Merge develop into AI-1445; consolidate OCR text views

Reconciles the OCR-results work that diverged: develop's ExtractedTextView
(markdown rendering via react-markdown + sanitize, with a rendered/raw toggle)
and this branch's OcrResults toggle (Extracted / Text / JSON).

- OcrResults keeps the 3-way toggle shell + JSON debug view; its Text view now
  delegates to ExtractedTextView so Azure layout markdown renders safely instead
  of being dumped as split-by-newline <p> tags.
- OcrResult.content uses develop's OcrContent type; dropped the duplicate inline
  content shape introduced here.
- Fixed conditional-hook ordering (useState now runs before the null guard) and
  disabled toggles for views with no data.
- DocumentViewerModal renders <OcrResults> guarded by develop's hasOcrData,
  preserving purged-document handling.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: alex-struk

.github/workflows/backend-qa.yml

@@ -5,6 +5,11 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
     branches: [main, develop]
+    paths:
+      - 'apps/backend-services/**'
+      - 'apps/shared/**'
+      - 'packages/**'
+      - '.github/workflows/backend-qa.yml'
   workflow_dispatch:
 
 jobs:
@@ -33,13 +38,18 @@ jobs:
         working-directory: apps/backend-services
         run: npm run db:generate
         env:
-          DATABASE_URL: "file:dev.db"
+          DATABASE_URL: "postgresql://localhost:5432/dummy"
       - name: Lint
         working-directory: apps/backend-services
         run: npm run lint
       - name: Type Check
         working-directory: apps/backend-services
         run: npm run type-check
+      - name: Build
+        working-directory: apps/backend-services
+        run: npm run build
+        env:
+          DATABASE_URL: "postgresql://localhost:5432/dummy"
       - name: Test
         working-directory: apps/backend-services
         run: npm run test:cov

.github/workflows/deploy-instance.yml

@@ -443,6 +443,25 @@ jobs:
             "app.kubernetes.io/instance=${INSTANCE_NAME}" --overwrite \
             -n "${OC_NAMESPACE}" || true
 
+      - name: Delete immutable PLG StatefulSets before upgrade
+        if: env.DEPLOY_PLG == 'true'
+        env:
+          INSTANCE_NAME: ${{ needs.metadata.outputs.instance-name }}
+          OC_NAMESPACE: ${{ needs.metadata.outputs.namespace || secrets.OPENSHIFT_NAMESPACE }}
+        run: |
+          set -euo pipefail
+          PLG_RELEASE="${INSTANCE_NAME}-plg"
+          # StatefulSet volumeClaimTemplates are immutable in Kubernetes.
+          # Delete the StatefulSets so Helm can recreate them with the correct
+          # spec. PVCs are not deleted and data is preserved.
+          for ss in loki prometheus; do
+            SS_NAME="${PLG_RELEASE}-${ss}"
+            if oc get statefulset "${SS_NAME}" -n "${OC_NAMESPACE}" &>/dev/null; then
+              echo "Deleting StatefulSet ${SS_NAME} for clean upgrade..."
+              oc delete statefulset "${SS_NAME}" -n "${OC_NAMESPACE}" --cascade=orphan
+            fi
+          done
+
       - name: Deploy PLG monitoring stack
         if: env.DEPLOY_PLG == 'true'
         env:

.github/workflows/frontend-qa.yml

@@ -5,6 +5,10 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
     branches: [main, develop]
+    paths:
+      - 'apps/frontend/**'
+      - 'packages/**'
+      - '.github/workflows/frontend-qa.yml'
   workflow_dispatch:
 
 jobs:

.github/workflows/temporal-qa.yml

@@ -5,6 +5,11 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
     branches: [main, develop]
+    paths:
+      - 'apps/temporal/**'
+      - 'apps/shared/**'
+      - 'packages/**'
+      - '.github/workflows/temporal-qa.yml'
   workflow_dispatch:
 
 jobs:
@@ -41,6 +46,11 @@ jobs:
       - name: Type Check
         working-directory: apps/temporal
         run: npm run type-check
+      - name: Build
+        working-directory: apps/temporal
+        run: npm run build
+        env:
+          DATABASE_URL: "postgresql://localhost:5432/dummy"
       - name: Run tests
         working-directory: apps/temporal
         run: npm test

apps/backend-services/Dockerfile

@@ -23,6 +23,9 @@ RUN cd /packages/blob-storage-paths && npm install --ignore-scripts && npm run b
 COPY packages/graph-workflow /packages/graph-workflow
 RUN cd /packages/graph-workflow && npm install --ignore-scripts && npm run build
 
+COPY packages/temporal-payload-codec /packages/temporal-payload-codec
+RUN cd /packages/temporal-payload-codec && npm install --ignore-scripts && npm run build
+
 COPY packages/monitoring /packages/monitoring
 RUN mkdir -p /packages/monitoring/node_modules/@ai-di && \
     ln -s /packages/logging /packages/monitoring/node_modules/@ai-di/shared-logging && \
@@ -65,6 +68,7 @@ COPY --from=builder /packages/logging /packages/logging
 COPY --from=builder /packages/graph-insertion-slots /packages/graph-insertion-slots
 COPY --from=builder /packages/blob-storage-paths /packages/blob-storage-paths
 COPY --from=builder /packages/graph-workflow /packages/graph-workflow
+COPY --from=builder /packages/temporal-payload-codec /packages/temporal-payload-codec
 COPY --from=builder /packages/monitoring /packages/monitoring
 
 # Copy package files

apps/backend-services/package.json

@@ -6,8 +6,8 @@
 	"private": true,
 	"license": "Apache-2.0",
 	"scripts": {
-		"build": "npm run db:generate && npm run build:graph-insertion-slots && npm run build:graph-workflow-config && npm run build:graph-workflow && nest build",
-		"build:prod": "NODE_ENV=production npm run db:generate && npm run build:graph-insertion-slots && npm run build:graph-workflow-config && npm run build:graph-workflow && nest build",
+		"build": "npm run db:generate && npm run build:graph-insertion-slots && npm run build:graph-workflow && nest build",
+		"build:prod": "NODE_ENV=production npm run db:generate && npm run build:graph-insertion-slots && npm run build:graph-workflow && nest build",
 		"build:logging": "cd ../../packages/logging && npm run build",
 		"format": "prettier --write \"src/**/*.ts\"",
 		"start": "nest start",
@@ -31,15 +31,13 @@
 		"workflow:migrate-ocr-refs": "tsx scripts/migrate-workflow-config-ocr-refs.ts",
 		"workflow:migrate-ocr-refs:apply": "tsx scripts/migrate-workflow-config-ocr-refs.ts --apply --refresh-benchmark-hashes",
 		"build:graph-workflow": "cd ../../packages/graph-workflow && npm run build",
-		"build:graph-workflow-config": "cd ../../packages/graph-workflow-config && npm run build",
 		"build:graph-insertion-slots": "cd ../../packages/graph-insertion-slots && npm run build"
 	},
 	"dependencies": {
 		"@ai-di/blob-storage-paths": "file:../../packages/blob-storage-paths",
-		"@ai-di/graph-workflow-config": "file:../../packages/graph-workflow-config",
-		"@ai-di/temporal-payload-codec": "file:../../packages/temporal-payload-codec",
 		"@ai-di/graph-insertion-slots": "file:../../packages/graph-insertion-slots",
 		"@ai-di/graph-workflow": "file:../../packages/graph-workflow",
+		"@ai-di/temporal-payload-codec": "file:../../packages/temporal-payload-codec",
 		"@ai-di/monitoring": "file:../../packages/monitoring",
 		"@ai-di/shared-logging": "file:../../packages/logging",
 		"@aws-sdk/client-s3": "3.990.0",

apps/backend-services/src/benchmark/benchmark-definition-db.service.ts

@@ -105,7 +105,7 @@ export class BenchmarkDefinitionDbService {
   async findBenchmarkProject(
     id: string,
     tx?: Prisma.TransactionClient,
-  ): Promise<{ id: string } | null> {
+  ): Promise<{ id: string; group_id: string } | null> {
     const client = tx ?? this.prisma;
     return client.benchmarkProject.findUnique({ where: { id } });
   }
@@ -120,11 +120,14 @@ export class BenchmarkDefinitionDbService {
   async findDatasetVersion(
     id: string,
     tx?: Prisma.TransactionClient,
-  ): Promise<{ id: string; dataset: { name: string } } | null> {
+  ): Promise<{
+    id: string;
+    dataset: { name: string; group_id: string };
+  } | null> {
     const client = tx ?? this.prisma;
     return client.datasetVersion.findUnique({
       where: { id },
-      include: { dataset: { select: { name: true } } },
+      include: { dataset: { select: { name: true, group_id: true } } },
     });
   }
 

apps/backend-services/src/benchmark/benchmark-definition.service.spec.ts

@@ -86,6 +86,7 @@ describe("BenchmarkDefinitionService", () => {
     createdAt: new Date(),
     dataset: {
       name: "Test Dataset",
+      group_id: "test-group",
     },
   };
 
@@ -114,6 +115,7 @@ describe("BenchmarkDefinitionService", () => {
     lineage: {
       id: "workflow-1",
       name: "Test Workflow",
+      group_id: "test-group",
     },
   };
 
@@ -502,6 +504,44 @@ describe("BenchmarkDefinitionService", () => {
       );
     });
 
+    it("rejects a dataset version owned by another group (cross-group reference blocked)", async () => {
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject); // group "test-group"
+      // Dataset version exists but its dataset belongs to a different group.
+      jest.spyOn(prisma.datasetVersion, "findUnique").mockResolvedValue({
+        ...mockDatasetVersion,
+        dataset: { name: "Other", group_id: "other-group" },
+      });
+
+      await expect(
+        service.createDefinition("project-1", createDto),
+      ).rejects.toThrow(
+        'Dataset version with ID "ds-version-1" does not exist',
+      );
+    });
+
+    it("rejects a workflow version owned by another group (cross-group reference blocked)", async () => {
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject); // group "test-group"
+      jest
+        .spyOn(prisma.datasetVersion, "findUnique")
+        .mockResolvedValue(mockDatasetVersion);
+      jest.spyOn(prisma.split, "findUnique").mockResolvedValue(mockSplit);
+      // Workflow version exists but its lineage belongs to a different group.
+      jest.spyOn(prisma.workflowVersion, "findUnique").mockResolvedValue({
+        ...mockWorkflowVersion,
+        lineage: { ...mockWorkflowVersion.lineage, group_id: "other-group" },
+      });
+
+      await expect(
+        service.createDefinition("project-1", createDto),
+      ).rejects.toThrow(
+        'Workflow version with ID "wv-workflow-1" does not exist',
+      );
+    });
+
     it("returns 400 when evaluator type is not registered", async () => {
       jest
         .spyOn(prisma.benchmarkProject, "findUnique")
@@ -701,6 +741,9 @@ describe("BenchmarkDefinitionService", () => {
       jest
         .spyOn(prisma.benchmarkDefinition, "findFirst")
         .mockResolvedValue(existingDefinition as never);
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject);
       jest.spyOn(prisma.benchmarkDefinition, "update").mockResolvedValue({
         ...existingDefinition,
         immutable: true,
@@ -770,6 +813,9 @@ describe("BenchmarkDefinitionService", () => {
       jest
         .spyOn(prisma.benchmarkDefinition, "findFirst")
         .mockResolvedValue(existingDefinition as never);
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject);
 
       const updatedDefinition = {
         ...existingDefinition,
@@ -1043,16 +1089,27 @@ describe("BenchmarkDefinitionService", () => {
       const baseLineageId = "base-lineage";
       const newBaseVersionId = "wv-new-base";
 
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject);
+
       jest.spyOn(prisma.workflowVersion, "findUnique").mockResolvedValue({
         id: candidateWorkflowVersionId,
         config: candidateConfig,
         lineage: {
           id: "cand-lineage",
+          group_id: "test-group",
           workflow_kind: "benchmark_candidate",
           source_workflow_id: baseLineageId,
         },
       } as never);
 
+      jest.spyOn(prisma.workflowLineage, "findUnique").mockResolvedValue({
+        id: baseLineageId,
+        group_id: "test-group",
+        head_version_id: "wv-old-head",
+      } as never);
+
       jest.spyOn(prisma.workflowVersion, "findFirst").mockResolvedValue({
         version_number: 2,
       } as never);
@@ -1107,16 +1164,27 @@ describe("BenchmarkDefinitionService", () => {
       const baseLineageId = "base-lineage";
       const candidateLineageId = "cand-lineage";
 
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject);
+
       jest.spyOn(prisma.workflowVersion, "findUnique").mockResolvedValue({
         id: candidateWorkflowVersionId,
         config: candidateConfig,
         lineage: {
           id: candidateLineageId,
+          group_id: "test-group",
           workflow_kind: "benchmark_candidate",
           source_workflow_id: baseLineageId,
         },
       } as never);
 
+      jest.spyOn(prisma.workflowLineage, "findUnique").mockResolvedValue({
+        id: baseLineageId,
+        group_id: "test-group",
+        head_version_id: "wv-old-head",
+      } as never);
+
       jest.spyOn(prisma.workflowVersion, "findFirst").mockResolvedValue({
         version_number: 2,
       } as never);
@@ -1195,11 +1263,15 @@ describe("BenchmarkDefinitionService", () => {
     });
 
     it("rejects non-candidate workflows", async () => {
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject);
       jest.spyOn(prisma.workflowVersion, "findUnique").mockResolvedValue({
         id: "wv-primary",
         config: candidateConfig,
         lineage: {
           id: "primary-lineage",
+          group_id: "test-group",
           workflow_kind: "primary",
           source_workflow_id: null,
         },
@@ -1210,6 +1282,37 @@ describe("BenchmarkDefinitionService", () => {
       ).rejects.toThrow(/not a benchmark candidate/i);
     });
 
+    it("rejects a candidate whose source points at another group's base lineage (cross-group write blocked)", async () => {
+      // Candidate is in the caller's group, but its source_workflow_id points at
+      // a lineage owned by a different group. The base-lineage group check must
+      // reject this before any version is written.
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue(mockProject);
+      jest.spyOn(prisma.workflowVersion, "findUnique").mockResolvedValue({
+        id: "candidate-v1",
+        config: candidateConfig,
+        lineage: {
+          id: "cand-lineage",
+          group_id: "test-group",
+          workflow_kind: "benchmark_candidate",
+          source_workflow_id: "foreign-base-lineage",
+        },
+      } as never);
+      // Base lineage belongs to another group.
+      jest.spyOn(prisma.workflowLineage, "findUnique").mockResolvedValue({
+        id: "foreign-base-lineage",
+        group_id: "other-group",
+        head_version_id: "wv-foreign-head",
+      } as never);
+      const createSpy = jest.spyOn(prisma.workflowVersion, "create");
+
+      await expect(
+        service.applyToBaseWorkflow("project-1", "candidate-v1", false),
+      ).rejects.toThrow(NotFoundException);
+      expect(createSpy).not.toHaveBeenCalled();
+    });
+
     it("throws ConflictException when definition pin does not match lineage head inside transaction", async () => {
       const projectId = "project-1";
       const definitionId = "def-1";
@@ -1235,6 +1338,10 @@ describe("BenchmarkDefinitionService", () => {
         edges: [],
       };
 
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue({ ...mockProject, group_id: baseLineageGroupId });
+
       let findFirstCalls = 0;
       jest
         .spyOn(prisma.benchmarkDefinition, "findFirst")
@@ -1315,6 +1422,10 @@ describe("BenchmarkDefinitionService", () => {
         .spyOn(service, "getDefinitionById")
         .mockResolvedValue({ id: definitionId } as never);
 
+      jest
+        .spyOn(prisma.benchmarkProject, "findUnique")
+        .mockResolvedValue({ ...mockProject, group_id: baseLineageGroupId });
+
       jest.spyOn(prisma.benchmarkDefinition, "findFirst").mockResolvedValue({
         id: definitionId,
         projectId,