[P2] Productionize an approved Vision model and provider boundary

[postigodev]

Context

Vision remains a planned Preppie capability, but the current YOLO/FastAPI implementation is an experimental lab stack rather than an approved production feature. The hosted implementation is being removed from the beta runtime under #92. A future implementation may use Gallo's cleaned model, a provider-backed approach, or another approved detector behind a stable provider boundary.

No Vision implementation may return to staging or production merely because a model produces plausible detections. Reactivation requires an explicit product decision and evidence for licensing, security, privacy, cost, accuracy, operations, and user review behavior.

Scope

• Define the user-facing Vision use case and confirm that it belongs in the active product roadmap.
• Evaluate the cleaned model and any provider alternatives behind a provider-neutral detection contract.
• Confirm that every runtime, model weight, dataset-derived artifact, and redistributed dependency has a license compatible with Preppie's proprietary distribution and hosted operation.
• Establish reproducible model delivery, versioning, integrity checks, and rollback behavior.
• Keep inference inaccessible from the public internet except through an authenticated Preppie product route.
• Add service authentication, private networking where applicable, request timeouts, cancellation, bounded uploads, media validation, and sanitized errors.
• Bound dimensions, duration, frames, concurrency, queueing, CPU/GPU work, and provider cost per request.
• Define accuracy and failure thresholds using representative, legally usable evaluation data.
• Preserve the review boundary: detections create candidates and never mutate inventory automatically.
• Add user-visible AI/Vision usage accounting, plan enforcement, observability, retention, deletion, and disclosures before activation.
• Provide a feature flag and tested rollback path that can disable Vision without impairing inventory workflows.

Acceptance criteria

• Product scope and the intended beta/release stage are explicitly approved.
• The selected model/runtime/provider has a documented license decision compatible with Preppie's intended use.
• Model artifacts or provider versions are reproducible and operationally identifiable.
• No direct anonymous inference path exists.
• Authentication, upload limits, media validation, timeouts, maximum work, concurrency, and sanitized error behavior have automated coverage.
• Accuracy and failure behavior are measured on representative, legally usable fixtures.
• Vision output requires user review before inventory mutation.
• Provider data minimization, retention, deletion, and user disclosures match the actual implementation.
• Usage and material cost are attributed and constrained by the applicable plan policy.
• Observability and a tested feature-disable/rollback path exist before production activation.
• Staging rehearsal succeeds before any production activation.

Dependencies

• Current deployment retirement and experiment quarantine: [P0] Decommission current Vision deployment and quarantine the experimental stack #92.
• Observability: [P1] Add cross-service, frontend, and database observability #95.
• Distributed usage enforcement: [P1] Replace in-memory rate limits with distributed usage enforcement #96.
• Runtime container hardening: [P2] Harden and make runtime containers reproducible #97.
• Privacy disclosures: [P0] Publish privacy, terms, AI, and voice disclosures before public beta #99.
• AI/provider data minimization: [P0] Minimize AI provider data and verify retention controls #101.
• Retention and deletion: [P1] Define retention and real deletion for operational user data, media, and logs #102.
• Durable usage accounting and plan enforcement: [P0] Define plan entitlements and durable usage accounting #119, [P1] Enforce subscription-aware quotas and provider rate limits #120, and [P1] Attribute provider usage and COGS by user, feature, and plan #122.

Out of scope

• Treating the current experimental YOLO stack as production-ready.
• Committing to GPT Vision or any other provider before evaluation.
• Automatic pantry mutation from unreviewed detections.
• Blocking the current private beta while Vision remains disabled and undeployed.