Proposes the integration contract between portal-bff and apf-ai-service:
- BFF dials the AI service over native gRPC HTTP/2 (h2c in dev, h2 +
TLS in prod) via @grpc/grpc-js + ts-proto stubs.
- Browser-facing chat surface is text/event-stream — each ChatEvent
oneof case translates to one SSE frame; cancellation flows
browser-close → call.cancel() → upstream LLM stop.
- Proto files vendored from apf-ai-service/contract/proto into the BFF
with on-demand codegen; both proto + generated stubs committed for
hermetic builds and reviewable diffs.
- POC ships unsigned Principal { subject, roles[], attributes{} } in
the proto body, mirroring apf-ai-service's ADR-0010. Subject is the
Entra oid hashed with the same HashUserIdService salt as the audit
module so apf_portal and apf-ai-service audit trails join cleanly.
- Production hardening choice (signed envelope vs mTLS) deferred until
the first production deployment is in scope; recorded as an open
item to be amended jointly in both repos.
Julien Gautier