Harden AI Analysis Path Implementation Plan

Steps

Add pure validator tests for modules/ai/types.ts.
Add/adjust analysis citation helper behavior in modules/ai/server/analysis.ts.
Add analysis service tests for missing config, invalid output, provider errors, retrieval degradation, and redaction.
Add knowledge service tests for scope, disabled entries, organization isolation, and embedding failure.
Add AI route tests for permission failures, invalid input, service failure propagation, success responses, and audit calls.
Improve knowledge UI and analysis dialog failure copy.
Clarify ai:manage permission description.
Align AI knowledge embedding storage to JSONB for production PostgreSQL without pgvector.
Run targeted AI tests, then project verification.

pnpm test -- modules/ai/types.test.ts
pnpm test -- modules/ai/server/analysis.test.ts modules/ai/server/knowledge.test.ts app/api/ai/ai-routes.test.ts
pnpm lint
pnpm type-check
pnpm test
pnpm build

Citation helper must reject unknown citation IDs and avoid appending unused citations.
Tests must not call real AI providers.
Tests must not require a live PostgreSQL instance unless explicitly scoped to migration smoke testing.
No new any, non-null assertions, @ts-ignore, or @ts-expect-error.
Failed history records must remain sanitized.

After citation strictness: revert helper and related tests if provider output compatibility proves too brittle.
After route tests: routes should remain behavior-compatible except status/copy assertions.
After UI copy: copy changes can be reverted without affecting backend contracts.