docs: spec for write mode, the config wall, audit attribution and providers #20

2026-10-13T21:20:48Z

KofTwentyTwo commented

2026-10-13 21:20:48 +00:00

(Migrated from github.com)

Adds the spec to docs/DESIGN.md: "Owner decisions (2026-10-13), continued", with all recommendations accepted.

W. Write mode. Per-conversation Read-only or Write; Read-only is the default.
- A user preference sets the default, and an admin policy can disable write mode globally, per role, or per table or process.
- In Read-only mode the write tools are not in the tool list.
- Every write is a confirmed pending action. Auto-confirm is allowed only when the policy permits it, and never for deletes, bulk writes, processes or schedules.
- Writes cover records, processes, reports and saved views, and notifications, all as UI API operations.
- Enforcement stays beneath the assistant, in the UI API and core.
X. The hard wall. The assistant/<turnId> client channel is set by the invoker. Core denies that channel every assistant_* object and the security surfaces (authentik, audit, keys, credentials, secrets), failing closed. A startup check fails if any assistant_* object is not denied. Profiles and skills are never data the model can query or change.
Y. Audit attribution. The human actor is recorded together with via=assistant/<turnId>, versus via=next-ui, using core's clientChannel audit column. The tests are specified.
P. Providers and models as data.
- Adapters: OpenAI-compatible (covering local Ollama, LM Studio, vLLM and llama.cpp), Bedrock and Vertex.
- Discovery and health checks; HIPAA/PHI classification, routing and HIPAA mode (BAAs are an owner and legal step).
- Budgets with warn, downgrade and stop, plus dashboards.
- Routing and fallback, RAG through the UI API, and scheduled tasks as a designated user.
The phase table lists each phase's dependencies on core (QQQ RC.6, client channel, audit column).

Docs only.

🤖 Generated with Claude Code

Adds the spec to `docs/DESIGN.md`: "Owner decisions (2026-10-13), continued", with all recommendations accepted. - **W. Write mode.** Per-conversation Read-only or Write; Read-only is the default. - A user preference sets the default, and an admin policy can disable write mode globally, per role, or per table or process. - In Read-only mode the write tools are not in the tool list. - Every write is a confirmed pending action. Auto-confirm is allowed only when the policy permits it, and never for deletes, bulk writes, processes or schedules. - Writes cover records, processes, reports and saved views, and notifications, all as UI API operations. - Enforcement stays beneath the assistant, in the UI API and core. - **X. The hard wall.** The `assistant/<turnId>` client channel is set by the invoker. Core denies that channel every `assistant_*` object and the security surfaces (authentik, audit, keys, credentials, secrets), failing closed. A startup check fails if any `assistant_*` object is not denied. Profiles and skills are never data the model can query or change. - **Y. Audit attribution.** The human actor is recorded together with `via=assistant/<turnId>`, versus `via=next-ui`, using core's `clientChannel` audit column. The tests are specified. - **P. Providers and models as data.** - Adapters: OpenAI-compatible (covering local Ollama, LM Studio, vLLM and llama.cpp), Bedrock and Vertex. - Discovery and health checks; HIPAA/PHI classification, routing and HIPAA mode (BAAs are an owner and legal step). - Budgets with warn, downgrade and stop, plus dashboards. - Routing and fallback, RAG through the UI API, and scheduled tasks as a designated user. - **The phase table** lists each phase's dependencies on core (QQQ RC.6, client channel, audit column). Docs only. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-assistant#20