Integrate LibreSign with Nextcloud AI capabilities and policy governance #9047

Goal

Establish the shared architecture, policy model, security boundaries, user experience conventions, test infrastructure, and documentation requirements required for LibreSign to use AI capabilities exposed by Nextcloud.

AI is an assistive tool over LibreSign functionality. It must not replace deterministic LibreSign domain behavior, authorization, policy resolution, cryptographic validation, signature validity, or legal/user decisions.

Product principles

• Use public Nextcloud AI abstractions instead of creating a LibreSign provider/model registry.
• Keep provider credentials, endpoints and model selection in Nextcloud.
• Discover technical capability through Nextcloud; decide whether an actor may use it through LibreSign policies.
• Prefer deterministic LibreSign behavior whenever the same problem can be solved reliably without AI.
• Treat source documents and AI output as untrusted data.
• Keep the source document authoritative over summaries, explanations and extracted information.
• Require normal LibreSign validation and authorization before any AI-suggested action changes application state.
• Give AI the minimum data, tools and authority required for the requested operation.
• Make AI-assisted behavior identifiable to users and administrators.

Nextcloud integration

Use the public Task Processing APIs available in the supported Nextcloud version.

Capability discovery must be semantic from LibreSign's point of view. Frontend code should receive product capabilities such as document summary or template assistance rather than depending directly on provider app names.

The LibreSign implementation must not require the Nextcloud Assistant app as a backend dependency. Where useful, use the official Nextcloud Vue AI components so AI-assisted interactions follow the surrounding ecosystem.

Implementation references:

• Nextcloud Task Processing developer documentation
• Nextcloud Assistant integration documentation
• Nextcloud Mail AI integration pattern: https://github.com/nextcloud/mail/tree/main/lib/Service/AiIntegrations
• Nextcloud Vue Assistant components: https://github.com/nextcloud-libraries/nextcloud-vue

Policy and authorization

The existing Policy Workbench is the source of truth for whether AI may be used.

The policy design must support the existing LibreSign hierarchy and delegation model:

• system-wide effective policy;
• group-level delegation/override where the parent policy permits it;
• user-level delegation/override where permitted;
• server-side effective-value resolution;
• backend authorization independent of frontend visibility.

The policy model must be granular enough to distinguish materially different AI capabilities. Do not create controls for product capabilities that do not yet exist.

Technical capability answers whether LibreSign can perform an operation. Policy answers whether the current actor may perform it.

Public/external signer behavior must be defined through the same policy and authorization model instead of being implicitly allowed or denied only because an actor is not a normal Nextcloud user.

Security and trust boundaries

The foundation must establish reusable rules for every downstream AI feature:

• document content is untrusted data and may contain indirect prompt injection;
• model output is untrusted and must be validated before entering LibreSign domain objects;
• generated markup/templates must pass normal sanitization and validation;
• prompts do not enforce access control or business rules;
• AI cannot expand the current actor's effective permissions;
• minimize document content sent for processing;
• failures, cancellation and unavailable providers must fail safely;
• never expose provider credentials through LibreSign;
• do not let the model directly mutate application state.

For agentic or tool-using capabilities, the model may propose an operation, but normal LibreSign services must validate actor, policy, object state and parameters before execution. Consequential external or destructive operations require an explicit confirmation step where appropriate.

Administrative transparency

When AI is available, administrators must be able to understand:

• that LibreSign is using AI capabilities configured in Nextcloud;
• which LibreSign AI capabilities are technically available;
• which capabilities are enabled by LibreSign policy;
• that data processing location/privacy depends on the configured Nextcloud provider unless Nextcloud exposes authoritative metadata.

Do not implement an independent Ethical AI Rating, provider trust table, or heuristics based on app/model names.

A neutral notice may explain that content can be processed by the provider configured by the Nextcloud administrator and may leave the instance depending on that configuration.

Deferred: Ethical AI and provider trust metadata

LibreSign must not invent an Ethical AI classification.

Before closing this epic, re-evaluate the current public Nextcloud APIs and ecosystem for standardized provider metadata such as:

• Ethical AI Rating;
• local/remote processing;
• privacy/data-boundary information;
• other provider trust metadata.

If Nextcloud exposes a suitable public contract, review whether LibreSign should surface it. If not, keep the functionality deferred and consider an upstream proposal instead of implementing provider heuristics locally.

UX and accessibility

AI must remain subordinate to the signing task.

For new or materially changed interactions:

• inspect the existing LibreSign workflow and official Nextcloud interaction patterns;
• research relevant signing/document products where they clarify user expectations;
• prototype or produce a concrete UI proposal before implementation when placement, terminology, review/acceptance, disclosure or error recovery is not obvious;
• use official Nextcloud Vue components where appropriate;
• keep keyboard, screen-reader and responsive behavior consistent with the rest of LibreSign;
• clearly identify AI-generated or AI-assisted content;
• make limitations understandable without overwhelming the normal workflow.

Visual references are evidence, not instructions to copy another product.

Testing strategy

The AI foundation must be testable without paid or remote AI services.

The intended strategy is:

1. deterministic provider/test double for unit, integration and Playwright flows;
2. provider contract coverage through the normal Nextcloud Task Processing path;
3. focused real local-AI smoke coverage where practical, following patterns used by Nextcloud AI apps.

Real-model tests must assert stable contracts and invariants rather than exact generated prose.

Security/adversarial tests must include hostile document instructions, malformed structured output, unsafe generated markup, authorization denial, provider absence/failure and cancellation.

Documentation

The foundation is not complete when only code/contracts are merged.

Document the shared AI foundation in the LibreSign documentation project, including:

• Nextcloud-side prerequisites and configuration ownership;
• LibreSign capability availability;
• LibreSign policy controls and delegation;
• provider/data-processing notice where supportable;
• shared limitations and human-review expectations;
• troubleshooting for unavailable capabilities;
• security-relevant behavior administrators/users need to understand.

Do not document downstream roadmap features as if they were already released. Each downstream epic owns its feature-specific documentation when that epic is later reviewed and decomposed.

Documentation must describe the product, not the implementation history, and must fit the existing information architecture. Add contextual in-product help links where the implemented foundation UI benefits from them.

Research basis

The design should remain consistent with risk- and human-centered guidance such as NIST AI RMF / Generative AI Profile, ISO/IEC 23894, OECD AI Principles, UNESCO Recommendation on the Ethics of AI, and OWASP guidance for prompt injection and excessive agency.

Relevant product research includes Nextcloud AI integrations and public signing/document-assistant behavior from Adobe Acrobat Sign and Docusign.

Non-goals

This epic does not:

• implement every future AI feature;
• create a LibreSign LLM/provider configuration stack;
• choose or configure models for Nextcloud;
• implement its own RAG/vector database just because AI is being introduced;
• implement Ethical AI Rating;
• make AI output authoritative;
• give an LLM direct database or privileged API access.

Planning and downstream handoff

Only the foundation work whose contracts are sufficiently understood should be decomposed immediately.

This epic currently blocks #9049, #9050, #9051 and #9052 through GitHub's native dependency relationships.

Before this epic is closed:

1. record the final capability, policy, security, UX, testing and documentation contracts actually established here;
2. review Add AI-assisted signature appearance authoring #9049, Add AI-assisted document understanding #9050, Add AI-assisted field and recipient suggestions #9051 and Expose LibreSign documents to Nextcloud Context Chat #9052 against those contracts;
3. update assumptions that no longer match the completed foundation;
4. resolve or rewrite open questions using evidence from the completed work;
5. only then create or refine implementation sub-issues for those downstream epics.

Do not pre-create a full implementation backlog for blocked downstream epics while this foundation is incomplete.

Native GitHub dependency and sub-issue relationships are the source of truth for planning relationships.

Done when

• LibreSign has a reusable Nextcloud Task Processing integration contract.
• Capability discovery is provider-neutral and user/context aware.
• AI use is governed by Policy Workbench and enforced on the backend.
• Shared security/trust-boundary rules are implemented and tested.
• The frontend has a consistent Nextcloud-native pattern for AI affordances.
• Deterministic automated AI integration tests exist.
• Focused real-provider/local-AI contract coverage exists where justified.
• Administrative transparency is implemented without inventing provider trust metadata.
• AI configuration, policies, limitations and use are documented in LibreSign documentation.
• Contextual documentation links are added where the implemented UI benefits from them.
• Ethical AI/provider metadata has been re-evaluated against the public Nextcloud ecosystem.
• Downstream epics have been reviewed against the implemented contracts before this epic is considered complete.