mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-12 22:26:13 +00:00
Marc-André Bombeck
5211771e8d
The self-context clarifying questions and the AI-composed proactive nudge both reached a provider without a consent check of any kind. Either could resolve to the operator's server-managed credential (admin-openai or the shared central Codex), so a user with no AI credentials and no receipt on file had health data leave the server on the operator's key. The questions path is the sharper of the two: its prompt carries the complete Coach snapshot. Gate both with the chain predicate pair the status path already uses, on the coach surface. The gate is skip-shaped on both — the questions fall back to the deterministic hints, the nudge keeps its deterministic template — so a missing receipt costs the user nothing but the model's phrasing. BYOK, local and ChatGPT-OAuth chains stay ungated; that egress is the user's own act. Move the questions path off the read-then-write budget check onto the atomic reserve/reconcile pair, so two concurrent saves can no longer both observe a sub-cap spend and both call the provider. The cap now follows the chain's cost owner instead of always charging the operator ceiling.