diff --git a/docs/README.md b/docs/README.md index bd87bab64..d4a832748 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # Profile Tailors Documentation -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 ## 📖 Table of Contents diff --git a/docs/architecture/README.md b/docs/architecture/README.md index 293e1807a..06df22d2f 100644 --- a/docs/architecture/README.md +++ b/docs/architecture/README.md @@ -1,6 +1,6 @@ # Profile Tailors — Architecture Documentation -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 This directory contains the architecture documentation for Profile Tailors, a social media management platform. @@ -46,8 +46,8 @@ architecture at different levels of abstraction. ┌─────────────────────────────────────────────────────────────┐ │ Level 3: Component (API Application) │ │ ┌─────────────────────────────────────────────────────┐ │ -│ │ 19 Bounded Contexts: Identity, Authorization, │ │ -│ │ Tenancy, Credentials, Publishing, Governance, etc. │ │ +│ │ 18 Bounded Contexts + Config: Identity, │ │ +│ │ Authorization, Tenancy, Publishing, etc. │ │ │ └─────────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────────┘ ↓ @@ -72,9 +72,9 @@ architecture at different levels of abstraction. ### 2. Domain-Driven Design (DDD) -- **Bounded Contexts**: 19 modular bounded contexts in `server/smp` (Analytics, Audit, Authorization, - Config, Credentials, Governance, Hashtags, Ideas, Identity, Lead Capture, MCP, Media, - Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy) +- **Bounded Contexts**: 18 bounded contexts plus the Config module in `server/smp` (19 modules total): + Analytics, Audit, Authorization, Credentials, Governance, Hashtags, Ideas, Identity, Lead Capture, + MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy - **Shared Kernel**: Multiple module layers — see [full dependency graph](shared/dependencies.md) for all `api` and `implementation` relationships - **Foundation**: [`shared:common`](../../shared/common/) and [`shared:lead-capture:common`](../../shared/lead-capture/common/) — framework-agnostic domain @@ -183,4 +183,4 @@ architecture at different levels of abstraction. --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/adr-discovery/candidate-decisions.md b/docs/architecture/adr-discovery/candidate-decisions.md index 156b7ea28..bdf916e49 100644 --- a/docs/architecture/adr-discovery/candidate-decisions.md +++ b/docs/architecture/adr-discovery/candidate-decisions.md @@ -10,11 +10,13 @@ | CANDIDATE-006 | **Resource Creation via POST** | Implemented | High | Likely (REST convention) | Documentation drift (target PUT) | Create ADR | | CANDIDATE-007 | **Astro & Vue Frontend Split** | Implemented | High | Yes | Documentation drift (mentions React) | Create ADR | | CANDIDATE-008 | **Application-Level Multi-tenancy** | Implemented | High | Yes | None (RLS not used) | Create ADR | -| CANDIDATE-009 | **JWT + HttpOnly Cookie Auth** | Implemented | High | Yes | None | Create ADR | +| CANDIDATE-009 | **Bearer JWT + HttpOnly Refresh Cookie** | Implemented | High | Yes | None | Create ADR | | CANDIDATE-010 | **Shared Kernel Strategy** | Implemented | High | Yes | None | Create ADR | | CANDIDATE-011 | **Docker Swarm Deployment** | Implemented | High | Yes | C4 referenced Kubernetes/Cloud Run | Documented | | CANDIDATE-012 | **In-Process Reactor Event Bus** | Implemented | High | Yes | C4 referenced RabbitMQ/Kafka | Documented | -| CANDIDATE-013 | **17 Backend Bounded Contexts** | Implemented | High | Yes | C4 missing 11 contexts | Documented | +| CANDIDATE-013 | **18 Bounded Contexts + Config Module** | Implemented | High | Yes | C4 previously listed 17 or missing 11 | Documented | +| CANDIDATE-014 | **In-Monolith Task Scheduling** | Implemented | High | Yes | C4 referenced separate Scheduler Svc | Documented | +| CANDIDATE-015 | **Stateless Auth / Optional Redis** | Implemented | High | Yes | C4 referenced Redis session cache | Documented | ## Decision Groups diff --git a/docs/architecture/adr-discovery/documentation-drift.md b/docs/architecture/adr-discovery/documentation-drift.md index f87b3a990..b470bb94c 100644 --- a/docs/architecture/adr-discovery/documentation-drift.md +++ b/docs/architecture/adr-discovery/documentation-drift.md @@ -9,4 +9,6 @@ | `server/smp/src/test/.../ModularityVerificationTest.kt` | Modulith enforces boundaries | Test is disabled due to violation: `authorization -> audit :: application` | CANDIDATE-001 | Resolve violation or update ADR to acknowledge permitted exceptions. | | `docs/architecture/c4/02-container.md` | Container deployment via Kubernetes / Cloud Run | Production deployment via Docker Swarm | CANDIDATE-011 | ✅ Resolved (2026-08-14) — Updated deployment details to Docker Swarm. | | `docs/architecture/c4/02-container.md` | Async messaging via RabbitMQ / Kafka | Internal event publishing via Reactor Channels (`ReactorChannelEventPublisher`)| CANDIDATE-012 | ✅ Resolved (2026-08-14) — Updated messaging model to in-process channels. | -| `docs/architecture/c4/03-component.md` | Context list missing 11 bounded contexts | 17 contexts in `server/smp` (Hashtags, Ideas, Privacy, Media, MCP, etc.) | CANDIDATE-013 | ✅ Resolved (2026-08-14) — Documented all 17 bounded contexts. | +| `docs/architecture/c4/03-component.md` | Context list missing bounded contexts | 18 bounded contexts plus the Config module in `server/smp` (19 modules total) | CANDIDATE-013 | ✅ Resolved (2026-09-14) — Documented all 18 bounded contexts plus Config. | +| `docs/architecture/c4/02-container.md` | Scheduler Service / Analytics Service as separate | In-monolith scheduling (`PublishingWorker`) and analytics context | CANDIDATE-014 | ✅ Resolved (2026-09-14) — Clarified in-monolith context execution. | +| `docs/architecture/c4/02-container.md` | Redis for session data (TTL 15 min) | Access JWT is sent as a Bearer token; only the refresh token is in the HttpOnly cookie | CANDIDATE-015 | ✅ Resolved (2026-09-14) — Clarified stateless access-token validation and refresh-cookie storage. | diff --git a/docs/architecture/adr-discovery/documentation-synchronization-plan.md b/docs/architecture/adr-discovery/documentation-synchronization-plan.md index ffad96ecc..7edcd8773 100644 --- a/docs/architecture/adr-discovery/documentation-synchronization-plan.md +++ b/docs/architecture/adr-discovery/documentation-synchronization-plan.md @@ -12,8 +12,10 @@ the canonical architectural state. | `docs/architecture/c4/04-code.md` | Identifier Strategy | Update description to mention prefixed-UUIDs (`varchar(64)`). | ADR-0005 | ✅ Applied (2026-08-14) | | `docs/architecture/README.md` | Architecture Principles | Link to ADR-0001 (Modular Monolith) and ADR-0002 (Hexagonal). | ADR-0001, ADR-0002 | ✅ Applied (2026-08-14) | | `docs/architecture/c4/02-container.md` | Deployment & Messaging | Remove Kubernetes/Cloud Run & RabbitMQ/Kafka in favor of Swarm & Reactor channels. | CANDIDATE-011, CANDIDATE-012 | ✅ Applied (2026-08-14) | -| `docs/architecture/c4/03-component.md` | Bounded Contexts | Document all 19 bounded contexts in `server/smp/`. | CANDIDATE-013 | ✅ Applied (2026-08-14) | -| `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 10 registered Gradle modules under `shared/`. | ADR-0010 | ✅ Applied (2026-08-14) | +| `docs/architecture/c4/03-component.md` | Bounded Contexts | Document all 18 bounded contexts plus the Config module in `server/smp/` (19 modules total). | CANDIDATE-013 | ✅ Applied (2026-09-14) | +| `docs/architecture/c4/02-container.md` | In-Monolith Execution | Clarify task scheduling and analytics run inside monolith. | CANDIDATE-014 | ✅ Applied (2026-09-14) | +| `docs/architecture/c4/02-container.md` | Auth Caching Clarification| Specify Bearer access-token auth, an HttpOnly refresh-token cookie, and optional rate-limit caching. | CANDIDATE-015 | ✅ Applied (2026-09-14) | +| `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 11 registered Gradle modules under `shared/`. | ADR-0010 | ✅ Applied (2026-09-14) | | `.agents/AGENTS.md` | Backend Architecture | Explicitly mention the custom `@Service` marker rule. | ADR-0002 | ✅ Applied (2026-08-14) | ## Process diff --git a/docs/architecture/adr-discovery/evidence-ledger.md b/docs/architecture/adr-discovery/evidence-ledger.md index 234207cd5..3ad6f1988 100644 --- a/docs/architecture/adr-discovery/evidence-ledger.md +++ b/docs/architecture/adr-discovery/evidence-ledger.md @@ -73,13 +73,37 @@ Yes. --- -## Finding: 19 Backend Bounded Contexts +## Finding: 18 Backend Bounded Contexts plus Config -- **Claim**: Backend `server:smp` comprises 19 bounded contexts following hexagonal architecture. +- **Claim**: Backend `server:smp` comprises 18 bounded contexts following hexagonal architecture plus the cross-cutting Config module (19 modules total). - **Evidence**: - `server/smp/src/main/kotlin/com/profiletailors/smp/`: Directory structure containing `analytics`, `audit`, `authorization`, `config`, `credentials`, `governance`, `hashtags`, `ideas`, `identity`, `leadcapture`, `mcp`, `media`, `notifications`, `observability`, `platform`, `platformadmin`, `privacy`, `publishing`, `tenancy`. -- **Verification Result**: VERIFIED (count corrected from 17 to 19). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts. -- **Drift Action**: Updated C4 Component & Code documents to include all 19 contexts and corrected CANDIDATE-013 synchronization records. +- **Verification Result**: VERIFIED (count corrected from 17 to 18 bounded contexts plus Config). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts. +- **Drift Action**: Updated C4 Component & Code documents to include all 18 bounded contexts plus the Config module and corrected CANDIDATE-013 synchronization records. + +--- + +## Finding: Task Scheduling & Analytics Execution Model + +- **Claim**: Task scheduling and analytics execute in-process within the `server:smp` modular monolith, rather than via separate external Scheduler or Analytics container services. +- **Evidence**: + - `server/smp/src/main/kotlin/com/profiletailors/smp/publishing/infrastructure/scheduling/PublishingWorker.kt:912`: In-process publishing scheduling via Spring `TaskScheduler`. + - `server/smp/src/main/kotlin/com/profiletailors/smp/analytics/`: Analytics context module inside `server:smp`. +- **Verification Result**: VERIFIED. +- **Drift Action**: Updated C4 Container model to remove separate container claims for Scheduler Service and Analytics Service. + +--- + +## Finding: Stateless Access-Token Auth & Rate Limit Caching + +- **Claim**: The SPA keeps the short-lived JWT access token in memory and sends it in the `Authorization: Bearer` header. The refresh token alone is stored in an HttpOnly cookie. Caffeine/Redis caching is reserved for rate limiting in `shared:shield:ratelimit`, not central session storage. +- **Evidence**: + - `apps/web/app/src/modules/auth/infrastructure/auth.store.ts` and `auth-api.ts`: Keep the access token in memory and add it to the `Authorization: Bearer` header. + - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/http/LocalAuthController.kt`: Returns the access token in `AuthTokens` and stores only `result.refreshToken` in the HttpOnly cookie. + - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/security/JwtPrincipalAuthenticationConverter.kt`: Stateless access-token validation. + - `shared/shield/ratelimit/src/main/kotlin/com/profiletailors/shield/ratelimit/`: Bucket4j rate limiting with Caffeine/Redis store options. +- **Verification Result**: VERIFIED. +- **Drift Action**: Corrected the C4 Container caching section to distinguish Bearer access-token authentication, the HttpOnly refresh-token cookie, and optional rate-limit caching. ### Open questions @@ -403,7 +427,7 @@ Yes. --- -## Finding: Authentication Flow (JWT + HttpOnly Cookie) +## Finding: Authentication Flow (Bearer JWT + HttpOnly Refresh Cookie) ### Observed implementation @@ -412,9 +436,10 @@ cookie. Access token lives only in memory on the frontend. ### Evidence -- `LocalAuthHandlers.kt`: `issueAuthSession` creates tokens. -- `auth-api.ts`: `requestRaw` includes `credentials: 'include'`. -- `auth.ts` (Vue store): "Access token lives ONLY in memory". +- `LocalAuthHandlers.kt`: `issueAuthSession` creates the access and refresh tokens. +- `LocalAuthController.kt`: returns `AuthTokens` and stores only `result.refreshToken` in the HttpOnly cookie. +- `auth-api.ts`: `requestRaw` sends the in-memory access token in the `Authorization: Bearer` header and includes the refresh cookie via `credentials: 'include'`. +- `auth.store.ts` (Vue store): "Access token lives ONLY in memory". ### Documented intention diff --git a/docs/architecture/c4/01-system-context.md b/docs/architecture/c4/01-system-context.md index d93da775a..7725993de 100644 --- a/docs/architecture/c4/01-system-context.md +++ b/docs/architecture/c4/01-system-context.md @@ -1,6 +1,6 @@ # Level 1: System Context Diagram -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 ## Overview @@ -190,4 +190,4 @@ Profile Tailors enables teams to: - Team collaboration enhancements - Media asset management improvements -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/c4/02-container.md b/docs/architecture/c4/02-container.md index f92726bc1..fa94fdc52 100644 --- a/docs/architecture/c4/02-container.md +++ b/docs/architecture/c4/02-container.md @@ -1,6 +1,6 @@ # Level 2: Container Diagram -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 ## Overview @@ -30,7 +30,7 @@ System_Boundary(profile_tailors, "Profile Tailors") { Container(spa, "Web Application", "Vue 3, TypeScript", "Single-page application for content management, scheduling, and analytics") - Container(api, "API Application", "Spring Boot 4, Kotlin, WebFlux", "Reactive REST API with 19 bounded contexts including Identity, Tenancy, Publishing, Media, Privacy, etc.") + Container(api, "API Application", "Spring Boot 4, Kotlin, WebFlux", "Reactive REST API with 18 bounded contexts plus the Config module (19 modules total), including Identity, Tenancy, Publishing, Media, and Privacy.") ContainerDb(db, "Database", "PostgreSQL 18", "Stores user data, workspaces, posts, schedules, credentials, and audit logs. R2DBC for reactive access.") @@ -131,10 +131,11 @@ graph TB - **Composition**: Shared modules (`shared:common`, `shared:bus`, `shared:spring-boot-common`, `shared:security`, `shared:presentation`, `shared:storage`, `shared:shield:ratelimit`, `shared:lead-capture:*`) and `server:smp` (application assembly). -- **Bounded Contexts**: Analytics, Audit, Authorization, Config, Credentials, Governance, Hashtags, +- **Bounded Contexts**: Analytics, Audit, Authorization, Credentials, Governance, Hashtags, Ideas, Identity, Leadcapture, MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy. -- **Key Features**: Reactive programming with Kotlin coroutines, native JWT/cookie authentication, +- **Cross-Cutting Module**: Config. +- **Key Features**: Reactive programming with Kotlin coroutines, Bearer JWT access-token authentication with an HttpOnly refresh-token cookie, non-blocking R2DBC access, internal in-process event publishing via Reactor (`ChannelEventPublisher`), Spring Modulith modular monolith. @@ -153,8 +154,8 @@ graph TB - **Technology**: Caffeine local in-memory cache, optional Redis via `shared:shield:ratelimit` - **Deployment**: Embedded JVM in-memory / optional container -- **Purpose**: Rate limiting (Bucket4j) and ephemeral caching. -- **Use Cases**: Rate limiting for public and waitlist endpoints (defaults to Caffeine). Session management relies on stateless signed JWT cookies rather than central session cache storage. +- **Purpose**: Rate-limit state storage for Bucket4j. +- **Use Cases**: Rate limiting for public and waitlist endpoints (defaults to Caffeine). The JWT access token is validated statelessly from the `Authorization: Bearer` header, while only the refresh token is stored in an HttpOnly cookie. #### Event Bus (In-Process Event Dispatch) @@ -288,9 +289,8 @@ graph TB ### Horizontal Scaling -- API Application: Stateless, can scale horizontally -- Scheduler Service: Partitioned by workspace or time slot -- Analytics Service: Partitioned by platform or metric type +- API Application: Stateless, can scale horizontally; in-process workers (`PublishingWorker`) handle scheduled tasks within the modular monolith +- Analytics Context: In-monolith analytics processing and metric aggregation ### Database Scaling @@ -300,9 +300,8 @@ graph TB ### Caching Strategy -- Redis for session data (TTL: 15 min) -- API response cache (TTL: 1-5 min) -- OAuth token cache (TTL: token expiry - 5 min) +- Local Caffeine or optional Redis store for Bucket4j rate limiting (`shared:shield:ratelimit`) +- The SPA keeps the short-lived JWT access token in memory and sends it in the `Authorization: Bearer` header; only the refresh token is stored in an HttpOnly cookie --- @@ -326,4 +325,4 @@ graph TB --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/c4/03-component.md b/docs/architecture/c4/03-component.md index 50d587f7c..1b074c414 100644 --- a/docs/architecture/c4/03-component.md +++ b/docs/architecture/c4/03-component.md @@ -1,6 +1,6 @@ # Level 3: Component Diagram -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 ## Overview @@ -867,12 +867,12 @@ framework features, it belongs in `shared/spring-boot-common` instead. ## Current Implementation Status -**Implemented Contexts** (19 total): +**Implemented Modules** (18 bounded contexts plus Config; 19 total): - ✅ Analytics Context (engagement metrics & reporting) - ✅ Audit Context (request outcomes, authorization decisions, mutations) - ✅ Authorization Context (RBAC, direct grants, workspace permissions) -- ✅ Config Context (system & application configuration) +- ✅ Config Module (system & application configuration) - ✅ Credentials Context (API keys, token validation, secret management) - ✅ Governance Context (audit logging, mutation tracking, compliance) - ✅ Hashtags Context (hashtag group management & tracking) @@ -891,4 +891,4 @@ framework features, it belongs in `shared/spring-boot-common` instead. --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/c4/04-code.md b/docs/architecture/c4/04-code.md index b691de155..6486e4810 100644 --- a/docs/architecture/c4/04-code.md +++ b/docs/architecture/c4/04-code.md @@ -1,6 +1,6 @@ # Level 4: Code Diagram -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 ## Overview @@ -130,12 +130,12 @@ com.profiletailors.smp ## Current Implementation Status -**Implemented Bounded Contexts** (19 total): +**Implemented Modules** (18 bounded contexts plus Config; 19 total): - ✅ Analytics Context (engagement metrics & reporting) - ✅ Audit Context (request outcomes, authorization decisions, mutations) - ✅ Authorization Context (permission checking, RBAC, direct grants) -- ✅ Config Context (application & system configuration) +- ✅ Config Module (application & system configuration) - ✅ Credentials Context (API key validation, secret management) - ✅ Governance Context (audit logging, compliance) - ✅ Hashtags Context (hashtag group management & tracking) @@ -164,4 +164,4 @@ com.profiletailors.smp --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/c4/README.md b/docs/architecture/c4/README.md index 098df3d47..9dd4aa092 100644 --- a/docs/architecture/c4/README.md +++ b/docs/architecture/c4/README.md @@ -1,6 +1,6 @@ # Profile Tailors — C4 Architecture Models -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 This directory contains the C4 architecture models for Profile Tailors, a social media management platform. @@ -51,8 +51,10 @@ Diagrams are written in: - Marketing site (Astro 7, bilingual static site) - Web Application Dashboard (Vue 3, Pinia, TypeScript) - Backend Modular Monolith (Spring Boot 4, Kotlin, WebFlux, R2DBC) -- 19 Bounded Contexts: Analytics, Audit, Authorization, Config, Credentials, Governance, Hashtags, Ideas, Identity, Leadcapture, MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy +- 18 bounded contexts plus the Config module (19 modules total): Analytics, Audit, Authorization, + Credentials, Governance, Hashtags, Ideas, Identity, Leadcapture, MCP, Media, Notifications, + Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy; plus Config --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/c4/SUMMARY.md b/docs/architecture/c4/SUMMARY.md index 6116680ae..2629a31dc 100644 --- a/docs/architecture/c4/SUMMARY.md +++ b/docs/architecture/c4/SUMMARY.md @@ -5,7 +5,7 @@ status: 🔄 In Progress # Profile Tailors — C4 Architecture Summary -**Last updated: 2026-09-12 +**Last updated:** 2026-09-15 ## Executive Summary @@ -66,19 +66,19 @@ framework-agnostic domain primitives and shared infrastructure: --- -## Bounded Contexts (19 Bounded Contexts) +## Backend Modules (18 Bounded Contexts + Config) -The backend `server:smp` comprises 19 modular bounded contexts: +The backend `server:smp` comprises 18 bounded contexts plus the cross-cutting Config module (19 modules total): 1. **Analytics Context**: Engagement metrics collection, aggregation, and reporting. 2. **Audit Context**: Request outcomes, authorization decision auditing, and mutation event capture. 3. **Authorization Context**: RBAC, direct permission grants, workspace permissions, and entitlements. -4. **Config Context**: Dynamic platform and system configuration. +4. **Config Module**: Dynamic platform and system configuration. 5. **Credentials Context**: API keys, OAuth tokens, and credential encryption (`PublishingCredentialsProperties`). 6. **Governance Context**: Mutation audit logging, policy enforcement, and compliance tracking. 7. **Hashtags Context**: Hashtag group management, aggregation, and performance tracking. 8. **Ideas Context**: Content brainstorming and draft idea management. -9. **Identity Context**: Native JWT and HttpOnly cookie authentication, principal management. +9. **Identity Context**: Bearer JWT access-token and HttpOnly refresh-cookie authentication, principal management. 10. **Lead Capture Context**: Public waitlist joins, lead capture storage, and consent collection. 11. **MCP Context**: Model Context Protocol integration for platform AI tooling. 12. **Media Context**: Media asset storage, Content-Addressable Storage (CAS) deduplication. @@ -279,4 +279,4 @@ Managed & Local Storage --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/iam-platform.md b/docs/architecture/iam-platform.md index 1db1e6a30..fb0a6dc0a 100644 --- a/docs/architecture/iam-platform.md +++ b/docs/architecture/iam-platform.md @@ -1,6 +1,6 @@ # IAM Platform Architecture -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 ## Overview @@ -322,4 +322,4 @@ These capabilities are part of the durable platform model but explicitly deferre --- -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/login-flow.md b/docs/architecture/login-flow.md index 57077b544..466987ee2 100644 --- a/docs/architecture/login-flow.md +++ b/docs/architecture/login-flow.md @@ -1,6 +1,6 @@ # Login Flow Architecture & Sequence Diagrams -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 - **Status**: Active / Implemented - **Bounded Contexts**: `com.profiletailors.smp.identity`, `com.profiletailors.smp.credentials` @@ -212,4 +212,4 @@ graph TD - **Stateless Verification**: API requests evaluate JWT access tokens statelessly without DB roundtrips on protected endpoints. - **Session Rotation**: Every refresh invocation revokes the prior refresh token and issues a new one, mitigating token replay attacks. -Last updated: 2026-09-12 +Last updated: 2026-09-14 diff --git a/docs/architecture/media-library-cas-dedup.md b/docs/architecture/media-library-cas-dedup.md index 54defcaf4..9aa59daaa 100644 --- a/docs/architecture/media-library-cas-dedup.md +++ b/docs/architecture/media-library-cas-dedup.md @@ -1,7 +1,7 @@ # Media Library — Content-Addressed Storage (CAS) Deduplication > **Status:** Implemented internal storage architecture -> ****Last Updated:** 2026-09-12 +> **Last Updated:** 2026-09-15 ## Overview diff --git a/docs/architecture/shared/dependencies.md b/docs/architecture/shared/dependencies.md index 866dfb598..9f55194c5 100644 --- a/docs/architecture/shared/dependencies.md +++ b/docs/architecture/shared/dependencies.md @@ -1,9 +1,9 @@ # Shared Module Dependencies -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 > Quick-reference dependency graph for the `shared/` Gradle modules in the Profile Tailors monorepo. -> Last updated: 2026-09-12 +> Last updated: 2026-09-14 ## Overview diff --git a/docs/compliance/agpl-source-offer.md b/docs/compliance/agpl-source-offer.md index c4909714b..d88947213 100644 --- a/docs/compliance/agpl-source-offer.md +++ b/docs/compliance/agpl-source-offer.md @@ -1,10 +1,10 @@ # AGPL-3.0 Source-Offer Runbook -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 > **Classification:** Internal — Legal and Compliance > **Status:** Active -> **Last updated: 2026-09-12 +> **Last updated:** 2026-09-14 ## Overview diff --git a/docs/compliance/contributor-copyright-map.md b/docs/compliance/contributor-copyright-map.md index d352c3756..f310973bd 100644 --- a/docs/compliance/contributor-copyright-map.md +++ b/docs/compliance/contributor-copyright-map.md @@ -1,10 +1,10 @@ # Contributor and Copyright Map -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 > **Classification:** Internal — Legal and Compliance > **Status:** Active -> **Last updated: 2026-09-12 +> **Last updated:** 2026-09-14 ## Overview diff --git a/docs/compliance/underage-account-procedure.md b/docs/compliance/underage-account-procedure.md index 3025e9fb1..dc8108845 100644 --- a/docs/compliance/underage-account-procedure.md +++ b/docs/compliance/underage-account-procedure.md @@ -2,7 +2,7 @@ > **Document ID:** COMP-007 > **Version:** v1.0.0 -> ****Last Updated:** 2026-09-12 +> **Last Updated:** 2026-09-15 > **Owner:** Legal & Compliance Team > **Review Cadence:** Annual diff --git a/docs/getting-started.md b/docs/getting-started.md index 3edd215c9..67847b40f 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -1,6 +1,6 @@ # Getting Started — Local Development Environment -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** Active ## Overview diff --git a/docs/gradle-build-system.md b/docs/gradle-build-system.md index 9c583a185..9c5ccaae4 100644 --- a/docs/gradle-build-system.md +++ b/docs/gradle-build-system.md @@ -1,6 +1,6 @@ # Gradle Build System & Conventions -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** ✅ Implemented --- diff --git a/docs/observability-contracts.md b/docs/observability-contracts.md index 1d801b8e4..de7cbb2e7 100644 --- a/docs/observability-contracts.md +++ b/docs/observability-contracts.md @@ -1,6 +1,6 @@ # Observability Contracts & SLA Matrix -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** Active **Scope:** System-wide Service Level Agreements (SLAs), Service Level Objectives (SLOs), Service Level Indicators (SLIs), and Observability Standards **Audience:** Platform Engineers, Backend Engineers, Operations, SRE diff --git a/docs/observability-usage.md b/docs/observability-usage.md index 1dac1351a..53ca52d26 100644 --- a/docs/observability-usage.md +++ b/docs/observability-usage.md @@ -1,6 +1,6 @@ # Shared Observability Usage Standard -****Last Updated:** 2026-09-14 +**Last Updated:** 2026-09-15 **Status:** Active documentation standard **Scope:** Kotlin shared modules and the SMP backend **Audience:** Backend engineers, platform engineers, operations, SRE, and reviewers diff --git a/docs/production-secrets.md b/docs/production-secrets.md index 5b83f9653..b1b343fd5 100644 --- a/docs/production-secrets.md +++ b/docs/production-secrets.md @@ -1,6 +1,6 @@ # Production Secrets Reference -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** Active ## Overview diff --git a/docs/publishing-failure-modes.md b/docs/publishing-failure-modes.md index d53ad5a56..b61706497 100644 --- a/docs/publishing-failure-modes.md +++ b/docs/publishing-failure-modes.md @@ -1,6 +1,6 @@ # Publishing Failure Modes -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** Active ## Overview diff --git a/docs/release-verification.md b/docs/release-verification.md index 32f7de974..e37b618eb 100644 --- a/docs/release-verification.md +++ b/docs/release-verification.md @@ -1,6 +1,6 @@ # Release Verification -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** Active ## Overview diff --git a/docs/retention-framework-operations.md b/docs/retention-framework-operations.md index da159809b..376e5b4b4 100644 --- a/docs/retention-framework-operations.md +++ b/docs/retention-framework-operations.md @@ -1,10 +1,10 @@ # Data Retention Operations Guide (Current State) -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 > **Classification:** Internal — Operations and Compliance > **Status:** Current-state operations guide — the retention governance API is planned, not implemented -> **Last updated: 2026-09-12 +> **Last updated:** 2026-09-14 > > **IMPORTANT:** Earlier drafts of this guide described a retention rule/purge/hold HTTP API > (`/api/governance/retention/*`) and a `V100__retention_governance.xml` migration. Neither diff --git a/docs/retention-framework-quick-reference.md b/docs/retention-framework-quick-reference.md index 32ace2e4a..2704cee53 100644 --- a/docs/retention-framework-quick-reference.md +++ b/docs/retention-framework-quick-reference.md @@ -1,6 +1,6 @@ # Data Retention — Quick Reference (Current State) -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 > **For:** On-call operators, compliance officers > **Updated:** 2026-08-02 @@ -55,6 +55,6 @@ --- -**Last updated: 2026-09-12 +**Last updated:** 2026-09-14 **Version:** 2.0 (corrected — v1.0 described a not-yet-implemented framework) **For questions:** [retention-and-erasure-control-plan.md](compliance/retention-and-erasure-control-plan.md) diff --git a/docs/runbooks/production-rollback.md b/docs/runbooks/production-rollback.md index a74780f3a..cee3a634e 100644 --- a/docs/runbooks/production-rollback.md +++ b/docs/runbooks/production-rollback.md @@ -1,6 +1,6 @@ # Production Rollback Runbook -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** Active **Scope:** Production Docker Swarm, Docker Compose, Database, and Worker Rollback **Audience:** Release Manager, On-Call Operator, SRE diff --git a/docs/technical-debt-remediation.md b/docs/technical-debt-remediation.md index 4e2ca40b2..f0af8b1bd 100644 --- a/docs/technical-debt-remediation.md +++ b/docs/technical-debt-remediation.md @@ -1,6 +1,6 @@ # Technical Debt Remediation and Java 25 -****Last Updated:** 2026-09-12 +**Last Updated:** 2026-09-15 **Status:** In progress; not a completion report ## Overview