PUBLIC BACKGROUND RESEARCH - CASE FILES PROFESSIONAL

Included in both GIB and Commercial installers. Open Field Operations >
Research & AI, choose a case, then choose a saved subject / claimant.
The page follows the approved preview: subject details, research scope,
source-linked finding cards, match review and case summary controls.

SETUP
In Agency Setup > AI & Scene Tools:
1. Save an OpenAI API key under API Credentials.
2. Enable AI and Public Background Research.
3. Enter an exact OpenAI model ID supporting the Responses API web_search
   tool. A separate public-research model can be set; blank uses the AI model.
4. Save settings. Public research is disabled until the agency enables it.
Search/tool usage and model usage are billed to the configured agency account.
Official integration reference:
https://developers.openai.com/api/docs/guides/tools-web-search

IDENTITY AND RESEARCH
Uses selected saved name, aliases, DOB, calculated age, address, phone, email
and identifying details. When DOB is missing, the user can enter a known
approximate age for this search. Review the exact fields before authorizing
transmission. Each request keeps an encrypted, dated identifier snapshot.
Private notes, case documents, case number and photos are excluded from the
provider request. The case photo is displayed locally for manual review only.
Automated facial identification and photo-based identity matching are not
included. Missing identifiers and public-source gaps are not inferred.

Scopes: court/public records, business affiliations, news, public social media.
Social research covers accessible profiles/posts across Facebook, Instagram,
LinkedIn, TikTok, X/Twitter, YouTube, Reddit, Threads, Bluesky, Mastodon,
Pinterest and other relevant public platforms. This is not exhaustive coverage;
search cannot access private/sign-in-only content or restricted databases.

Only findings with URLs present in provider citation/consulted-source metadata
are shown. Every match starts as Possible Match. Review original sources,
corroborating identifiers and conflicts; record notes before Confirmed by
Reviewer or Not Relevant. Shared names or cities do not establish identity.
Charges/allegations and convictions must remain distinct. Absence of a finding
does not establish absence of records. Research is not an eligibility decision.

SAVE TO CASE
Save individual findings, a selection, or the complete draft research summary.
Saved items retain links, source dates, match status and reviewer notes in the
encrypted case research record. View them in Case Research History; the existing
Research History also opens these records. They do not automatically enter a
client report or change subject profiles, case status or accounting records.
Not Relevant findings cannot be saved and are removed from the saved selection.

PERMISSIONS / REQUEST CONTROL
Administrator, case manager and assigned investigator access follows existing
case scope. Only the researcher or case management can change a research draft.
Closed/cancelled cases are read only. Clients/accounting cannot access this page.
Requests use CSRF protection, subject-version checks, idempotency and the shared
30 AI requests/hour agency limit. Results and identifiers are encrypted at rest.
There is no automatic retry of uncertain or timed-out requests. Provider storage
is disabled for the request; this does not guarantee zero provider retention.
Provider/account failures and incomplete/unparseable search results are recorded
as uncertain. Check usage and model/tool availability before a new request.

GIB PATCH
Back up the existing application, then extract the patch into its application
root and overwrite the included files, preserving app and assets directories.
No database migration is needed; the existing cfp_research table is used.
The full installers already contain the feature and all earlier packaged fixes.

VALIDATION
20 PHP files parsed under PHP 8.3. Behavioral tests cover subject/case scope,
identifier exclusions, DOB/age boundaries, source validation, fake-source
omission, repeated-request prevention, uncertain results, save/review persistence,
stale versions, invalid selections and closed/cancelled permissions. 40 UI checks
cover both editions across mobile/tablet/desktop states, source escaping, review
controls and selected-finding form submission.
No live MySQL or billed OpenAI search was exercised in this environment. A real
provider smoke test with the configured model/account is still needed on the
test site. No real personal records were used in the test fixtures.
