docs(setup): the AI Copilot checklist says what Setup actually ships

[os-steve]

Fixes #1614

Section 14. AI Copilot of the admin setup checklist told an admin to "Confirm the AI Copilot is enabled (Setup → AI)", to "Choose which skills to enable" and to "Configure data sensitivity rules — which fields the Copilot must redact". Setup ships no AI group, and neither of the other two screens exists. All three are resolved together, against the installed platform (@objectstack/* 17.3.0), the way test/docs-setup-navigation-names.test.ts builds its roster — SETUP_APP.navigation + SETUP_NAV_CONTRIBUTIONS + SetupAppTranslations, across the four shipped locales.

The three measurements

1. Nothing enables the Copilot — and the one control that looks like it does is not it.
Setup's nine groups are Overview, Apps, People & Organization, Access Control, Approvals, Configuration, Diagnostics, Integrations, Advanced; AI is a Studio group holding Agents / Tools / Skills. The ai settings namespace behind Setup → Configuration → AI & Embedder carries no master switch: its only toggles are Auto-summarize conversation titles, Record traces and Log full prompts, and its only gestures are Test connection, Test embedder and Reset to environment defaults — matching what #1591 measured.

The candidate switch is real: feature_flags.ai_enabled, labelled AI Assistant under Setup → Configuration → Feature Flags, tenant-scoped, marked beta, default false, help text "Enables the in-app AI assistant panel", env-pinnable as OS_FEATURE_FLAGS_AI_ENABLED. It is still not the Copilot's switch: the key ai_enabled occurs nowhere in the installed @objectstack/* tree except its own manifest and its four locale label bundles, and the shipped console computes assistant availability from the agent roster rather than from any feature flag. What does decide whether the Copilot can answer is the provider, whose manifest default is Memory (echo — testing only) — it replays the question instead of answering it.

So the item became that check plus a denial, not a redirect to a plausible-looking screen. It was not deleted (the route the dispatch offered): with the default provider there is a real Day-5 thing to do, and the checklist genre wants the thing to do.

2. There is no per-skill enable surface.
No Setup entry names skills, and none of the eleven settings namespaces (sys, auth, mail, sms, branding, feature_flags, storage, ai, knowledge, localization, company) carries a skill key. active is skill metadata: SkillSchema defaults it to true, none of the six src/skills/*.skill.ts files declares it, and the roster comes from allSkills — which content/docs/customization/ai-skills already documents as an app change. The item now points at Studio → AI → Skills for the roster and says the set is decided in the app rather than picked at setup time.

Not settled, and reported as unsettled rather than asserted: whether Studio's metadata:resource browser lets an admin flip active on a package-provided skill. The wording holds either way — Studio is not Setup, and the roster still comes from the app.

3. There are no AI sensitivity or redaction rules to configure.
The only redactFields the platform defines belongs to an object's publicSharing block — "Field names removed from records served via a share token" — which crm_knowledge_article uses for share links and which has nothing to do with the Copilot. No settings namespace and no Setup entry mentions redaction or sensitivity. What limits what the Copilot may read is field-level security, which administration/sharing-and-security already states in its own words: FLS is enforced in list views, reports, the API and the AI Copilot alike, and the Copilot reads as the signed-in user. The item now sends the reader there.

Shape

The shape is the one ruled on #1402 / PR #1401 and again on #1591 / PR #1616: say what actually ships, put a denial where nothing does, redirect only to a path that resolves live. Every surviving path is written in bold — the free half of the fix. This instance's citation was bare parenthesised prose, invisible to both of #853's rules: rule 2 matches a bold **App → …** citation, and rule 1 cannot ban AI, which is a real Studio label. No guard was extended and none was built.

Ablation — committed first, mutation proved on disk, restored byte-identically to the HEAD blob (fe9da43c… before, 7612af69… mutated, fe9da43c… after; git diff HEAD empty):

• replacing the two live **Setup → Configuration → AI & Embedder** citations in setup.mdx with **Setup → AI → AI & Embedder** turns test/docs-setup-navigation-names.test.ts red, exit 1, naming the file and the segment: content/docs/administration/setup.mdx: 'Setup → AI'
• restoring turns it green again, exit 0, 18 tests

That is what the bolding buys: the same wrong claim that shipped invisibly for months is caught by name once it is written in the shape rule 2 parses. It is also why no bolded path here is one that fails to resolve — the first segments are Configuration (a Setup group) and AI (a Studio group), in every face.

Locale conventions

• zh-Hans uses the zh-CN language-pack wording, resolved live: 设置 → 配置 → AI 与 Embedder, 设置 → 配置 → 功能开关, Studio → AI → 技能, AI 助手, 测试连接, Memory(回显 — 仅测试).
• zh-Hant spells platform navigation in English, because the console falls back to Simplified and a Traditional page would otherwise ship mixed script (The zh-Hant navigation convention rests on a false reason: the console falls back to Simplified, not English #1368).
• Both localized faces keep their /zh-Hans/ and /zh-Hant/ prefixes on every site-absolute link (docs(i18n): keep the locale prefix on twelve links in the Chinese pages #1599).

Gates

Full pnpm verify chain, run script by script in this worktree at 95acfe09:

gate	exit
pnpm validate	0
pnpm typecheck	0
pnpm lint	0
pnpm lint:i18n-gate	0 — "i18n lint gate: 0 i18n/missing-* issues"
pnpm hygiene	0 — "source hygiene clean"
pnpm hygiene:tokens	0 — "source token ratchet clean"
pnpm build	0 — "Build complete"
pnpm test	0 — 160 files, 3394 passed, 1 skipped

What no gate reads

The prose itself. link-check.yml wakes on .mdx but runs file-extension: '.md' with check-modified-files-only, so it opens none of the three pages — only the changeset, which carries no site-absolute links. A green there says nothing about these edits. The evidence for the paths is the roster read above, not a check mark.

Scope

content/docs/administration/setup.mdx + .zh-Hans.mdx + .zh-Hant.mdx, section 14 only, plus one changeset. No src/, no test/**, no new guard, no other section.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hotcrm	Ignored		Sep 6, 2026 12:45am UTC