# 07E Provider PM Repair — aieditorrsp

- task_id: t_ac03c43e
- tenant: site-aieditorrsp-20260528
- project_slug: aieditorrsp
- domain: https://aieditorrsp.net
- checked_at_utc: 2026-05-29T07:57:01Z
- prepared_by: 墨枢
- verdict: PROVIDER_REPAIRED_NEEDS_COMPLIANCE_PM_QA_RECHECK

## Decision

Path A completed: real server-side AI image edit provider is enabled through fal `fal-ai/flux-pro/kontext`.

The site no longer returns `PROVIDER_NOT_CONFIGURED` for safe image-generation requests. Production `/api/generate-image` now validates prompt/image, blocks unsafe prompts before provider invocation, calls fal server-side with `FAL_KEY`, polls the queue result, and returns `image_url`, `preview_url`, and `download_url`.

Paid checkout remains disabled. No Stripe/payment gate was enabled by this task.

## Code/config changes

Committed and pushed:

- commit_sha: `ca5e9d3e846a069bc44c162a0b05090f652001d3`
- pushed_branch: `main`
- files_changed_by_this_task:
  - `src/app/api/generate-image/route.ts`
  - `wrangler.jsonc`

Implementation notes:

- Provider vars added:
  - `AI_PROVIDER_NAME=fal`
  - `FAL_MODEL=fal-ai/flux-pro/kontext`
- Secret used: Cloudflare Worker secret `FAL_KEY` (not printed, not committed, not included in reports).
- Supported upload inputs: JPG, PNG, WebP, max 8 MB.
- Unsafe prompt categories return `400 UNSAFE_PROMPT_BLOCKED` before provider lookup/call.
- Provider failures return `503 PROVIDER_FAILURE` and do not decrement app credits.
- Timeout returns `504 PROVIDER_TIMEOUT` with provider request id for support.

## Deploy

Deployed from a clean detached worktree at the same commit:

- deploy_worktree: `/tmp/aieditorrsp-deploy-ca5e9d3`
- deploy_url: `https://aieditorrsp.net`
- deployment_source_commit: `ca5e9d3e846a069bc44c162a0b05090f652001d3`
- cloudflare_worker: `aieditorrsp`
- cloudflare_version_id: `4230b57f-f7d3-4459-93c6-315f68287e89`
- deploy_command: `npm run deploy:raw`

`/root/projects/aieditorrsp` still contains pre-existing frontend dirty work from the parallel frontend repair task. The provider deployment itself was built/deployed from the clean detached worktree above.

## Verification

### Build checks

- `npm run verify`: PASS
  - routes: 11
  - hrefPlaceholders: 0
  - forbiddenCopy: 0
  - runtime_architecture: `workers_first_frontend_with_api_stubs`
- `npm run build` on clean deploy worktree: PASS
- `npm run deploy:raw` on clean deploy worktree: PASS

### Production API checks

Unsafe prompt with uploaded PNG:

```json
{
  "status": 400,
  "code": "UNSAFE_PROMPT_BLOCKED"
}
```

Credits/payment gate:

```json
{
  "status": 200,
  "paid_enabled": false
}
```

Safe prompt with uploaded PNG:

```json
{
  "status": 200,
  "ok": true,
  "provider": "fal",
  "model": "fal-ai/flux-pro/kontext",
  "image_url": true,
  "preview_url": true,
  "download_url": true,
  "compliance": {
    "unsafe_prompt_blocked_before_provider": true,
    "site_storage": "none",
    "result_cache_ttl_hours": 24,
    "training_opt_out": "Provider request configured for one-off image editing; site does not use uploads/results for model training."
  }
}
```

## Compliance/retention facts for recheck

Current implemented facts:

- User uploads are sent server-side to fal for one-off image editing.
- Site does not store source uploads or generated images in D1/R2.
- API response exposes provider-hosted generated image URL as both preview and download URL.
- `ANON_RESULT_TTL_HOURS=24` is reported in the response compliance object.
- Unsafe prompts are blocked before provider call.
- Provider key stays server-side as Worker secret.
- Paid checkout remains disabled.

Required follow-up created:

- `t_e3b86e02` — provider retention/privacy compliance recheck, assignee `modun`.
- `t_564f9c20` — PM recheck after provider repair, assignee `moce`.
- Both were linked before final QA `t_1ced1a6d`.

## Residual risks

- Public legal copy still needs compliance recheck for provider/retention wording before launch unlock.
- Product acceptance still needs PM recheck because 07C also flagged frontend upload/result-preview and inert CTA gaps; provider API is fixed, but PM must judge the full user flow.
- Final QA must wait for frontend repair, provider compliance recheck, and PM recheck.

## next_inputs

For 墨盾/compliance:

- Recheck Privacy/Terms/provider retention using this report and production API behavior.
- Require exact copy changes if fal/result URL retention wording is not acceptable.

For 墨策/PM:

- Re-run product acceptance against production after this provider repair.
- Keep PM_NO_GO if upload UI/result preview remains incomplete despite backend success.

For 墨测/QA:

- Do not run launch-unlocking final QA until `t_336249d9`, `t_e3b86e02`, and `t_564f9c20` are closed.