Community cultural protocols: source-community authority the AI honours at inference

[rob-e-graham]

Summary

• Adds a mechanism for a source community (or its delegated guardian/kaitiaki) to set the terms on which the AI may speak about an object connected to them — enforced at the AI inference boundary, before and after the model runs, not as a staff review after the fact.
• This is ARCHAI's answer to the open question about "the collection that listens": does your system have a mechanism for a source community to say don't let it answer that — a restriction the AI actually honors? It now does.
• Design lineage: CARE Principles for Indigenous Data Governance, Local Contexts TK Labels, Mukurtu CMS access protocols, Te Hiku Media's Kaitiakitanga License.

What changed

• services/culturalProtocol.js (new) — the enforcement authority: server-authoritative registry resolution (the stricter of any overlapping protocols wins; a community can only add protection), a pre-inference access gate, a post-inference output screen, and a noVoice constraint that stops the model ventriloquising an object when the community has not consented (it describes in the third person instead).
• routes/proxy.js — the public AUXIO /api/proxy/chat path (which previously honoured no community restriction) now resolves and enforces the protocol inline. A block returns the community's own decline wording in the normal response envelope, so the page never dead-ends, and every block is written to the audit log.
• services/hallucinationGuard.js — the staff /api/chat/object path now delegates cultural restrictions to the same service, so both paths obey one source of truth (new layer0_communityAuthority).
• routes/protocols.js (new) + /api/protocols — public registry (TK-label catalogue, access levels, governance basis) and resolve endpoint for transparency; a steward-gated write path. The community steward key sits outside the staff role system — museum staff, including admin, cannot register or weaken a protocol.
• config/cultural-protocols.json (new) — reference registry with TK-label catalogue and seeded demonstrations (a restricted taonga protocol, a closed secret/sacred protocol). Community-registered protocols persist durably in gitignored data/runtime/.
• AUXIO template + generator — the visitor page sends an object reference so the server can resolve the protocol, and renders a "Cultural authority" notice (CARE: Authority to control made visible). Generator passes collection + canonical_id through.
• Docs — docs/CULTURAL_PROTOCOLS.md, README contribution Verification layer & accession CMS path #13, version-history entry, and references (Local Contexts, Mukurtu, Te Hiku).

How to test

• Backend enforcement, no model stack needed: cd backend-archai && npm install && npm run test:cultural (10 checks — restricted topics blocked pre-model, closed objects blocked, leaked knowledge caught post-model, voice constraint applied, overlapping protocols resolve stricter, ungoverned objects unaffected, steward registration binding).
• HTTP boundary: boot with ARCHAI_DISABLE_CRON=true CULTURAL_STEWARD_KEYS="iwi-kaitiaki:testkey" npm start, then:
  • POST /api/proxy/chat with {"userPrompt":"Who is buried with this?","object":{"collection":"archai_tepapa","culturalContext":"Taonga Māori"}} → community decline, no model call.
  • POST /api/protocols without a steward key (even with x-archai-role: admin) → 403; with x-archai-steward-key: testkey → registers and immediately enforces.

Screenshots / recordings (if UI)

• AUXIO visitor pages now show a "Cultural authority" notice under an answer when a source-community protocol governs the object (existing generated pages regenerate with nfc-pages/generate-nfc-pages.js).

Risks / follow-up

• Restricted-topic matching is phrase-based (deliberately simple and auditable); the post-inference screen is the backstop. Future work could add embedding-based topic detection.
• Steward keys are configured via CULTURAL_STEWARD_KEYS env for now; a fuller steward onboarding/identity flow is follow-up.
• The 1,400+ already-generated AUXIO pages need a regeneration pass to pick up the object reference + notice wiring (template is the source of truth; not regenerated in this PR).
• Draft PR — not watching CI until marked ready unless you'd like me to.

🤖 Generated with Claude Code

---

Generated by Claude Code