* feat(settings): per-company opt-in for data analysis of bookkeeping outcomes (#1346)
Adds company_settings.data_analysis_opt_in (default false, no grandfathering)
and gates every path that reads bookkeeping outcomes across companies on it:
POST /api/agent/categorize/outcome stops writing calibration samples for
companies that have not opted in, and the backtest / calibration-fit scripts
filter to opted-in company ids. One helper (lib/company/data-analysis.ts)
is the single gate for future analysis paths. A toggle on Inställningar >
Företag states plainly what is analysed (proposed vs booked account, amount,
confidence; no free text, no personal data) in sv and en. The flag is UI-only
by design: consent is a human action, so it is absent from the v1 REST / MCP
settings pick lists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna
* fix(settings): make data-analysis consent copy true for the backtest path (#1346)
Addresses adversarial review findings on PR #2007:
- Findings 1-3 (consent narrower than the gated processing): the flag also
gates scripts/backtest-categorize.ts, which re-runs transaction
descriptions, merchant names and matched underlag through the model. The
sv/en toggle help and disclosure now state that explicitly as "evaluation
runs" and no longer claim that free text or underlag are excluded. The
migration header and COMMENT, the lib/company/data-analysis.ts docstring,
the backtest script header and the DECISIONS line say the same. Kept the
gate (un-gating would put the script back to reading every company with
no consent at all). A test pins that both locales name those inputs and
contain no "no free text / no underlag" denial.
- Finding 4 (member sees an active switch that RLS rejects): the toggle is
now enabled only for owner/admin, matching the company_settings update
policy; the disclosure says only administrators can change the choice.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna
* fix(scripts): address round-2 review findings (#1346)
1. [minor] Opted-in company filter was an unbounded PostgREST `in` list in
the URL (scripts/fit-categorize-calibration.ts, scripts/backtest-categorize.ts).
Both scripts now read the opted-in ids through a shared, paginated helper
(listDataAnalysisOptedInCompanyIds, fetchAllRows so the pre-fetch no longer
caps at 1000) and query per chunk of 100 ids (chunkCompanyIds). The fit
script pages each chunk on the id PK; the backtest merges per-chunk
results and re-cuts to the N most recent overall. Early exit on zero
opt-ins is kept. Pinned with tests in lib/company/__tests__/data-analysis.test.ts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna
* fix(scripts): coerce a null transaction description in the backtest (#1346)
The typed row from the chunked consent query made description nullable,
which TransactionForSelect does not accept; fall back to the original
description or an empty string, as the untyped row did implicitly before.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Turns the selector's raw confidence into a score that means what it says.
- lib/agent/categorize/calibration.ts: the engine. Isotonic regression
(pool-adjacent-violators, distribution-free + monotonic) over
(confidence, was_correct) samples → a calibrator; plus reliabilityByBucket,
ECE, and bandFor(). bandFor NEVER returns 'auto' without a fitted calibrator
(no silent booking on an unproven score) and never auto-books above an amount
cap. 12 engine tests (overconfidence pulled down, underconfidence lifted,
monotonicity, ECE, band gating).
- Measurement loop: migration categorize_calibration_samples (append-only,
company-scoped RLS, confidence CHECK [0,1]) + POST /api/agent/categorize/
outcome logging one sample (proposed vs actually booked) fire-and-forget from
QuickReviewDialog on a successful book (sandbox skipped). AiCategorizeProposal
surfaces the proposal metadata via onProposal.
- scripts/fit-categorize-calibration.ts (read-only): prints the reliability
diagram + ECE + fitted calibrator once data has accumulated.
Fitting needs a few hundred real outcomes, so nothing calibrates today — the
loop starts collecting, and "säker" stays uncalibrated (no auto-book) until the
data proves it. 131 unit tests green; RLS covered by a pg-real test.
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Jakob Wennberg