# NIST AI RMF Current Source Enablement Plan V01

Issue: #225

Status: owner-approval and production enablement planning only. This PR does not enable production current retrieval.

## Purpose

Prepare the owner-approval package, production configuration plan, smoke matrix, rollback plan, and evidence requirements for enabling one current/public source for Package + current context.

This plan covers only the NIST AI Risk Management Framework candidate. It is not runtime registry configuration, Cloudflare configuration, package authority, policy approval, or permission to enable retrieval.

## Candidate Source Identity

| Field | Value |
|---|---|
| Candidate ID | `nist-ai-rmf-public-framework-candidate` |
| Source | NIST AI Risk Management Framework |
| URL | `https://www.nist.gov/itl/ai-risk-management-framework` |
| Allowed origin | `https://www.nist.gov` |
| Allowed path prefix | `/itl/ai-risk-management-framework` |
| Current approval status | `candidate_only` |
| Current retrieval enabled | `false` |
| Current trust label | `candidate_owner_review_required` |
| Current freshness label | `periodic_review_required` |
| Claim boundary | `current_public_context_only_not_package_authority` |

## Why This Is The First Source

NIST AI RMF is the first proposed current/public source because it is an authoritative public framework, stable enough for a controlled first-source test, relevant to package-supported questions about AI governance and risk, and less vendor-biased than pricing or platform-limit documentation.

The source is still only current/public context. It does not approve tools, models, vendors, workflows, data classes, production use, or enterprise policy.

## Current Candidate Registry State

Before this issue:

- the candidate registry contains four candidate entries
- every candidate remains `approval_status: "candidate_only"`
- every candidate remains `retrieval_enabled: false`
- NIST remains `approved_by: "not_approved"`
- NIST remains `approved_date: "not_approved"`
- NIST remains `review_due_date: "before_production_enablement"`

This PR must not edit `docs/product-architecture/current_source_registry_candidates_v01.json` to enable retrieval.

## Future Enablement Target State

A later owner-authorized production enablement may target this single source only:

- candidate ID: `nist-ai-rmf-public-framework-candidate`
- target approval status: `approved_for_single_source_production_test`
- target retrieval enabled: `true`
- production enablement status before that future change: `not_enabled`
- production enablement status after that future approved change: to be recorded by the later issue

The later change must keep the NIST source outside package authority and must not enable any other candidate.

## Required Owner Approval

Before a future production configuration change can enable this source, the issue or receipt must record:

- source owner confirmation that the page is public, non-sensitive, and credential-free
- approver identity or role for production single-source testing
- approval date
- review due date
- allowed origin confirmation
- allowed path prefix confirmation
- redirect behavior confirmation
- trust label
- freshness label
- claim boundary
- acceptable query categories
- unacceptable query categories
- rollback owner
- production smoke owner

Proposed source owner field: `National Institute of Standards and Technology`.

Proposed approver field: `package_governance_owner_review_required`.

## Allowed Retrieval Boundary

Allowed:

- HTTPS GET from `https://www.nist.gov`
- path under `/itl/ai-risk-management-framework`
- credentials omitted
- server-side retrieval only through `allowlisted_public_fetch`
- current/public citations with retrieval timestamp, source type, trust label, freshness label, and claim boundary

Not allowed:

- wildcard hosts or paths
- redirects outside `https://www.nist.gov/itl/ai-risk-management-framework`
- browser-side current-source requests
- user-provided URLs
- arbitrary web search
- cookies, credentials, session state, or private network access
- promotion into package, context-pack, CLM, or owner-validated internal authority

## Trust, Freshness, And Claim Boundary Labels

Future single-source test target labels:

- source type: `public_standards_or_regulatory`
- trust label: `owner_approved_authoritative`
- freshness label: `periodic_review_required`
- claim boundary: `current_public_context_only_not_package_authority`

The trust label must not be updated in production config until owner approval evidence is recorded.

## Intended Use Cases

Acceptable query categories after future approval:

- AI governance framework comparison where approved package support already exists
- AI risk management language interpretation
- source-quality and claim-boundary explanation
- package/current comparison for public governance framing
- capability discipline questions that need a current public framework reference

## Non-Use Cases

Unacceptable query categories:

- approving a tool, model, vendor, workflow, data class, or production use
- replacing package guidance
- resolving package/current conflicts without labeling both lanes
- answering unsupported no-package prompts
- producing enterprise policy
- interpreting internal policy-sensitive claims without owner validation
- general NIST search or retrieval beyond the allowed path
- cybersecurity, privacy, compliance, legal, procurement, or audit conclusions beyond what package-supported context can justify

## Future Cloudflare Configuration Plan

This PR does not change Cloudflare configuration.

A later owner-authorized enablement issue must configure current-context retrieval outside the repository using deployment environment settings only. The repository may name expected settings but must not store production values.

Expected setting names:

- `AICD_CURRENT_CONTEXT_ADAPTER`
- `AICD_CURRENT_CONTEXT_SOURCE_REGISTRY_JSON`
- `AICD_CURRENT_CONTEXT_MAX_REFS`
- `AICD_CURRENT_CONTEXT_RESPONSE_BYTE_LIMIT`
- `AICD_CURRENT_CONTEXT_SNIPPET_CHAR_LIMIT`
- `AICD_CURRENT_CONTEXT_TIMEOUT_MS`

Required future configuration posture:

- adapter setting selects `allowlisted_public_fetch`
- registry value contains exactly one owner-approved NIST entry for the single-source test
- no source credentials are configured
- no browser-visible current-source registry is added
- no repo-tracked production registry JSON is added
- Cloudflare Access and WAF remain separate external controls unless a later issue explicitly scopes them

## Validation Gates Before Enablement

Before a future PR or config change can enable the source:

- `python3 validation/scripts/check_current_source_registry_governance.py`
- `python3 validation/scripts/check_minimal_external_chat_proof.py`
- `python3 validation/scripts/check_published_site_contract.py`
- `.venv/bin/python validation/scripts/check_published_site_contract.py --browser required`
- production smoke proving package-only default behavior
- production smoke proving Package + current context is explicit
- production smoke proving no-package prompts block current retrieval and provider execution
- validation that current/public citations remain separate from package citations
- validation that browser direct provider calls remain `0`
- validation that browser direct current-source calls remain `0`
- validation that rollback can disable retrieval without code changes

## Future Deployment Steps

Later enablement must:

1. Confirm owner approval evidence and review due date.
2. Prepare the single-source registry value outside the repository.
3. Configure deployment environment settings outside the repository.
4. Deploy or refresh the Cloudflare Pages environment.
5. Run disabled-state smoke before enablement if possible.
6. Run enabled-state single-source smoke after enablement.
7. Record production evidence in a validation receipt.
8. Keep rollback ready until smoke passes.

## Production Smoke Matrix

| Smoke case | Expected result before enablement | Expected result after future approved enablement |
|---|---|---|
| Package-only default | Package-only remains default | Package-only remains default |
| Package-only supported prompt | Provider call routes only through `/api/source-grounded-chat` | Provider call routes only through `/api/source-grounded-chat` |
| Package + current context selected | Explicit mode, retrieval not enabled | Explicit mode, NIST retrieval may run only after package support exists |
| Current context text | `Current/public source says` reports that current/public context was not retrieved. | NIST current/public context appears only with separate citations |
| External retrieval count | `0` | `1` or bounded configured count for the single source |
| Current/public citation count | `0` | NIST citation count only |
| Unsupported or no-package prompt | blocks current retrieval and provider execution | blocks current retrieval and provider execution |
| Direct browser provider calls | `0` | `0` |
| Direct browser current-source calls | `0` | `0` |
| Secrets rendered | none | none |
| Redirect outside allowed path | not applicable while disabled | fail closed |
| Registry with more than one source | not configured | fail validation for this single-source test |

## Rollback Plan

Rollback must be possible without code changes:

1. Disable or remove the current-context adapter setting in the deployment environment.
2. Remove or clear the deployment registry value.
3. Redeploy or refresh the Cloudflare Pages environment.
4. Run smoke proving Package + current context returns a visible `Current/public source says` not-retrieved diagnostic.
5. Record rollback evidence with timestamp, operator, and production URL.

Rollback must not require changing Cloudflare Access or WAF.

## Failure Modes

- NIST page unavailable, returns non-200, or changes content type.
- NIST page redirects outside allowed origin or path prefix.
- Registry value includes more than one source.
- Source is treated as package authority in answer rendering.
- Unsupported prompt triggers current retrieval.
- Browser performs direct current-source fetch.
- Browser performs direct provider call.
- Current/public citation metadata is missing trust, freshness, claim boundary, or retrieval timestamp.
- Cloudflare setting is applied to the wrong environment.
- Rollback cannot restore disabled retrieval without code changes.

## Monitoring And Observation Expectations

The future enablement receipt must record:

- production URL
- deployment target
- source ID retrieved
- retrieval status
- retrieval count
- current/public citation count
- direct browser provider request count
- direct browser current-source request count
- provider request route
- no-secret rendering check
- rollback command or operator action evidence without secret values

This plan does not add durable telemetry, database storage, vector storage, Supabase, uploads, or session attachments.

## Evidence Checklist

Before a future PR or config change enables NIST retrieval, the operator must provide:

- owner approval evidence
- approver field
- approval date
- review due date
- final allowed origin and path prefix
- trust label
- freshness label
- claim boundary
- production environment setting names without values
- production smoke evidence
- rollback evidence
- confirmation that only one source is enabled
- confirmation that NIST is not package authority
- confirmation that Cloudflare Access/WAF were not changed unless explicitly scoped
- confirmation that no secrets were exposed

## Boundary Confirmation For This PR

This PR does not:

- enable production current retrieval
- change Cloudflare environment variables
- change Cloudflare Access or WAF
- add secrets
- add runtime production registry config
- add arbitrary web search
- add browser-side current-source fetches
- add user-provided URL retrieval
- add durable telemetry, database, vector store, Supabase, uploads, or session attachments
- enable more than one source
- promote NIST or any current/public source into approved package authority
- apply `codex-automerge`