Upstream Mike PR #345 review

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: high

Needs architecture and security decision; metadata-only evidence is insufficient for this cross-stack refactor.

Mike PR open-legal-products#345

• Outcome: needs-decision
• Capability: Provider-neutral assistant source-document normalization with shared citation, document-event, and edit-card presentation across web and Word clients
• Series: assistant-source-ui-convergence
• Dependencies: Likely upstream Word add-in foundation (feat(word-addin): align chat UI with web app open-legal-products/mike#299), Likely canonical shared frontend assets (refactor: make frontend icons canonical open-legal-products/mike#343)
• Prerequisites: Complete upstream patch and dependency diff, Contract tests for normalized document, case-law, and citation sources, Legal-source attribution and citation-verification review, Data-boundary and source-document authorization review, ROSS product decision on a Word add-in runtime
• Reason: The omitted 118-file change spans dependencies and lockfiles, source APIs, citation verification, legal-source behavior, data boundaries, and an absent ROSS Word client. Current ROSS seams exist in backend citation/legal-source routes and frontend shared types/assistant panels, but metadata cannot establish safe contract compatibility.

Architecture brief

Implement any approved subset at ROSS’s existing seams: normalize provider-neutral source records behind backend citation and legal-source contracts, expose them through authenticated source-document routes, and resolve them in frontend shared types and AssistantSidePanel. Keep ROSS legal-source verification and data-boundary controls authoritative; treat Word UI sharing as a separate capability requiring an approved Word runtime.

Implementation plan

• Obtain and review the full upstream patch, package manifests, lockfile delta, and API examples.
• Specify a ROSS-native normalized source contract covering uploaded documents, cases, provider authorities, quotes, attribution, and stable identifiers.
• Map authorization, ownership, hosted-data-boundary, and citation-verification invariants before adding any route.
• Build backend contract tests and frontend panel-resolution tests using document, case-law, and Ontario legal-source fixtures.
• Evaluate the web-only implementation independently; separately decide whether Word add-in architecture and shared UI packaging are in scope.

Required human action

This is a draft state-only architecture record. Review the brief and implementation plan before any code is attempted.