Rhythm 2.0 Specifications

Appearance

CAP-PFM-LLM-004Retain redacted AI evidence and remove it safely

Markdown

CAP-PFM-LLM-004

Retain redacted AI evidence and remove it safely

Markdown
  • DocumentDraft
  • Product intentProposed
  • ImplementationObserved

Planning

Feature
FEAT-PFM-LLM-01
Exercised by
FAS-PFM-LLM-01-01, FAS-PFM-LLM-01-03, FAS-PFM-LLM-01-04
Key concepts
CON-PFM-LLM-001
Actors
ACT-PFM-012, ACT-PFM-004
Depends on
CAP-PFM-LLM-001
Related
CAP-PFM-LLM-016
Proved by
ATS-PFM-LLM-004

Implementation

Executable suites
TST-PFM-LLM-014, TST-PFM-LLM-020, TST-PFM-LLM-027, TST-PFM-LLM-034, TST-PFM-LLM-072

KindCapabilityProduct areaPlatformModuleAI Requests, Usage and the Jazz AI TeammateRevision1

Read atservices-platform ad3f6a65

Retain redacted AI evidence and remove it safely ​

Purpose ​

Preserve diagnostic content under a bounded retention policy while keeping it out of ordinary usage reports.

How It Works ​

Platform attempts to capture the request before model dispatch and the response after the conversation returns. It redacts recognizable secret fields and credential-shaped text before storage. The usage record keeps capture status and an evidence reference rather than the body. Failed or unconfigured capture does not establish that evidence exists. Rhythm staff use a separate controlled read to inspect retained content. The evidence bucket applies the retention policy. Organization deletion removes the usage data and then its stored evidence versions. The product should resolve the provider compliance questions that accompany routine content capture.

Relationships ​

  • Run AI requests with consistent attribution and accounting supplies the prerequisite behavior for this outcome.

The Formal Contract

The narrative above explains; the sections below are authoritative — the rules, scenarios and tests this document binds.

Outcomes
Capture records distinguish saved, skipped and failed content.Redaction removes recognized credentials while retaining useful diagnostic text.Organization deletion purges its AI records and saved evidence.
Surfaces
job
Postconditions
Request and response capture each have a recorded status.
Constraints
The provider’s own content-retention policy remains unestablished.
Intent sources
services-platform:docs/proposals/llm-observability/11-decisions.md#D-1services-platform:docs/milestones/PLAT-M1-ai-usage-metered-and-visible.md#D-1 (proposal)

Controls

47 controls apply, from the corpus control catalogue.

TC-AI-006 TC-AI-007 TC-AZ-001 TC-AZ-002 TC-AZ-003 TC-AZ-004 TC-AZ-005 TC-CHG-001 TC-CHG-002 TC-CHG-003 TC-CHG-004 TC-CHG-005 TC-CHG-006 TC-CRY-001 TC-CRY-002 TC-CRY-003 TC-CRY-004 TC-DAT-001 TC-DAT-002 TC-DAT-003 TC-DAT-004 TC-IAM-001 TC-IAM-002 TC-IAM-003 TC-IAM-004 TC-IAM-005 TC-LOG-001 TC-LOG-002 TC-LOG-003 TC-LOG-004 TC-LOG-005 TC-MON-001 TC-PI-001 TC-PI-003 TC-PI-005 TC-PRV-001 TC-PRV-002 TC-SEC-001 TC-SEC-002 TC-SEC-003 TC-SEC-004 TC-TEN-001 TC-TEN-002 TC-TEN-003 TC-VEN-001 TC-VEN-002 TC-VEN-003

Business Rules

9 rules, 6 to be proved before approval. A rule's product intent is derived from its origin: 0 confirmed by a product decision, the rest inheriting this capability's proposed.

IdRuleKindEnforced atProvenance
01must prove
Proposed
The runtime attempts redacted request capture before dispatch and response capture after a loop result under a ninety-day retention policy; allowance refusals have no bodies and capture may be skipped or fail.
origin: services-platform:docs/proposals/llm-observability/11-decisions.md#D-1
proved by ATS-PFM-LLM-001-13, ATS-PFM-LLM-004-01, ATS-PFM-LLM-004-06, TST-PFM-LLM-020
policyserviceobserved
services-platform:modules/llm/services/execution/run-operation.ts:recordCapture
02must prove
Proposed
Redaction replaces secret-named field values and recognizable credentials wherever they appear while retaining ordinary prompt text.
proved by ATS-PFM-LLM-004-02, TST-PFM-LLM-020, TST-PFM-LLM-072
policyserviceobserved
services-platform:modules/llm/services/evidence/evidence-redaction.ts
03must prove
Proposed
Evidence bodies are stored separately from request and attempt records, whose contents consist of references, counts and operational details.
proved by ATS-PFM-LLM-004-03, TST-PFM-LLM-034
invariantserviceobserved
services-platform:modules/llm/services/persistence/invocations.ts:recordInvocationAttempt
04
Proposed
Capture status distinguishes pending, captured, skipped, failed and purged, and database constraints require a storage reference for a captured body.
proved by ATS-PFM-LLM-004-07, TST-PFM-LLM-014
invariantdatabaseobserved
services-platform:modules/llm/db/llm-invocations.table.ts:LLM_PAYLOAD_CAPTURE_STATUSES
05must prove
Proposed
Organization deletion removes its AI records in dependency order and all versions of its evidence without changing neighboring organizations’ data.
proved by ATS-PFM-LLM-004-04, TST-PFM-LLM-027
lifecycleserviceobserved
services-platform:modules/llm/services/maintenance/tenant-participant.ts
06must prove
Proposed
Deletion removes evidence after the last dependent AI record, preserving references until those records are gone.
proved by ATS-PFM-LLM-004-04, TST-PFM-LLM-027
invariantservicetest
services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#removes the evidence only after the last row, so a surviving row never names a deleted body
07
Proposed
AI provision creates no allowance or request records for a new organization; the first request creates them when needed.
lifecycleservicetest
services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#provisions nothing, because a tenant’s allowance is created by its first call
08
Proposed
Runtime functions may write evidence and use model credentials, the HQ content-reading function may read evidence without model credentials, and reconciliation holds neither authority.
invariantservicedocumented
services-platform:docs/llm.md#Reading a body, and what deletes it
09must prove
Proposed
Capture returns skipped when no evidence store is configured and failed when redaction, serialization or writing fails, allowing request processing to continue. A memory evidence store cannot be constructed in deployed configuration.
proved by ATS-PFM-LLM-004-05
validationserviceobserved
services-platform:modules/llm/services/evidence/evidence-store.ts

Scenarios

IdGivenWhenThenProvenance
01A prompt contains a recognized credential.The redactor processes captured content.The credential is replaced while surrounding prompt text remains.test
services-platform:modules/llm/tests/unit/services/evidence-redaction.spec.ts#keeps the prompt’s own words
02An organization has stored AI history.Its deletion participant runs.Its records and evidence are removed without purging a similarly named organization.test
services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves the evidence of another tenant, and of one whose id begins like the purged one, exactly as it was

The Markdown files under specs/ in rhythmsoftware/rhythm-v2-docs are the canonical source of truth. This reader is a generated, read-only projection of them.

Rhythm Software