Reorganize docs and workflow package refs

Move scattered feature docs into the proper `docs-md` topic folders, fix internal links and agent-rule references, and refresh wiki/source routing to match the new taxonomy. This also updates architecture/workflow docs for current transaction and audit behavior, documents OCR result views and Temporal payload footprint handling, and removes the obsolete Temporal build step for the old `graph-workflow-config` package after its consolidation into `@ai-di/graph-workflow`.

Author: kmandryk

.claude/skills/docs-sync/CONVENTIONS.md

@@ -4,15 +4,15 @@
 
 | Folder | Scope |
 | --- | --- |
-| `architecture/` | System-level design: HITL architecture, database services/roles, blob storage, reference data tables, template models, shared packages, audit table, HA |
+| `architecture/` | System-level design: HITL architecture, database services/roles, transaction/audit compliance, blob storage, document content hash, ephemeral document cleanup, reference data tables, template models, shared packages, audit table, HA |
 | `auth/` | Authentication (OAuth/Keycloak, API keys) and group resource authorization |
 | `groups/` | Group management APIs, membership requests, group frontend pages/context |
-| `workflows/` | DAG workflow engine, graph types, node/activity/OCR-provider guides, workflow builder, node catalog, lineage, config overrides, Temporal worker concurrency, `templates/` example configs |
-| `extraction/` | OCR/extraction: Azure AI models, classifiers, enrichment, field formatting, image normalization, confusion profiles/matrices, OCR improvement pipeline, ground truth, HITL datasets |
+| `workflows/` | DAG workflow engine, graph types, node/activity/OCR-provider guides, workflow builder, node catalog, lineage, config overrides, Temporal worker concurrency, Temporal payload footprint (gzip codec + OCR payload refs), `templates/` example configs |
+| `extraction/` | OCR/extraction: Azure AI models, classifiers, enrichment, field formatting, image normalization, confusion profiles/matrices, OCR improvement pipeline, OCR failure handling, OCR result views, ground truth, HITL datasets |
 | `operations/` | OpenShift deployment, environment configuration, backups, Azure infrastructure, secrets, npm hardening |
 | `monitoring/` | PLG stack, Helm charts, Promtail, dashboards, metrics, alerting, logging |
 | `benchmarking/` | Benchmarking system, load testing runbooks |
-| `frontend/` | Frontend-wide concerns: BC Design System migration, UI patterns not tied to one feature |
+| `frontend/` | Frontend-wide concerns: BC Design System migration, confirmation-modal and sentence-case standardization, header/upload UI, UI patterns not tied to one feature |
 | `archive/` | Historical/point-in-time artifacts only — see `archive/README.md` |
 | `wiki/` | Routing layer — rules in `wiki/README.md`, canonical agent rules in `AGENTS.md` (Repo Wiki section) |
 

.github/copilot-instructions.md

@@ -28,7 +28,7 @@
 - Tables should be designed with a `created_at` timestamp (default to now) and an `updated_at` timestamp (auto-updated on change) for auditing purposes.
 - Table names should be singular (e.g., `User`, not `Users`) to align with Prisma conventions.
 - **Transactions:** Two or more database writes that must succeed or fail together MUST use a single Prisma transaction. Db-services take optional `tx?: Prisma.TransactionClient` as the last parameter (`const client = tx ?? this.prisma`). Services start cross-module transactions with `prismaService.transaction()` and pass `tx` through — services must not query `tx` directly. Controllers never use transactions. See `docs-md/DATABASE_SERVICES.md`.
-- **Audit on mutations:** Every user-initiated mutation and every service-layer mutation transaction MUST emit an audit event (`AuditService.recordEvent` or benchmark `AuditLogService`). Pass `tx` to audit when inside a transaction; otherwise audit after commit (best-effort, non-fatal). See `docs-md/AUDIT.md` and the compliance audit in `docs-md/TRANSACTION_AND_AUDIT_AUDIT.md`.
+- **Audit on mutations:** Every user-initiated mutation and every service-layer mutation transaction MUST emit an audit event (`AuditService.recordEvent` or benchmark `AuditLogService`). Pass `tx` to audit when inside a transaction; otherwise audit after commit (best-effort, non-fatal). See `docs-md/architecture/AUDIT.md` and the compliance audit in `docs-md/architecture/TRANSACTION_AND_AUDIT_AUDIT.md`.
 
 ## Repo Wiki
 

CLAUDE.md

@@ -10,6 +10,6 @@
 - To test API directly, use: `curl -H "x-api-key: $API_KEY" http://localhost:3002/api/...` (read the key from your local env/config; never paste or log secret values).
 - NEVER read secrets from .env files directly, they should not be leaked into chat, terminal, etc., do not operate with secret values directly, only indirectly through variables.
 - **Database transactions:** Any operation that performs two or more database writes that must stay consistent MUST run inside a single Prisma transaction. Db-services accept optional `tx?: Prisma.TransactionClient` as the last parameter and use `const client = tx ?? this.prisma`. Services initiate cross-module transactions via `prismaService.transaction(async (tx) => { ... })` and pass `tx` to db-services (and other services) — never query `tx` directly in services. Controllers never initiate or receive transactions. See [docs-md/architecture/DATABASE_SERVICES.md](docs-md/architecture/DATABASE_SERVICES.md).
-- **Audit on mutations:** Every user-initiated create/update/delete (and every service-layer mutation transaction) MUST record an audit event via `AuditService.recordEvent` (global) or `AuditLogService` / `AuditLogDbService` (benchmark). Pass the same `tx` into audit when the mutation is transactional; otherwise call audit immediately after a successful commit. Audit failures must not fail the main operation unless audit is intentionally in the same transaction. Read/access endpoints follow [docs-md/architecture/AUDIT.md](docs-md/architecture/AUDIT.md). When reviewing or adding backend code, check [docs-md/TRANSACTION_AND_AUDIT_AUDIT.md](docs-md/TRANSACTION_AND_AUDIT_AUDIT.md) for known gaps.
+- **Audit on mutations:** Every user-initiated create/update/delete (and every service-layer mutation transaction) MUST record an audit event via `AuditService.recordEvent` (global) or `AuditLogService` / `AuditLogDbService` (benchmark). Pass the same `tx` into audit when the mutation is transactional; otherwise call audit immediately after a successful commit. Audit failures must not fail the main operation unless audit is intentionally in the same transaction. Read/access endpoints follow [docs-md/architecture/AUDIT.md](docs-md/architecture/AUDIT.md). When reviewing or adding backend code, check [docs-md/architecture/TRANSACTION_AND_AUDIT_AUDIT.md](docs-md/architecture/TRANSACTION_AND_AUDIT_AUDIT.md) for known gaps.
 - Repo wiki rules: see `AGENTS.md` (Repo Wiki section).
 - Skills: see `AGENTS.md` (Skills section). Use `.claude/skills/documentation/` when updating docs or the wiki; use `.claude/skills/create-pr/` when opening a pull request.

apps/temporal/package.json

@@ -16,7 +16,6 @@
 		"lint:fix": "npm run lint -- --write",
 		"pretest": "npm run build:logging && npm run build:graph-insertion-slots && npm run build:graph-workflow",
 		"build:graph-workflow": "cd ../../packages/graph-workflow && npm run build",
-		"build:graph-workflow-config": "cd ../../packages/graph-workflow-config && npm run build",
 		"test": "jest",
 		"build:graph-insertion-slots": "cd ../../packages/graph-insertion-slots && npm run build"
 	},

docs-md/README.md

@@ -6,15 +6,15 @@ Canonical markdown documentation for the Document Intelligence platform, organiz
 
 | Folder | Contents |
 | --- | --- |
-| [architecture/](architecture/) | System-level design: HITL architecture, database services, blob storage, reference data tables, template models, shared packages, audit table, high availability, the workflow-node + configuration-UI extension pattern |
+| [architecture/](architecture/) | System-level design: HITL architecture, database services, transaction/audit compliance, blob storage, document content hash, ephemeral document cleanup, reference data tables, template models, shared packages, audit table, high availability, the workflow-node + configuration-UI extension pattern |
 | [auth/](auth/) | Authentication (OAuth/Keycloak, API keys) and group-based resource authorization |
 | [groups/](groups/) | Group management: APIs, membership requests, frontend pages and context |
-| [workflows/](workflows/) | DAG workflow engine, graph types, adding nodes/activities/OCR providers (incl. Mistral OCR), workflow builder guide and design brief, node catalog, lineage/versions, config overrides, Temporal worker concurrency, [templates/](workflows/templates/) example configs |
-| [extraction/](extraction/) | OCR and extraction: Azure AI models, classifiers, enrichment, field formatting, image normalization, confusion profiles/matrices, OCR improvement pipeline, ground truth and HITL datasets |
+| [workflows/](workflows/) | DAG workflow engine, graph types, adding nodes/activities/OCR providers (incl. Mistral OCR), workflow builder guide and design brief, node catalog, lineage/versions, config overrides, Temporal worker concurrency, Temporal payload footprint (gzip codec + OCR payload refs), [templates/](workflows/templates/) example configs |
+| [extraction/](extraction/) | OCR and extraction: Azure AI models, classifiers, enrichment, field formatting, image normalization, confusion profiles/matrices, OCR improvement pipeline, OCR failure handling, OCR result views, ground truth and HITL datasets |
 | [operations/](operations/) | OpenShift deployment, CI workflows overview, environment configuration, backups, Azure infrastructure, secrets management, npm hardening |
 | [monitoring/](monitoring/) | PLG stack (Prometheus, Loki, Grafana), Helm charts, Promtail sidecars, dashboards, metrics, alerting, logging |
 | [benchmarking/](benchmarking/) | Benchmarking system, load testing runbooks and stress run sheets |
-| [frontend/](frontend/) | BC Design System migration, reference data tables UI |
+| [frontend/](frontend/) | BC Design System migration, reference data tables UI, confirmation-modal and sentence-case standardization, header/upload UI |
 | [archive/](archive/) | Point-in-time artifacts (reports, audits, completed plans) — historical only, see [archive/README.md](archive/README.md) |
 | [wiki/](wiki/) | Repo wiki: routing map for humans and LLM agents — see [wiki/README.md](wiki/README.md) for rules |
 

docs-md/architecture/AUDIT.md

@@ -14,8 +14,10 @@ In addition to the event types listed below, **every user-initiated create, upda
 
 | Domain | Service | Audit helper |
 |--------|---------|--------------|
-| Global (HITL, groups, tables, documents, workflows) | Feature service or controller | `AuditService.recordEvent` |
-| Benchmark (datasets, runs, definitions) | Feature service | `AuditLogService` or `AuditLogDbService` |
+| Global (HITL, groups, tables, documents, workflows, bootstrap, most benchmark lifecycle) | Feature service or controller | `AuditService.recordEvent` |
+| Benchmark `benchmark_audit_log` table (a small subset) | Feature service | `AuditLogService` or `AuditLogDbService` |
+
+> **Hybrid benchmark audit.** Most benchmark/dataset lifecycle mutations record to the global `audit_events` table via `AuditService.recordEvent` (see the benchmark event-type tables below). Only a few actions still write the separate `benchmark_audit_log` table via `AuditLogService` / `AuditLogDbService` (`AuditAction`): `dataset_created` (`DatasetService.createDataset`), `version_published` (`HitlDatasetService.packageDocumentsIntoVersion`), `run_started` (`BenchmarkRunService.startRun`), and `baseline_promoted` (`BenchmarkRunService.promoteRunToBaseline`). The `run_completed` helper (`AuditLogService.logRunCompleted`) exists but is currently unused in production.
 
 ### Placement rules
 
@@ -83,6 +85,41 @@ Known gaps and remediation priorities: [TRANSACTION_AND_AUDIT_AUDIT.md](./TRANSA
 | `api_key_deleted` | API key revoked | api_key | key.id | key_prefix; `actor_id` from request context |
 | `api_key_regenerated` | API key rotated in place | api_key | key.id | key_prefix, generating_user_id; `actor_id` from request context |
 
+### Group and membership
+
+Recorded by `GroupService` (`resource_id` for membership actions is the request id; for member actions it is `{userId}:{groupId}`).
+
+| event_type | When | resource_type | resource_id | Payload / notes |
+|------------|------|---------------|-------------|-----------------|
+| `group_created` | Group created | group | group.id | name (+ metadata) |
+| `group_updated` | Group metadata updated | group | group.id | name (+ changed fields) |
+| `group_deleted` | Group deleted | group | group.id | group_name |
+| `membership_request_created` | User requests to join a group | group_membership_request | request.id | user_id, group_id |
+| `membership_request_cancelled` | Requester cancels their request | group_membership_request | request.id | reason |
+| `membership_request_approved` | Admin approves a request | group_membership_request | request.id | user_id, ... |
+| `membership_request_denied` | Admin denies a request | group_membership_request | request.id | user_id, reason |
+| `member_added` | User added to a group (direct or via approval) | user_group | `{userId}:{groupId}` | user_id (+ membership_request_id on approval) |
+| `member_removed` | User removed from a group | user_group | `{userId}:{groupId}` | removed_user_id |
+| `member_role_updated` | Member role changed | user_group | `{userId}:{groupId}` | user_id, new_role |
+| `user_left_group` | User leaves a group themselves | user_group | `{userId}:{groupId}` | — |
+
+### Reference data tables
+
+Recorded by `TablesService`. Row-level events use `resource_type: "table_row"`; all others use `resource_type: "table"`.
+
+| event_type | When | resource_type | resource_id |
+|------------|------|---------------|-------------|
+| `tables.created` / `tables.updated` / `tables.deleted` | Table create/update/delete | table | table.id |
+| `tables.column.added` / `tables.column.updated` / `tables.column.removed` | Column schema change | table | table.id |
+| `tables.lookup.added` / `tables.lookup.updated` / `tables.lookup.removed` | Lookup config change | table | table.id |
+| `tables.row.created` / `tables.row.updated` / `tables.row.deleted` | Row data change | table_row | row.id |
+
+### System
+
+| event_type | When | resource_type | resource_id | Payload / notes |
+|------------|------|---------------|-------------|-----------------|
+| `system_bootstrap` | First-run bootstrap creates the initial user + group | system | `bootstrap` | user_email, group_name; recorded inside the bootstrap transaction (`tx`) |
+
 ### HITL events
 
 | event_type                     | When | resource_type    | resource_id | Payload / notes        |
@@ -189,6 +226,7 @@ Known gaps and remediation priorities: [TRANSACTION_AND_AUDIT_AUDIT.md](./TRANSA
 |------------|------|---------------|-------------|-----------------|
 | `document_uploaded` | Document uploaded via upload API | document | document.id | title, file_type, status |
 | `document_updated` | Document title/metadata updated | document | document.id | fields_updated |
+| `document_deleted` | Document deleted via `DELETE /api/documents/:id` | document | document.id | title, status (+ context) |
 
 ### Document access
 
@@ -220,19 +258,23 @@ Known gaps and remediation priorities: [TRANSACTION_AND_AUDIT_AUDIT.md](./TRANSA
 
 ## Implementation
 
-- **Backend:** `AuditService` (in `apps/backend-services/src/audit/`) provides `recordEvent(events)`. When `request_id` or `actor_id` are omitted in the input, they are filled from the current request context (AsyncLocalStorage) when available; `group_id` must be passed by the caller. It is called from:
+- **Backend:** `AuditService` (in `apps/backend-services/src/audit/`) provides `recordEvent(events, tx?: Prisma.TransactionClient)`. When `request_id` or `actor_id` are omitted in the input, they are filled from the current request context (AsyncLocalStorage) when available; `group_id` must be passed by the caller. When a `tx` is passed the audit insert participates in that transaction (and a failure rolls back with it); without `tx` it is best-effort and non-fatal. It is called from:
   - **OcrService:** after starting a graph workflow and updating the document (document update + audit in one transaction).
+  - **GroupService:** after group create/update/delete, membership request create/cancel/approve/deny, and member add/remove/role-update/leave.
+  - **TablesService:** after table, column, lookup, and row mutations.
+  - **BootstrapService:** after first-run bootstrap creates the initial user + group (in the bootstrap transaction).
   - **WorkflowService:** after creating, updating, or appending workflow versions; after creating benchmark candidate lineages.
   - **BenchmarkDefinitionService:** after promoting or applying candidate workflows to the base lineage.
   - **ApiKeyService:** after creating, deleting, or regenerating group API keys.
   - **HitlService:** after creating a session, submitting corrections, approving, escalating, skipping, reopening a session, or deleting a correction.
   - **TrainingService / TrainingPollerService:** after starting/cancelling training jobs and activating/deleting trained models (poller activation is system-initiated, no actor).
   - **DatasetService:** after dataset/version/sample/split mutations and freezes.
   - **BenchmarkProjectService:** after creating or deleting a project.
+  - **BenchmarkRunService:** after cancelling or deleting a run (`benchmark_run_cancelled` / `benchmark_run_deleted`).
   - **ClassifierService / AzureController:** after classifier create/update/delete and training request.
   - **ConfusionProfileService:** after create/update/delete (including derive-and-save create path).
   - **UploadController:** after successful document upload (`document_uploaded`).
-  - **DocumentController:** after successfully sending the human approval signal to a workflow; after document update (`document_updated`); and after authorized delivery of document metadata, file bytes, or OCR to a user (see "Document access" above for the full list of controllers and endpoints).
+  - **DocumentController:** after successfully sending the human approval signal to a workflow; after document update (`document_updated`) and delete (`document_deleted`); and after authorized delivery of document metadata, file bytes, or OCR to a user (see "Document access" above for the full list of controllers and endpoints).
 - **Migration:** the `audit_events` table is created in the squashed init migration `apps/shared/prisma/migrations/20260328205045_init/`.
 - **Failure behavior:** If an audit insert fails, the service logs a warning and continues; the main operation is not failed.
 

docs-md/architecture/DATABASE_SERVICES.md

@@ -85,14 +85,14 @@ Types are defined in `document/document-db.types.ts`. Callers outside the module
 | `benchmark-run-db.service.ts` | `BenchmarkRunDbService` | Benchmark run creation, status updates, result storage |
 | `benchmark-definition-db.service.ts` | `BenchmarkDefinitionDbService` | Benchmark definition CRUD with dataset version, split, workflow joins |
 | `dataset-db.service.ts` | `DatasetDbService` | Dataset, `DatasetVersion`, and `Split` management including freeze/delete |
-| `audit-log-db.service.ts` | `AuditLogDbService` | `BenchmarkAuditLog` entries: create and paginated query |
+| `audit-log-db.service.ts` | `AuditLogDbService` | `BenchmarkAuditLog` entries: create (`createAuditLog(..., tx?)`) and paginated query (`findAllAuditLogs(..., tx?)`) |
 | `ground-truth-job-db.service.ts` | `GroundTruthJobDbService` | `DatasetGroundTruthJob` lifecycle: create, status updates, batch queries with document/review joins |
 
 Service wiring in the benchmark module:
 - `BenchmarkProjectService` → `BenchmarkProjectDbService`
-- `BenchmarkRunService` → `BenchmarkRunDbService` (audit via `AuditLogService`)
-- `BenchmarkDefinitionService` → `BenchmarkDefinitionDbService`
-- `DatasetService` → `DatasetDbService`, `AuditLogDbService`, `GroundTruthJobDbService`
+- `BenchmarkRunService` → `BenchmarkRunDbService` (`benchmark_audit_log` via `AuditLogService` for `run_started`/`baseline_promoted`; global `AuditService.recordEvent` for `benchmark_run_cancelled`/`benchmark_run_deleted`)
+- `BenchmarkDefinitionService` → `BenchmarkDefinitionDbService` (lifecycle audit via global `AuditService`)
+- `DatasetService` → `DatasetDbService`, `AuditLogDbService` (only `dataset_created` → `benchmark_audit_log`), `GroundTruthJobDbService`, global `AuditService` (most dataset/version/split mutations)
 - `AuditLogService` → `AuditLogDbService`
 - `GroundTruthGenerationService` → `GroundTruthJobDbService`, `ReviewDbService` (cross-module, injected directly)
 - `HitlDatasetService` → `ReviewDbService` (cross-module, injected directly)