10  User Stories — M3 (AI Q2 Delivery)

In-flight delivery stories, keyed to PRD Appendix A

Published

June 19, 2026

Milestone M3 — AI Q2 Delivery (Jun 2026). Status labels mirror PRD Appendix A.

11 Contextual data chat

11.0.1 US-M3-01 — Workspace-scoped natural-language query

FR-APP-02 (single-turn, Delivered), FR-APP-03 (multi-turn, Q3 Target)

As an Integrity Engineer, I want to ask natural-language questions scoped to my workspace and campaign so that I can find relevant findings without manual filtering.

  • Given a selected workspace and campaign, when I ask a single-turn question, then the answer draws only on that workspace’s data. (Multi-turn context retention is FR-APP-03, targeted for M4 — accuracy at 2+ turns is currently below release bar.)
  • Given a query that implies a high-consequence action, when the assistant proposes it, then it requires explicit human-in-the-loop confirmation before any action is taken.
  • Given no grounded data supports an answer, when the assistant responds, then it states it cannot find supporting data rather than fabricating a result.

12 Agent reliability

12.0.1 US-M3-08 — Graceful degradation on backend faults

FR-APP-13 (failure recovery, Delivered)

As an Integrity Engineer, I want the chat assistant to fail safely when a backend dependency errors so that I get a clear message instead of a broken or hallucinated answer.

  • Given a Supabase RLS denial or query timeout, when it occurs, then the assistant returns an empty/no-access result rather than crashing or leaking another workspace’s data.
  • Given a Gemini rate-limit or timeout, when it occurs, then the request retries/backs off and the user sees a clear “try again” message rather than a stalled UI.
  • Given an expired or tampered JWT, when a request is made, then it is rejected with a re-authentication prompt, not a silent failure.

12.0.2 US-M3-09 — Trustworthy chat backed by accuracy gates

FR-APP-14 (agent evaluation gate, Delivered)

As an Integrity Engineer, I want the chat assistant’s classification/query/report accuracy validated against a benchmark before each release so that I can trust its answers in day-to-day use.

  • Given a new build of the classifier, executor, or reporter agent, when it is proposed for release, then it must pass the accuracy benchmark thresholds before shipping.
  • Given a benchmark regression (e.g. below-target accuracy on a query category), when detected, then the release is blocked until resolved.
  • Given multi-turn conversation accuracy remains below target, when a user starts a new conversation, then the assistant is scoped to single-turn queries only for M3 rather than silently degrading on follow-ups.

12.0.3 US-M3-10 — Persona-tailored workspace view

FR-APP-15 (persona-tailored workspace scoping, Alpha (prototype))

As a Data Explorer, I want the chat workspace tailored to my role so that I see the framing and results relevant to exploration rather than engineering sign-off tasks.

  • Given a Data Explorer persona, when I open a workspace, then the chat surface presents exploration-oriented framing (discovery, browsing) distinct from the Integrity Engineer’s action-oriented framing.
  • Given an Integrity Engineer persona, when the same underlying data is queried, then results are framed toward verification/action rather than raw exploration.
  • Given multiple workspaces I have access to, when I switch between them, then the persona-tailored framing is preserved per workspace.

12.0.4 US-M3-11 — Query firewall against injection and malicious input

FR-APP-16 (SQL-injection & malicious-input defense, Delivered)

As an Integrity Engineer, I want the chat assistant’s generated SQL to be firewalled against injection and malicious input so that a crafted question can never modify data or escape my workspace’s scope.

  • Given a generated query, when it contains DML/DDL (INSERT/UPDATE/DELETE/DROP/ALTER) or an injection pattern (e.g. SLEEP, CHR/ASCII obfuscation), then it is rejected before execution.
  • Given a query attempting to reference another workspace’s data, when it is generated, then the workspace scope is enforced and the cross-workspace reference is blocked.
  • Given a rejected query, when the assistant responds, then the user sees a safe refusal rather than a raw database error or partial result.

Coverage note: this starter intentionally covers the highest-value in-flight FRs. Remaining M4 FRs are to be added as they enter active development. FR-AI-01’s story (grounded damage-mechanism suggestions) moved to m4 when the FR slipped past the M3/Jun 2026 window; the old MVP-demonstration-sequence FR was retired outright (determined not to be a KAP/milestone requirement); FR-PRT-02 slipped to M4 and has no story yet. FR-APP-02 was split (2026-07-03) into FR-APP-02 (single-turn chat), FR-APP-13 (failure recovery), FR-APP-14 (evaluation gate), FR-APP-15 (persona-tailored workspaces), and FR-APP-16 (SQL-injection/malicious-input defense, added 2026-07-03) — see US-M3-08/09/10/11.