Trust by design
Every AI decision is logged. Every consent state is enforced. Every parent can ask why and get a real answer.
TraceLayer
The audit spine. Every AI call writes to ai_decision_logs with student/activity IDs, model + usage, redaction report. 90-day TTL; 7-year audit retention.
“Why this?” card
Plain-language reason on every AI-recommended activity. Surfaces the redaction count + model used. Parent-facing.
Build-time PII attestation
Every AI route in the codebase must call redactForAi() before any payload reaches a model. Build script generates a committed attestation report; CI fails if a new route is ungated.