Identified AI Surfaces — 11 total

Surface	Engine	Exposure	Disclosure State
Chat widget + leave-assist host toast	OpenAI via api/chatbot.js (toast is deterministic host UI)	Visitor-facing	Welcome disclosure default ON; desktop leave and mobile return/idle all use the same permanent platform-owned “AI assistant” label. Placement is configurable, but the disclosure label remains inside the toast and cannot be removed (2026-08-31). 2026-09-24: signed-in hea_app no longer hosts this widget. Chief of Staff uses the Office Desk family instead. 2026-09-15: first-question cards are the same disclosed chat family (owner-published chrome, possibly AI-proposed at create / Review). Disclosure stays welcome / data_disclaimer. No per-card AI badge. Not a new AI family
WhatsApp channel	Same engine via api/whatsapp/webhook.js	Visitor-facing	Auto-prepended
AI Review	OpenAI via utils/hea/heaReviewAgent.js	Admin only	Labeled "AI Review"
Opportunity Scout	OpenAI via utils/outpost/opportunityScout.js	Admin only	N/A
Brief/Content Engine	OpenAI via utils/outpost/briefEngine.js	Admin drafts	No AI label on output ⚠️
Foundry enrichment	OpenAI via enrichment utilities	Internal RAG	N/A
CRM enrichment	Explorium / AI classification	Admin only	N/A
Infirmary email case classifier	OpenAI via utils/infirmary/emailCaseClassifier.js	Admin / Infirmary operators only	Operator-only classify; Ward shows machine-ingested unverified candidate; no public visitor disclosure
Workbench Chief of Staff	OpenAI via utils/workbench/cosRuntime.js + draftRuntime.js + draftEnrichProposal.js (reply drafts + Enrich propose B) + composeRuntime.js (new-thread compose generate)	Admin only	Quiet permanent disclosure line under the chat input (2026-08-12); AI-drafted badge on every AI-generated reply draft until send, downgrading to "AI-assisted — edited by you" after first owner edit (N3-a, 2026-08-13). Enrich is a new operator action: proposed alternative is labeled as drafted from published HEA knowledge; existing badge stays; A is unchanged until Use enriched. S1 Direction on the draft card is operator text — not a new AI surface. 2026-08-21: compose generate is the same Workbench surface / new trigger — badge until send; no sent-body footer; not a new AI family.
Defense Tower Exposure judge	OpenAI via utils/outpost/defenseTower/judge.js	HEA owner + admin	Permanent disclosure chip on the Exposure story (`#defense-ai-disclosure`). No owner-off switch. Not visitor-facing. Scores stay deterministic.
Office Desk	OpenAI via utils/office/officeTurn.js + api/office.js	Signed-in HEA owner / collaborator	Permanent disclosure line under the Desk input (`#office-ai-disclosure`). No owner-off switch. Not visitor-facing. Tools are Mandate-gated; missing Mandate is published L8 plus campus how-to. Draft Find when Mandate ticks editor_find_draft. Briefing list/open when Mandate ticks briefing_read. Town Hall count/search/filter/open when Mandate ticks crm_read (integers or at most 8 hits, then one card). Mailbox draft when Mandate ticks crm_draft: list unsent drafts, open one thread, persist an N3 reply, or persist a new-thread compose to a Town Hall card that already has an email (`created_by: cos`, `ai_drafted: true`). Desk preview shows the letter (To, subject, body) with an AI-drafted badge; operator can edit and save on Desk. Recipients are the Town Hall card email only, never the model and never the last From. Town Hall does not list these drafts. Refresh restores the Desk letter. Mailbox send when Mandate ticks crm_send: CoS mints a confirm intent; nothing leaves the mailbox until the operator clicks Confirm send on that open letter (`reviewed_draft_id`). AI-drafted letter; review forced. Town Hall write when Mandate ticks crm_write: one contact, organization, or relationship, or one next action, from an exact email or website the operator typed in this or the previous Desk message (not a leftover substring or a model-invented address). Town Hall archive when Mandate ticks crm_archive: organization or relationship after Confirm archive on the open card. Contact and HEA archive stay absent. Add a Briefing note when Mandate ticks briefing_write: one note or https link the operator typed. ChatRoom post when Mandate ticks chatroom_write: one Team-visible CoS post in a named current room. find_priorities when Mandate ticks crm_read, counter_read, or infirmary_read: labeled cases / deliveries / tasks / quiet, then one open. Desk preview pane is chrome for one opened item; disclosure unchanged. Town Hall documents when Mandate ticks crm_documents: Confirm link attaches an https bookmark or a current Briefing item. No fetch. Not a new AI family. Record conversation when Mandate ticks record_meetings: live Record opens the microphone only after the consent tick. The headphones warning stays on screen. Tab video is not stored. The transcript preview is badged AI-generated transcript. Same Desk family. Save can email that written note to addresses still ticked and still on the Town Hall card. The email says it was written by an AI assistant. The audio file is not attached. 2026-09-24: the same Desk thread also opens from the right-edge arrow on other customer hea_app pages (not Admin, Stripe, login, or My Desk). Same disclosure line. 2026-09-25: a card photo is a proposal until Confirm card. No image generation. No new public surface. Letters keep the AI-drafted badge. Not a new AI family.

Exposure Audit

11 AI surfaces identified. 2 are visitor-facing (chat widget family, including its leave-assist host toast, + WhatsApp). 7 are admin/internal only. 1 is HEA-owner + admin (Defense Tower Exposure judge). 1 is signed-in Office Desk (owner / collaborator). Mixed visitor+owner surface: none. 2026-09-24: signed-in hea_app uses that Office Desk family in a right-edge panel, not the visitor widget. 2026-09-21: Defense Tower judge is visible to the HEA owner after Package A. 2026-09-21: Office Desk is a new signed-in family, not the visitor chat or admin Workbench.

Direct Interaction Assessment

• Chat widget + leave-assist host toast: YES — visitors directly interact with AI. The toast is a deterministic, pre-chat invitation into that same disclosed AI interaction, not a separate AI engine. First-question cards are the same family: a tap sends a normal user message into the already-disclosed chat.
• WhatsApp: YES — same engine.
• AI Review / Scout / Brief: NO — admin tools, users are aware they're using AI features.
• Foundry / CRM enrichment: NO — background processing.
• Workbench Chief of Staff: NO — admin-only operator tool; the owner knowingly uses an AI assistant (quiet permanent disclosure line under the chat input). Reply drafts (N3-a): AI-generated content the owner reviews/edits before any send — badge persists until send ("AI-drafted" → "AI-assisted — edited by you" after first owner edit).
• Defense Tower Exposure judge: NO — HEA owner + admin read a written report after a deterministic scan. They do not chat with the judge.
• Office Desk: YES — signed-in operators chat with the Desk. Permanent disclosure under the input. Not visitor chat.

Active Disclosure Points

• Chat widget: Welcome message disclaimer (configurable text, default ON). First-question cards (2026-09-15) sit above the composer and are not a second disclosure surface.
• Leave-assist host toast: Permanent platform-owned “AI assistant” label beside the localized invitation. HEA-wide and per-install placement may move the complete toast between bounded corners; the label moves with it and cannot be removed or weakened by owner configuration.
• WhatsApp: First-message disclaimer auto-prepended.
• Widget menu: "Powered by HEA-World" (hardcoded).
• Widget menu: "Privacy terms" link (hardcoded).
• Site footer: "Powered by AI, guided by humans." (hardcoded).
• Privacy page: States "you're interacting with an AI system" (static).
• FAQ: States AI interaction is disclosed (static).
• Office Desk: Permanent line under the composer (`#office-ai-disclosure`). No owner-off switch.

Removability Controls

Control	Default	Guardrail	Status
show_data_disclaimer toggle	Default: true	Editor shows Article 50 warning modal on toggle-off	✅ Remediated
data_disclaimer text	Default: "This is an AI-powered assistant."	Can be changed but default is clear	✅ Verified
intro_message text	Default includes "AI assistant"	Redundant — data_disclaimer already covers AI disclosure	✅ N/A
First-question cards	Owner-published Personality chrome (create / Review / edit)	Same class as intro_message: owner can empty or disable the cards; that does not remove welcome / data_disclaimer. No per-card AI badge. Article 50 warning modal is unchanged (disclaimer toggle only).	✅ Recorded 2026-09-15
Leave-assist host-toast disclosure	Platform-owned “AI assistant” label	Not owner-authored; rendered with textContent; cannot be removed or weakened by HEA owner configuration. E1 contract + mandatory E4 light/dark browser journeys.	✅ Verified locally
WhatsApp disclaimer	Auto-prepended	Low risk	✅ Verified

Generated Content Assessment

Content Engine generates publishable drafts (LinkedIn posts, emails, articles) and Canteen hero images for operator use. Each generated content card shows an ✨ AI-generated — review before publishing badge on text. Generated hero images show an on-image AI badge; crop/filter edits auto-label as AI-generated — human-edited. Downloaded hero PNGs embed C2PA Content Credentials with machine-readable provenance (Article 50).

First-question cards (2026-09-15) are owner-published chat chrome in the existing widget family, not a new generated-media surface. Marking decision: no per-card AI badge. C2PA is N/A (no image/audio/video).

Public catalog directory lines (2026-09-24) are HEA World listings compiled from each HEA's already published knowledge. They are not the owner's statement and not a chat turn. The card shows the sentence with no generated badge. A missing line leaves name and avatar only. C2PA is N/A (text only).

Signal Tower draftLlmsTxt (2026-09-20, Package L v1) assembles a downloadable llms.txt from first-party catalog titles/meta, pantry brand fields, and already-stored offer URLs. It does not interpolate model-derived summaries. Article 50 N/A for this slice (no new model call; publishable bytes are first-party / escaped labels). If a later slice adds Foundry summaries, revisit disclosure and this row.

✅ Remediated — text + image human-visible badges + C2PA at download (2026-07-07)

Machine-Readable Provenance

Text outputs (current): Content Engine text outputs (LinkedIn posts, emails, articles) are delivered via copy-paste. No machine-readable provenance standard applies to plain-text clipboard content today. Human-visible AI badge added to all outputs (2026-07-06).

✅ Text — covered by human-visible badge

Image outputs (current Canteen hero images) / video outputs (future):

• Embed C2PA / Content Credentials on hero PNG download — ✅ `serveCanteenImage?download=1` (2026-07-07)
• Show AI-generated badge on every generated image card — ✅ on-image badge in Canteen (2026-07-07)
• If user applies filters or edits, mark as AI-generated, human-edited — ✅ in-app crop + filter editor auto-labels (2026-07-07)
• Only full manual upload (user's own photo) removes the AI label — not yet supported in Canteen v1

✅ Canteen hero downloads — C2PA embedded with dev/test signer (Trust List cert optional via ENV)

Human Review Controls

• Content Engine drafts: Require admin review before publishing.
• Chat responses: Generated in real-time without human review.
• First-question cards: Same owner-review class as intro_message — generated at create (and Review may propose); the owner edits or Applies, then Publishes. Not a withheld first publish. Live tap is not a new model call.
• AI Review suggestions: Require admin action (Apply button) before taking effect.

Dashboard Status Recommendations

Requirement	Status	Summary
AI-ACT-50-1	✅ Verified	data_disclaimer is non-removable baseline; show_data_disclaimer toggle has Art. 50 warning modal on disable
AI-ACT-50-2	✅ Remediated	AI-generated badge on Content Engine text; on-image badge + auto human-edited marking on Canteen heroes; C2PA Content Credentials on hero PNG download (2026-07-07)
AI-ACT-50-4	🔵 Planned	Future media / avatar / synthetic voice features
AI-ACT-50-5	✅ Verified	Content Engine is copy-paste only (no direct publish); boundary explicit in UI
AI-ACT-50-6	✅ Verified	Checklist enforced as policy gate via AGENTS.md (AI Act Article 50 Compliance Gate)