# NIST AI RMF Current Source Owner Authorization V01

Issue: #227

Authorization date: 2026-06-24

Status: owner authorization recorded for the next single-source production current-context test. This PR does not enable production current retrieval.

## Owner Authorization Statement

Tony authorizes the project to prepare for enabling exactly one current/public source for a controlled production test.

This authorization covers only the NIST AI Risk Management Framework candidate source and only the later production configuration step required to test server-side current/public retrieval through `allowlisted_public_fetch`.

Actual production enablement requires the next issue or ticket after this record is merged.

## Approved Source Identity

| Field | Value |
|---|---|
| Candidate ID | `nist-ai-rmf-public-framework-candidate` |
| Source | NIST AI Risk Management Framework |
| URL | `https://www.nist.gov/itl/ai-risk-management-framework` |
| Allowed origin | `https://www.nist.gov` |
| Allowed path prefix | `/itl/ai-risk-management-framework` |
| Source type | `public_standards_or_regulatory` |
| Candidate registry trust label | `candidate_owner_review_required` |
| Authorized target trust label | `owner_approved_authoritative` |
| Freshness label | `periodic_review_required` |
| Claim boundary | `current_public_context_only_not_package_authority` |
| Source owner | National Institute of Standards and Technology |
| Authorized by | Tony |
| Authorized scope | Single-source production current-context test only |

## Authorized Scope

The later production test may enable only:

- candidate ID: `nist-ai-rmf-public-framework-candidate`
- source: NIST AI Risk Management Framework
- retrieval mode: server-side `allowlisted_public_fetch`
- approved sources count: `1`
- target approval status: `approved_for_single_source_production_test`
- target retrieval enabled: `true` in the later Cloudflare configuration step only
- production target state after this PR: `authorized_not_enabled`

Package-only default remains unchanged.

Package + current context remains explicit and package-first.

Current/public context remains separately labeled and separately cited. It is not package authority.

## Exact Boundaries

This authorization prohibits:

- browser-side current-source fetches
- arbitrary web search
- user-provided URL retrieval
- additional current/public sources unless separately approved
- current/public source promotion into approved package authority
- runtime production retrieval in this PR
- repo-tracked production registry values
- secrets in repo files
- Cloudflare account IDs, tokens, secret values, provider keys, or production environment values in repo files
- durable telemetry, database, vector store, Supabase, uploads, or session attachments
- Cloudflare Access/WAF changes in this PR
- `codex-automerge`

## Explicit Non-Goals

This PR does not:

- change Cloudflare environment variables
- change Cloudflare production config
- change Cloudflare Access or WAF
- enable production current retrieval
- add arbitrary web search
- add browser-side current-source fetches
- add user-provided URL retrieval
- enable more than one source
- promote NIST or any current/public source into approved package authority
- add secrets
- add durable telemetry, database, vector store, Supabase, uploads, or session attachments

## Allowed Production-Test Behavior

After this authorization is merged, a later issue may prepare and apply external Cloudflare configuration for one source only.

That later issue must keep the registry value outside the repository, must omit source credentials, and must prove that retrieval happens only inside the server-side `/api/source-grounded-chat` boundary.

The later test must fail closed if the NIST URL redirects outside `https://www.nist.gov/itl/ai-risk-management-framework`, returns unsafe content, exceeds configured limits, or appears without approved package support.

## Required Evidence Before Cloudflare Config Change

Before any later Cloudflare configuration change, the next issue or ticket must record:

- this owner authorization record
- exact source metadata from `current_source_registry_candidates_v01.json`
- allowed origin and path prefix confirmation
- target trust label
- freshness label
- claim boundary
- source owner
- approver
- approval date
- single-source registry contents without secret values
- validation gates
- production smoke gates
- rollback gates
- confirmation that Cloudflare Access/WAF are unchanged unless separately scoped

## Runtime Safety Constraints

The later production test must preserve:

- package-only default behavior
- explicit Package + current context selection
- no-package prompt refusal before current retrieval
- server-side-only provider calls
- server-side-only current/public retrieval
- `0` direct browser provider calls
- `0` direct browser current-source calls
- no secret rendering
- separate package citations and current/public citations

## Validation Gates

Required validation before the later production configuration step:

- `git diff --check`
- `node --check docs/assets/source-grounded-chat-proof.js`
- `node --check functions/api/source-grounded-chat.js`
- `python3 -m py_compile validation/scripts/check_published_site_contract.py validation/scripts/check_minimal_external_chat_proof.py validation/scripts/check_current_source_registry_governance.py`
- `python3 validation/scripts/check_current_source_registry_governance.py`
- `python3 validation/scripts/check_minimal_external_chat_proof.py`
- `python3 validation/scripts/check_published_site_contract.py`
- `.venv/bin/python validation/scripts/check_published_site_contract.py --browser required`
- `python3 validation/scripts/run_all.py`

## Production Smoke Gates

The later production smoke must confirm:

- Package-only remains default
- Package-only supported prompt calls the provider only through `/api/source-grounded-chat`
- Package + current context remains explicit
- NIST retrieval occurs only after package support exists
- current/public citation count is limited to the NIST source
- unsupported or no-package prompt blocks current retrieval and provider execution
- direct browser provider calls remain `0`
- direct browser current-source calls remain `0`
- no secrets are rendered

## Rollback Expectation

Rollback must be possible without code changes:

1. Disable or remove the current-context adapter setting in the deployment environment.
2. Remove or clear the deployment registry value.
3. Redeploy or refresh the Cloudflare Pages environment.
4. Run smoke proving Package + current context returns a visible `Current/public source says` not-retrieved diagnostic.
5. Record rollback evidence with timestamp, operator, production URL, and no secret values.

Rollback must not require changing Cloudflare Access or WAF.

## Boundary Confirmation For This PR

This PR does not change Cloudflare configuration.

This PR does not enable production current retrieval.

This PR does not alter the candidate registry to enable retrieval.

NIST remains authorized for the next single-source production config step, but NIST remains not enabled until that later step is completed and smoke-tested.