through a mutable global workspace variable or a model-supplied tool argument. The provider decodes that identity, checks D1 before every inference (including retries/compaction/recovery), and then dispatches the existing Workers AI model. Tool wrappers recheck policy before execution and lazy credential use. A one-second, serialized policy watcher also aborts stalled model admissions and readers, rather than waiting for a subsequent model chunk. The supported binding receives an AbortSignal. Signal attributes contain no keys, bearer tokens, prompt copies or note text. A bounded metadata-only alias catalog retains the original model’s compaction and output limits across recovered renders. Existing note access and skill trust remain separate requirements.

AI_DISABLED, AI_CONSENT_STALE, AI_WORKSPACE_REQUIRED and AI_WORKSPACE_FORBIDDEN distinguish policy denials. Live Assistant updates and inline chunks recheck policy before publishing output. No denial automatically enables AI or renews consent.

Renderer lifecycle

The shared bridge policy store clears at account/workspace boundaries. Turns capture a revision and abort signal; a changed policy or scope aborts them and makes late events/results inapplicable. A three-second authoritative refresh and window-focus refresh reconcile other-device changes; server execution guards remain authoritative throughout that refresh interval.

AI capture/keymaps use a CodeMirror compartment. Revocation preserves document, selection and undo history, and leaves snippet triggers independent. AI commands, settings, help launch actions, Snippet AI and local-agent connect controls follow availability. Registered provider identity remains available through get/has; pickers filter unavailable providers. Frameset rendering projects available leaves without mutating the saved tree. Normal editor fibers survive that projection; saved Assistant tabs/history/layout metadata can be recovered later.

Generic document, terminal, search, sync, history, snippet and locally summarized list operations remain available. App-owned MCP Assistant calls read authoritative consent and send the captured revision. Independently running external programs are outside this application's control.

Note Tray reference authority

A structurally bound Assistant captures one immutable conversation context: workspace, source tray, folder/sticker scope, complete UUID/version membership, unavailable members, creation defaults and the configured sticker field. The existing workspace note index supplies the collection, including pending notes; rendered cards and the focused editor are not membership authorities. Sticker evidence must describe the exact captured body and metadata revision. Dirty or pending references remain explicit unavailable members rather than being replaced with the latest saved version. Reopening a conversation restores its context; changing the tray requires an explicit new conversation.

Each send freezes its prompt bytes and context. A bound note prompt reads the latest live body once at Send, preserves the source note, and excludes its UUID from reference tools. Scoped or bound-note turns never inherit ambient active-note context from another frame. Transport retry keeps the same send identity and payload; an explicit Retry has a new send identity linked to the same immutable original payload. It cannot expand the reference set or silently refresh versions.

Migration 0054_ai_note_admissions.sql extends existing shared D1 conversation and admission records. Ingress proves the owned key session and current consent before persisting a scoped context. It validates every reference page against the sync server's immutable history before admitting the turn. Finalization, first-send quota and conditional credential publication are transactional. Every automatic tool carries its original admission ID through mandatory /ai routes; an older delivery cannot borrow a newer turn's credentials. List, read, search and nested Kanban operations all enforce the same membership and prompt exclusion.

This AI context is intentionally different from the opaque numbering index. Under explicit Workspace AI consent and a valid key session, the AI service receives the source name, scope/default folder and sticker, configured field, UUID/version membership and explicit prompt text needed for that conversation. Those labels are not needed by, or sent to, the numbering operation. The canonical identity index still stores opaque encrypted-path associations without plaintext paths, stickers or bodies. No new independent note database is introduced.

Proposal registration fixes the original target, body digest, base version, location revision and operation identity before returning an Apply preview. Canonical note targets and unbound general-file targets are distinct; a file-row ID is never treated as a note UUID. Human Apply uses current interactive access and the original proposal authority, independently of a later automatic turn's nonce. Fresh writes and number reservations have atomic consent/session/expiry fences. Exact completed receipts can be inspected after the original grant expires under current authorized access, but that replay cannot perform another write.

Answer saves retain their own captured defaults and optional local overrides. The existing conversation record must persist the save attempt's UUID, operation, origin and body before calling the existing pending-note journal. It must persist the result association before acknowledging that journal's origin. A failed conversation-cache write therefore leaves recoverable text and the same creation identity. Neither the prompt nor the conversation is deleted by saving an answer.

Cancellation limits and verification

Revocation prevents further inference/tool work, cancels supported client work, and suppresses late publication/application. Data already transmitted cannot be recalled. No provider-side erasure, retention or model-training claim is made.

Fake-backed tests exercise policy persistence, CAS, retry recipes, auth/quota boundaries, bridge invalidation and an actually crashed/recovered Flue submission using throwaway SQLite state. Desktop browser viewport checks do not establish native macOS/Tauri popout, Android/Samsung IME or iOS behavior. The implementation inventory and command/revision ledger are in doc/workspace-ai-consent/.