# Package + Current Context Mode Design Issue: #186, extended by #219 ## Purpose Package + current context exists for questions where approved package guidance is still the source of record, but separately cited current or public context may help a reader interpret, compare, or update the package-bound answer. Package-only mode remains the default. The default assistant behavior continues to answer from the approved playbook package only, with package citations or a deterministic refusal. Package + current context is not a general chat mode. It is only for playbook-related questions where current public context is relevant to architecture, governance, AI capability formation, source quality, tokenomics, model behavior, platform posture, or other approved package topics. This design does not enable general live external retrieval, session uploads, durable telemetry, database storage, whole-site Access decisions, provider-secret changes, or public unauthenticated provider execution. #219 adds a disabled-by-default controlled current/public retrieval adapter that can run only server-side after approved package support exists. ## Source Boundary Model ### Package Says The Package says lane uses only approved corpus material. Allowed source basis: - approved context-pack rows - approved package artifacts - existing package citations - reader targets and source paths carried by the package - package source-quality and claim-boundary metadata Authority: - Source of record for playbook doctrine, package guidance, and package-defined boundaries. - Current or external sources cannot silently override this lane. - If package support is absent and policy requires package support, the assistant refuses before any provider call. Required label: `Package says`. ### Current/Public Source Says The Current/public source says lane uses explicit current or external sources only. Allowed source basis: - current/public citation records supplied by an approved retrieval adapter - source URL or stable reader target - retrieval date/time - source type - source quality/trust label - freshness indicator - claim boundary Authority: - Not durable package authority. - This lane is not durable package authority. - Not a replacement for package guidance. - Not approval for tools, vendors, data classes, production use, enterprise policy, GxP use, or regulated use. - Must be separately cited and visibly distinct from package citations. Required label: `Current/public source says`. ### Synthesis / Implications The Synthesis / implications lane may derive implications only from the Package says and Current/public source says lanes. Rules: - Do not introduce uncited claims. - This lane must not introduce uncited claims. - Preserve conflicts instead of hiding them. - State when a conclusion is an implication, not source evidence. - Identify whether each key claim is supported by package sources, current/public sources, or both. - If the synthesis would require private, internal, policy, approval, or owner evidence that is not present, say what evidence or decision owner is needed. Required label: `Synthesis / implications`. ## User-Facing Mode Language Mode name: Package + current context Short description: Compare approved package guidance with separately cited current context. Boundary note: Package guidance remains the source of record. Current context must be cited separately and may be stale, incomplete, or not approved. Non-chat warning: This is not general chat. Questions must relate to the playbook, architecture, governance, AI capability formation, or approved package topics. Disabled-state copy, if a future UI placeholder is added before retrieval is enabled: Design pending. Not enabled. Package-only mode remains the live assistant mode. ## Request Contract A Package + current context request must include: - `mode`: `Package + current context` - `user_question`: the user's question, bounded to approved package topics - `selected_package_refs`: selected package citations, source paths, reader targets, source families, source quality labels, and claim boundaries - `current_external_source_refs`: current/public source refs, if any, with URL or reader target, retrieval time, source type, trust label, freshness indicator, and claim boundary - `source_boundary_labels`: at least `Package says`, `Current/public source says`, `Synthesis / implications`, and `Divergence / update candidate` - `citation_classes`: package citation, current/public citation, uploaded/session citation reserved for #187, and internal/operator citation - `refusal_patterns`: no package support, no current source support, package/current source conflict, stale or weak current source, unsupported general chat, unsupported approval request, and private/internal data request - `derivative_output_label`: generated synthesis is derivative interpretation, not source evidence, policy approval, or production approval - `telemetry_fields`: mode, package refs selected, current refs selected, provider/model, token usage, latency, refusal state, citation class counts, source freshness, external retrieval count, cost estimate future, and durable logging future #189 The contract must not include arbitrary file ingestion, hidden memory, private data, source material without disclosure, browser-visible provider secrets, cookies, OTP values, or unapproved internal-only content. ## Citation Model Citation classes: - `package citation`: approved package corpus or artifact citation. This is the only citation class that can support Package says. - `current/public citation`: current or external public source citation. This supports Current/public source says only and does not become durable source authority by default. - `uploaded/session citation`: future only, reserved for #187. This design does not implement session file uploads. - `internal/operator citation`: not user-facing unless explicitly approved for the source boundary. Use only for operator receipts, protected implementation evidence, or internal review context. Each citation must carry: - title - source family/type - URL or reader target - retrieval time for current/external sources - source quality/trust label - claim boundary - freshness indicator where applicable Visual and semantic separation: - Package citations and current/public citations must render as distinct classes. - The answer must not merge package and current citations into one undifferentiated evidence list. - Citation counts should be summarized by class in run telemetry. - The proof UI renders answer prose through a narrow safe renderer. Provider text is not inserted as raw HTML. - Package citation actions use clean section or raw-source CTAs. Canonical reader section targets use `/html/...#anchor` links when the package metadata provides an unambiguous reader target. - Current/public citation actions remain separate from package citation actions and must continue to disclose that current/public context is not package authority. ## Refusal Model The mode refuses or narrows when source support is insufficient. No package support: - If the question is outside approved package topics, refuse with the package not-found pattern. - If policy requires package support before current retrieval, do not call the provider or retrieval adapter. - Response should say that no approved package support was found. No current source support: - If package support exists but current context was requested and no current/public citation supports the current claim, answer package-only and state that current context was not found. - Do not invent current claims from model memory. Package/current source conflict: - State the conflict explicitly. - Identify which claim comes from package sources and which claim comes from current/public sources. - Do not resolve by model preference. - Say what owner decision, evidence, policy source, or validation would be needed. Stale or weak current source: - Label the current source as stale, weak, incomplete, vendor/self-published, community, news, standards, documentation, unknown, or otherwise limited. - Use cautious language and avoid overclaiming. - Prefer package guidance when the decision depends on playbook doctrine. Unsupported general chat: - Refuse prompts unrelated to the playbook, architecture, governance, AI capability formation, or approved package topics. - Do not become free-for-all general chat. Unsupported approval request: - Refuse requests for tool approval, production approval, data approval, vendor approval, SaaS approval, GxP approval, workflow approval, model approval, security approval, legal approval, regulatory approval, or company policy approval unless approved sources explicitly contain that approval. - Preserve the existing approval-boundary refusal language. Private/internal data request: - Refuse private or internal data requests unless the data is explicitly inside an approved source boundary for the user-facing mode. - Do not expose provider secrets, Cloudflare tokens, cookies, OTP values, private files, operator-only receipts, or internal-only content. ## Conflict Model When package and current context conflict: - state the conflict explicitly - do not resolve by model preference - identify which claim comes from package sources versus current context - preserve both cited claims when both are source-supported - say what decision owner, source owner, policy source, validation evidence, or freshness review is needed - avoid implying enterprise approval Conflict answer shape: 1. Package says: cite package source and claim boundary. 2. Current/public source says: cite current/public source, retrieval time, trust label, and freshness indicator. 3. Conflict: name the difference plainly. 4. Decision needed: identify owner or evidence needed. 5. Synthesis / implications: provide only bounded implications tied to the two cited lanes. ## Trust And Freshness Model Every current/external source must include: - retrieved date/time - source type - credibility/trust posture - freshness limitation - whether it is authoritative, vendor/self-published, community, news, standards, documentation, or unknown - claim boundary - whether the source is suitable for comparison, interpretation, implementation screening, or decision support Trust labels should be conservative: - `authoritative`: standards body, official documentation, regulator, policy source, or approved owner source - `vendor/self-published`: useful but potentially biased or incomplete - `community`: useful signal, not authority - `news`: time-sensitive and potentially incomplete - `documentation`: useful for implementation facts, not enterprise approval - `unknown`: do not rely on it for decision support Freshness language must be visible when a source is time-sensitive. Stale current context can support a historical observation, but not a current recommendation unless refreshed. ## Enterprise Portability Keep the design tool-agnostic. Examples are examples only: - approved search/retrieval provider - enterprise LLM gateway - sanctioned cloud platform - approved identity/access layer - enterprise logging/telemetry store Use the tooling your enterprise has approved. The pattern is portable; the governance controls are not optional. This design must not prescribe GitHub, Cloudflare, OpenAI, Codex, or any personal stack. Specific products are implementation examples only and are not approval for every company. ## Privacy And Data Boundary Privacy rules: - no durable ingestion without explicit design - no hidden memory as source authority - no user question logging unless telemetry/privacy model approves it - current/external sources must be disclosed - private data must be refused unless explicitly in an approved source boundary - no arbitrary files, uploads, or session attachments in this issue - no browser-visible provider credentials or current-source credentials - no operator-only receipts in user-facing answers unless approved The mode must treat source disclosure as part of safety. A claim supported by hidden memory, provider priors, private browsing state, or an undisclosed retrieval result is unsupported. ## Telemetry Requirements Define these fields now without implementing durable #189 telemetry: - mode - package refs selected - current refs selected - provider/model - token usage - latency - refusal state - citation class counts - source freshness - external retrieval count - cost estimate, future - durable logging, future #189 Telemetry must distinguish package-only behavior, retrieval-skipped behavior, current-retrieval behavior, provider-called behavior, provider-skipped behavior, and deterministic refusal behavior. ## Validation Strategy Validation cases: - package-only behavior unchanged - current mode UI is explicitly separate if a placeholder is later added - no current claims without current citations - unsupported general chat refused - no provider call when package support is absent and policy requires refusal - conflict response separates claims - citation classes are visually distinct - current source freshness is visible - direct browser provider calls remain prohibited - Access/WAF unaffected - no live current/external retrieval in Phase 0 - no file uploads in Phase 0 - no durable telemetry/database in Phase 0 - no mandatory vendor/tool stack language ## Implementation Phases Phase 0: design only - Create this design artifact. - Add deterministic validation that the design preserves source boundaries. - Do not alter live assistant behavior. Phase 1: disabled/placeholder UI affordance, if desired - Add a disabled mode placeholder only if a later issue asks for it. - It must say Design pending or Not enabled. - It must not imply current retrieval is live. Phase 2: controlled retrieval adapter design and v01 implementation - Define an approved retrieval adapter contract. - Require disclosed current/public source refs before any current claim is generated. - Keep retrieval server-side or behind an approved enterprise boundary. - Implement `allowlisted_public_fetch` only behind explicit server-side configuration. - Preserve disabled or unconfigured behavior when no valid source registry exists. Phase 3: provider contract and citation separation - Extend the provider request contract to carry package citations and current/public citations as separate classes. - Require answer sections for Package says, Current/public source says, Synthesis / implications, and Divergence / update candidate. Phase 4: telemetry/privacy review - Review whether user question logging, retrieval logs, token usage, cost estimates, and durable records are allowed. - Do not implement durable logging until #189 or a successor issue approves it. Phase 5: production-gated rollout - Run protected smoke tests. - Confirm no direct browser provider calls. - Confirm Access, WAF, rate limiting, privacy, and citation display controls remain intact. - Roll out only after owner review of source boundaries, retrieval controls, telemetry/privacy posture, and enterprise portability wording. ## UI Mode History #186 defined the mode design before runtime behavior changed. #216 added the explicit Package + current context selector while keeping retrieval disabled. #219 adds the first controlled server-side retrieval adapter behind configuration. The selector must continue to make Package-only the default and Package + current context an explicit opt-in. ## Controlled Current/Public Retrieval Adapter V01 Issue #219 implements the first narrow current-context slice. It is package-first, server-side only, allowlisted, cited, and auditable. Scope: - Package-only remains the default runtime route. - Package + current context remains explicit opt-in. - Current retrieval runs only after approved package support exists. - If package support is absent, the assistant refuses before current retrieval and before provider execution. - Current/public refs are returned as `current/public citation` records and as `current_external_source_refs`. - Current/public refs do not become package authority, context-pack authority, CLM authority, or owner-validated internal evidence. - Provider synthesis over current refs is enabled by Package + Current Synthesis V01 when approved package refs and retrieved current/public refs are both present. Allowed source model: - Adapter name: `allowlisted_public_fetch`. - Default adapter: `disabled`. - Registry source: server-side `AICD_CURRENT_CONTEXT_SOURCE_REGISTRY_JSON`. - Missing, invalid, empty, or unsafe registry: behave as disabled or unconfigured and return no current/public refs. - Source records must include `id`, `title`, `url`, `allowed_origin`, `allowed_path_prefix`, `source_type`, `trust_label`, `freshness_label`, `claim_boundary`, and optional `query_terms`. - Production behavior must use real approved source records, not schema examples or placeholder domains. Adapter constraints: - HTTPS only. - GET only. - No credentials. - No cookies. - No browser-side fetches. - No arbitrary user-provided URLs. - No private IPs, localhost, link-local, internal hostnames, URL credentials, or unsafe redirects. - Redirects must stay inside the configured origin and path prefix. - Timeout required. - Response byte limit required. - Text extraction limit required. - Supported content types limited to safe public text, HTML, Markdown, JSON, or JSON-like text. - Maximum current/public refs per run is capped at 3. - Maximum current snippet chars per source is capped at 1200. - Retrieval metadata must include retrieval timestamp and source-class labels. - Parsing, timeout, unsafe URL, blocked domain, oversized response, unsupported content type, or redirect failure must fail closed. Required current/public metadata: - title - source URL or stable reader target - retrieval timestamp - source type - trust label - freshness label - claim boundary Failure modes: - `disabled`: default adapter. No current/public refs are retrieved. - `unconfigured`: adapter requested but registry missing, invalid, empty, or unsafe. - `not_retrieved`: registry exists but no source matches the package-supported question. - `fail_closed`: selected sources failed timeout, parsing, size, content-type, redirect, or allowlist checks. - `retrieved`: at least one current/public ref was fetched and normalized with required metadata. Privacy and data boundary: - No durable storage, database, vector store, Supabase, hosted retrieval service, upload flow, session attachment, or telemetry persistence is introduced. - No provider secret, Cloudflare token, cookie, credential, OTP, private file, or internal-only source is exposed. - Current/public retrieval results are disclosed to the user as separate current/public citations. - Browser direct provider calls remain prohibited. - Browser direct current-source calls remain prohibited. - Cloudflare Access and WAF are not changed by this adapter. Validation expectations: - Package-only default remains unchanged. - Package-only supported prompts still call the provider through `/api/source-grounded-chat`. - Package + current context remains explicit. - No package support blocks current retrieval and provider execution. - Disabled or unconfigured adapter returns the Not retrieved placeholder. - Configured test adapter returns separately cited current/public refs with all required metadata fields. - Current/public citations are visually and semantically distinct from package citations. - Current/public refs do not become approved package authority. - Oversized, unsafe, unsupported, or blocked current-source responses fail closed. - Direct browser provider request count remains 0. - Direct browser current-source request count remains 0. - No secrets are rendered. - No durable storage is introduced. ## Package + Current Synthesis V01 Issue #237 implements runtime synthesis for the first enabled Package + current context path. It does not enable new current/public sources. It uses the existing `allowlisted_public_fetch` adapter and the current production posture where NIST AI RMF is the only enabled current/public source. Package-first behavior: - Package-only remains the default runtime mode. - Package-only answers use approved package refs only or refuse. - Package + current context remains explicit and opt-in. - The runtime refuses before current retrieval and before provider execution when approved package refs are absent. - Current retrieval runs only after approved package support exists. Current/public evidence behavior: - Current/public refs are retrieved only through the configured server-side allowlisted adapter. - Current/public refs remain `current/public citation` records and remain outside approved package authority. - Current/public refs do not become package, context-pack, CLM, owner-validated internal, or policy authority. - NIST AI RMF remains current/public context only unless a future human-reviewed package update promotes specific package text through issue, PR, validation, receipt, and release discipline. Package + Current NIST routing fix V01: - Issue #239 fixes source selection for natural NIST prompts without enabling any new current/public source. - The server keeps registry-configured `query_terms` and adds source-id-scoped aliases only for the existing `nist-ai-rmf-public-framework-candidate` entry. - Matching aliases include `NIST`, `NIST principles`, `NIST AI RMF`, `AI RMF`, `AI Risk Management Framework`, and governance or risk management framework expectation phrasing. - The alias map is evaluated only after approved package refs exist and only inside the server-side current-source adapter path. - The alias map does not add arbitrary web search, does not add browser-side current-source fetches, and does not promote NIST into approved package authority. - Non-NIST Package + current context prompts do not route to NIST only because current context is requested. Four-lane answer model: 1. `Package says` 2. `Current/public source says` 3. `Synthesis / implications` 4. `Divergence / update candidate` The provider prompt carries package refs and current/public refs in separate source groups. The answer must preserve those lanes and cite package and current/public evidence separately. Divergence/update candidate behavior: - The divergence lane names gaps, conflicts, stale package wording, source-scope mismatches, or unresolved differences when cited sources support that finding. - The divergence lane may propose a human-reviewed update candidate, but it cannot mutate package authority. - If no direct divergence is found, the answer uses this exact fallback: `No direct divergence found in the cited sources. No package update candidate is proposed from this answer alone.` Provider execution boundary: - Provider calls remain server-side through `/api/source-grounded-chat`. - Browser direct provider calls remain prohibited. - Browser direct current-source calls remain prohibited. - Provider/model secrets and provider/model config remain outside the repository. Failure behavior: - If current/public retrieval is disabled, unconfigured, unmatched, unsafe, oversized, timed out, or otherwise fails closed, the answer reports that current/public context was not retrieved and does not fabricate current claims. - If provider execution fails after current refs are retrieved, the server returns a sanitized visible diagnostic, preserves available package and current/public citation metadata, and does not fall back to uncited model memory. - If the provider response omits the required four-lane shape, the server renders a visible diagnostic wrapper rather than inventing uncited source claims. Non-goals: - No new current/public source is enabled. - No Cloudflare environment, Access, WAF, provider, or model configuration is changed. - No arbitrary web search, browser-side current-source fetch, user-provided URL retrieval, durable telemetry, database, vector store, Supabase, uploads, or session attachments are introduced. - No current/public source is promoted into approved package authority. Production enabling requirements: - An owner-approved source registry must be configured outside the repository. - Source registry governance, template validation, production smoke, and rollback requirements are defined in `current_source_registry_governance.md` and `current_source_registry_template.json`. - Source records must have owner-reviewed trust and freshness labels. - The protected proof/API route posture must be smoke-tested after configuration. - Access/WAF configuration remains external and must not be changed by this repo PR. - Provider synthesis over current refs requires a later issue if it is expanded beyond deterministic retrieval display.