# Centrally governed AI library organization

AI organization is disabled by default. Administrators can enable `policy.library.aiSuggestionsEnabled` through the existing signed policy publication and independent review workflow. `aiAutoApplyEnabled` is a separate permission; automatic application also requires an approved local AI endpoint. The ordinary `policy.ai.enabled`, approved model/endpoint, policy expiry, library visibility and personal bookmark edit permissions remain authoritative.

The service uses the same approved OpenAI-compatible or Ollama gateway as the browser AI workspace. Its input contains only personal bookmark/tab IDs, titles and hostnames. Paths, query strings, fragments, credentials, page contents and managed company bookmarks are not sent. Titles are untrusted model input. Input and output pass the existing local DLP, optional semantic/YARA and configured enterprise ICAP checks. Confidential-local exceptions retain the existing restrictions; credentials and malware cannot be exempted.

`POST /api/device/library/propose` accepts `{policyVersion, bookmarkRevision, tabs, snapshotHash}` using an authenticated, active device credential. `snapshotHash` is SHA-256 of the normalized tab array produced by `librarySnapshotHash`. A model response must be a strict JSON object with `bookmarks: [{id, folder}]` and `tabs: [{id, group}]`. Every existing personal bookmark and supplied tab ID must appear exactly once. No new URLs, deleted items, commands or additional fields are accepted. Folder labels are limited to 80 characters and tab group labels to 40, without control characters.

Proposals expire after five minutes and are held only in bounded service memory. No model prompt or answer is persisted. Audit records contain counts, policy generation, revision and application mode. Restarting the service invalidates pending proposals. One generation request can run per device, with at most three pending proposals per device and 1,000 pending/in-flight proposals globally.

`POST /api/device/library/apply` accepts `{proposalId, policyVersion, expectedRevision, snapshotHash, mode}`. Mode is `manual` by default. Current policy permission, generation, exact personal bookmark revision, device ownership and snapshot binding are rechecked. Personal bookmark ordering and folder changes commit together in a SQLite transaction; company bookmarks are never mutated. The service returns a freshly signed bookmark snapshot and the tab grouping plan. A second application of the same proposal fails.

The browser must hold a native tab mutation reservation and verify its current snapshot before applying a returned tab grouping plan. The server cannot independently attest browser tab state. The returned signed bookmark snapshot must be verified with the enrolled management key. Native tab and central bookmark storage are separate boundaries: an unexpected browser interruption after a central bookmark commit requires reconciliation, rather than claiming cross-process atomicity.

The feature provides organization of existing personal bookmarks and browser tabs. It does not grant arbitrary JavaScript, CDP, secret export, policy bypass, model-generated navigation or modification of company bookmarks.

Validation: `node --test tests/library.test.mjs` checks default disablement, strict output, metadata minimization, signed batch application, stale bindings, permission denial, protected metadata, managed IDs and immutable company bookmarks.