diff --git a/mcp-server/biometric_intake.html b/mcp-server/biometric_intake.html new file mode 100644 index 0000000..962b6ae --- /dev/null +++ b/mcp-server/biometric_intake.html @@ -0,0 +1,467 @@ + + + + + +Lakehouse — Biometric Consent Intake + + + + +
+

⚡ Biometric Consent Intake

+ step 1 of 4 + … +
+ +
+ + +
+

Operator authentication

+

Paste the legal-tier audit token. Stored in this tab's session only; cleared on close. Never persists to disk.

+
+ + +
+ +
+
+
+
+ + + + + +
+

Photo capture

+

Take or upload a clear photo. Stored quarantined under data/biometric/uploads/ with mode 0700/0600 + SHA-256 integrity hash. Audit chain records the upload event.

+ +
+

Option A — File upload

+ + +

Option B — Camera capture

+ + + + + + +

Preview

+ +

No photo selected yet.

+ +
+ + +
+
+
+
+ + +
+
+

✓ Intake complete

+

Audit chain rows (HMAC-SHA256, persisted to data/_catalog/subjects/<id>.audit.jsonl):

+
+ +
+

Consent grant

+
+ StatusGiven + Given at… + Retention until… +
+

Audit hmac

+ +
+ + + +
+

Verification

+

Operator: confirm the audit chain by running:

+
./scripts/staffing/verify_biometric_erasure.sh <candidate_id>
+

Or hit GET /audit/subject/<id> with legal-tier auth to read the full chain.

+
+ +
+ +
+
+ +
+ +
+ + Phase 1.6 BIPA Gates + · Consent template v1 + · Destruction runbook + +
+ + + + diff --git a/mcp-server/index.ts b/mcp-server/index.ts index c144b43..e2b0cd5 100644 --- a/mcp-server/index.ts +++ b/mcp-server/index.ts @@ -767,6 +767,17 @@ async function main() { }); } + // Biometric intake — Phase 1.6 Gate 2 frontend. Operator-driven + // candidate consent + photo capture flow. POSTs to gateway's + // /biometric/subject/{id}/consent + /photo. URL must include + // ?candidate_id=WORKER-XXX. Operator's legal-tier audit token + // is captured into sessionStorage (cleared on tab close). + if (url.pathname === "/biometric/intake") { + return new Response(Bun.file(import.meta.dir + "/biometric_intake.html"), { + headers: { ...cors, "Content-Type": "text/html" }, + }); + } + // Workspaces — per-contract state (Phase 8.5). UI layer over the // gateway's /workspaces/* routes: list, create, detail, handoff, // save-search, shortlist, log-activity. All persisted on the