E09: SDPR HITL inline editor + timing-experiment harness (stacked on E08 / #165)

.gitignore

@@ -3,6 +3,10 @@ node_modules
 .env
 dist
 
+# Python bytecode caches
+__pycache__/
+*.pyc
+
 # SpecStory
 .specstory/
 /.claude/settings.loca.json
@@ -34,6 +38,21 @@ infra/*.tfstate
 infra/*.tfstate.backup
 infra/.terraform.lock.hcl
 
+# Local benchmark dataset drops — private subset never committed.
+# See docs/superpowers/specs/2026-05-08-extraction-experiments-design.md
+data/datasets/*/private/**
+!data/datasets/*/private/.gitkeep
+!data/datasets/.gitkeep
+
+# SDPR-report working files — drafts, regenerated plots, and HITL curves used
+# during analysis. Lived on a network share; kept locally only as a scratch
+# space. Don't commit them — they contain analysis outputs derived from
+# private benchmark data.
+/SDPR_OCR_Performance_Report*.md
+/SDPR_OCR_Performance_Report*.pdf
+/plots/
+/hitl/
+
 # Generated repo wiki HTML (built by docs/build.sh at docs deploy time)
 /docs/wiki.html
 /docs/wiki-*.html

apps/backend-services/src/azure/azure-openai.controller.spec.ts

@@ -0,0 +1,71 @@
+import type { ConfigService } from "@nestjs/config";
+import { AzureOpenAiController } from "./azure-openai.controller";
+
+describe("AzureOpenAiController", () => {
+  function makeController(
+    env: Record<string, string | undefined>,
+  ): AzureOpenAiController {
+    const configService = {
+      get: <T>(key: string): T | undefined => env[key] as T | undefined,
+    } as unknown as ConfigService;
+    return new AzureOpenAiController(configService);
+  }
+
+  describe("getDeployments", () => {
+    it("parses AZURE_OPENAI_DEPLOYMENTS as comma-separated list", async () => {
+      const controller = makeController({
+        AZURE_OPENAI_DEPLOYMENTS: "gpt-4o,gpt-5",
+      });
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual(["gpt-4o", "gpt-5"]);
+    });
+
+    it("trims whitespace and drops empty entries", async () => {
+      const controller = makeController({
+        AZURE_OPENAI_DEPLOYMENTS: " gpt-4o , , gpt-5 , ",
+      });
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual(["gpt-4o", "gpt-5"]);
+    });
+
+    it("falls back to AZURE_OPENAI_DEPLOYMENT when DEPLOYMENTS is unset", async () => {
+      const controller = makeController({
+        AZURE_OPENAI_DEPLOYMENT: "gpt-4o",
+      });
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual(["gpt-4o"]);
+    });
+
+    it("falls back to AZURE_OPENAI_DEPLOYMENT when DEPLOYMENTS is empty string", async () => {
+      const controller = makeController({
+        AZURE_OPENAI_DEPLOYMENTS: "",
+        AZURE_OPENAI_DEPLOYMENT: "gpt-4o",
+      });
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual(["gpt-4o"]);
+    });
+
+    it("returns empty array when neither var is set", async () => {
+      const controller = makeController({});
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual([]);
+    });
+
+    it("returns empty array when both vars are empty strings", async () => {
+      const controller = makeController({
+        AZURE_OPENAI_DEPLOYMENTS: "",
+        AZURE_OPENAI_DEPLOYMENT: "",
+      });
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual([]);
+    });
+
+    it("preserves deployment order from the env var", async () => {
+      const controller = makeController({
+        AZURE_OPENAI_DEPLOYMENTS: "gpt-5,gpt-4o,gpt-4o-mini",
+      });
+      const result = await controller.getDeployments();
+      expect(result.deployments).toEqual(["gpt-5", "gpt-4o", "gpt-4o-mini"]);
+    });
+  });
+});

apps/backend-services/src/azure/azure-openai.controller.ts

@@ -0,0 +1,50 @@
+import { Controller, Get } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import {
+  ApiOkResponse,
+  ApiOperation,
+  ApiTags,
+  ApiUnauthorizedResponse,
+} from "@nestjs/swagger";
+import { Identity } from "@/auth/identity.decorator";
+import { AzureOpenAiDeploymentsResponseDto } from "@/azure/dto/azure-openai-deployments-response.dto";
+
+/**
+ * Lists Azure OpenAI deployments the workflow editor / activity nodes may select.
+ *
+ * Allow-list is sourced from AZURE_OPENAI_DEPLOYMENTS (comma-separated). When unset
+ * the controller falls back to the single deployment name in AZURE_OPENAI_DEPLOYMENT
+ * for backward compatibility, or an empty array if neither is set.
+ */
+@ApiTags("Azure OpenAI")
+@Controller("api/azure-openai")
+export class AzureOpenAiController {
+  constructor(private readonly configService: ConfigService) {}
+
+  @Get("deployments")
+  @Identity({ allowApiKey: true })
+  @ApiOperation({
+    summary:
+      "List Azure OpenAI deployments allowed for workflow node selection",
+  })
+  @ApiOkResponse({
+    description: "Allowed deployment names",
+    type: AzureOpenAiDeploymentsResponseDto,
+  })
+  @ApiUnauthorizedResponse({ description: "Caller is not authenticated." })
+  async getDeployments(): Promise<AzureOpenAiDeploymentsResponseDto> {
+    const list = this.configService.get<string>("AZURE_OPENAI_DEPLOYMENTS");
+    if (list && list.trim() !== "") {
+      const deployments = list
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+      return { deployments };
+    }
+
+    const fallback = this.configService.get<string>("AZURE_OPENAI_DEPLOYMENT");
+    return {
+      deployments: fallback && fallback.trim() !== "" ? [fallback.trim()] : [],
+    };
+  }
+}

apps/backend-services/src/azure/azure.module.ts

@@ -1,6 +1,7 @@
 import { Module } from "@nestjs/common";
 import { AzureController } from "@/azure/azure.controller";
 import { AzureService } from "@/azure/azure.service";
+import { AzureOpenAiController } from "@/azure/azure-openai.controller";
 import { ClassifierService } from "@/azure/classifier.service";
 import { ClassifierDbService } from "@/azure/classifier-db.service";
 import { ClassifierOrphanCleanupService } from "@/azure/classifier-orphan-cleanup.service";
@@ -17,6 +18,6 @@ import { BlobStorageModule } from "@/blob-storage/blob-storage.module";
   ],
   exports: [AzureService],
   imports: [BlobStorageModule],
-  controllers: [AzureController],
+  controllers: [AzureController, AzureOpenAiController],
 })
 export class AzureModule {}

apps/backend-services/src/azure/dto/azure-openai-deployments-response.dto.ts

@@ -0,0 +1,11 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class AzureOpenAiDeploymentsResponseDto {
+  @ApiProperty({
+    description:
+      "Azure OpenAI deployment names allowed for selection on workflow nodes (e.g. for the enrichResults activity's azureOpenAiDeployment parameter). Parsed from the AZURE_OPENAI_DEPLOYMENTS env var (comma-separated). The first entry is treated as the default if a workflow node doesn't specify one.",
+    example: ["gpt-4o", "gpt-5"],
+    type: [String],
+  })
+  deployments!: string[];
+}

apps/backend-services/src/benchmark/benchmark.module.ts

@@ -6,6 +6,7 @@ import { DatabaseModule } from "@/database/database.module";
 import { DocumentModule } from "@/document/document.module";
 import { HitlModule } from "@/hitl/hitl.module";
 import { OcrModule } from "@/ocr/ocr.module";
+import { LocalDatasetSyncService } from "@/seed/local-dataset-sync.service";
 import { TemporalModule } from "@/temporal/temporal.module";
 import { WorkflowModule } from "@/workflow/workflow.module";
 import { AiRecommendationService } from "./ai-recommendation.service";
@@ -72,6 +73,7 @@ import { OcrImprovementPipelineService } from "./ocr-improvement-pipeline.servic
     AiRecommendationService,
     OcrImprovementPipelineService,
     BenchmarkErrorDetectionService,
+    LocalDatasetSyncService,
   ],
   exports: [
     DatasetService,