Welcome to CivicRecords AI

[scottconverse]

Hey everyone! 👋

CivicRecords AI is an open-source, locally-hosted AI system that helps municipal staff respond to open records requests (FOIA, CORA, and state equivalents). Every piece of data stays on your city's own hardware — no cloud, no subscriptions, no vendor lock-in.

Current status: v1.2.0 — released 2026-04-23. CI green on commit cc06abc. 617 backend pytest + 36 frontend vitest, all passing. Installer, onboarding, seeding, model picker, portal switch, and at-rest encryption all landed together.

Headline: ENG-001 closed. Connector credentials in data_sources.connection_config are now encrypted at rest via a Fernet envelope (AES-128-CBC + HMAC-SHA256). pg_dump output, restored backups, and DB-superuser sessions see ciphertext only. Runtime code still sees a plain dict — zero API/admin-UI surface change. Operator breaking change: set ENCRYPTION_KEY in .env before restart (the installer auto-generates one on fresh installs and prints a loud "BACK IT UP SEPARATELY FROM YOUR DATABASE" banner). Losing the key means losing credential access — key rotation is a future slice.

New in v1.2.0 — Tier 5 (installer + onboarding + seeding + model picker + portal switch):

• T5A — Onboarding persistence. The single-phase LLM-powered interview now actually persists each answer onto CityProfile and transitions onboarding_status through its lifecycle. Skip advances the walk truthfully.
• T5B — First-boot baseline seeding. app/main.lifespan auto-seeds 175 state-scoped exemption rules, 5 compliance templates, and 12 notification templates on first boot. Idempotent via skip-if-exists; admin customizations survive re-seeds.
• T5C — 4-model Gemma 4 installer picker. Default is gemma4:e4b. Fake tags gemma4:12b and gemma4:27b have been purged repo-wide. Larger tags (gemma4:26b, gemma4:31b) remain selectable but require an explicit "stronger hardware" acknowledgement against the locked 32 GB baseline.
• T5D — Install-time portal switch. New PORTAL_MODE env var (private default, public opt-in). Public mode exposes exactly three surfaces — landing page, resident-registration path, and authenticated records-request submission for UserRole.PUBLIC. Anonymous walk-up submission is intentionally out of scope.
• T5E — Windows unsigned double-click installer. Real .exe shipped as a GitHub Release asset (CivicRecordsAI-1.2.0-Setup.exe + .sha256). Unsigned by design — SmartScreen shows "Windows protected your PC — Unknown publisher" on first run. Click More info → Run anyway, confirm UAC. macOS/Linux continue on the guided install.sh script.

Carried from v1.1.0 / v1.0.x (unchanged):

• Hybrid AI search (semantic + keyword) across ingested city documents
• Records request tracking with full-lifecycle status management and statutory deadline handling
• Exemption detection (PII regex + state-specific keyword rules + optional LLM)
• Human-in-the-loop enforcement — the system suggests, staff decides
• Hash-chained audit logging with automatic archival
• AMD GPU/NPU auto-detection (ROCm on Linux, DirectML on Windows)
• Cross-platform: tested on Windows 11 and Ubuntu 22.04 via Docker

Roadmap (current, per canonical spec):

Phase	Version(s)	Focus	Status
Phase 0–2	v1.0.x → v1.1.0 → v1.2.0	Core workbench, request lifecycle, search, department access, compliance templates	Shipped
Phase 3	unscheduled	Additional data-source connectors (PostgreSQL, MySQL, MSSQL, SMB/NFS, SharePoint, …). IMAP removed from scope in T3B connector-taxonomy cleanup.	Planned
Phase 3+	unscheduled	Broader public portal (resident dashboard, published-records search, track-my-request), cross-instance federation	Planned

Public portal clarification. v1.2.0 ships a minimal public surface (T5D) only when the deployment explicitly opts in via PORTAL_MODE=public. That surface is three screens — public landing page, resident registration, and authenticated records-request submission. It is not a full public portal. The older statement in this thread that "v1 is internal-only" is now partially obsolete — staff-only private mode remains the default, but a minimal public mode exists as a deliberate opt-in.

Release + docs:

• v1.2.0 release page · CHANGELOG §[1.2.0] · README · USER-MANUAL · Canonical spec

If you're a city clerk, records officer, or civic technologist — we'd love to hear from you.

— Scott