docs(architecture): synchronize C4 models and ADR discovery ledger with 100% codebase evidence

docs/README.md

@@ -1,6 +1,6 @@
 # Profile Tailors Documentation
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-15
 
 ## 📖 Table of Contents
 

docs/architecture/README.md

@@ -1,6 +1,6 @@
 # Profile Tailors — Architecture Documentation
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-15
 
 This directory contains the architecture documentation for Profile Tailors, a social media
 management platform.
@@ -46,8 +46,8 @@ architecture at different levels of abstraction.
 ┌─────────────────────────────────────────────────────────────┐
 │ Level 3: Component (API Application)                        │
 │ ┌─────────────────────────────────────────────────────┐   │
-│ │  19 Bounded Contexts: Identity, Authorization,      │   │
-│ │  Tenancy, Credentials, Publishing, Governance, etc. │   │
+│ │  18 Bounded Contexts + Config: Identity,            │   │
+│ │  Authorization, Tenancy, Publishing, etc.           │   │
 │ └─────────────────────────────────────────────────────┘   │
 └─────────────────────────────────────────────────────────────┘
                         ↓
@@ -72,9 +72,9 @@ architecture at different levels of abstraction.
 
 ### 2. Domain-Driven Design (DDD)
 
-- **Bounded Contexts**: 19 modular bounded contexts in `server/smp` (Analytics, Audit, Authorization,
-  Config, Credentials, Governance, Hashtags, Ideas, Identity, Lead Capture, MCP, Media,
-  Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy)
+- **Bounded Contexts**: 18 bounded contexts plus the Config module in `server/smp` (19 modules total):
+  Analytics, Audit, Authorization, Credentials, Governance, Hashtags, Ideas, Identity, Lead Capture,
+  MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy, Publishing, Tenancy
 - **Shared Kernel**: Multiple module layers — see [full dependency graph](shared/dependencies.md)
   for all `api` and `implementation` relationships
 - **Foundation**: [`shared:common`](../../shared/common/) and [`shared:lead-capture:common`](../../shared/lead-capture/common/) — framework-agnostic domain
@@ -183,4 +183,4 @@ architecture at different levels of abstraction.
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14

docs/architecture/adr-discovery/candidate-decisions.md

@@ -10,11 +10,13 @@
 | CANDIDATE-006 | **Resource Creation via POST**      | Implemented   | High              | Likely (REST convention) | Documentation drift (target PUT)      | Create ADR      |
 | CANDIDATE-007 | **Astro & Vue Frontend Split**      | Implemented   | High              | Yes                      | Documentation drift (mentions React)  | Create ADR      |
 | CANDIDATE-008 | **Application-Level Multi-tenancy** | Implemented   | High              | Yes                      | None (RLS not used)                   | Create ADR      |
-| CANDIDATE-009 | **JWT + HttpOnly Cookie Auth**      | Implemented   | High              | Yes                      | None                                  | Create ADR      |
+| CANDIDATE-009 | **Bearer JWT + HttpOnly Refresh Cookie** | Implemented   | High              | Yes                      | None                                  | Create ADR      |
 | CANDIDATE-010 | **Shared Kernel Strategy**          | Implemented   | High              | Yes                      | None                                  | Create ADR      |
 | CANDIDATE-011 | **Docker Swarm Deployment**         | Implemented   | High              | Yes                      | C4 referenced Kubernetes/Cloud Run    | Documented      |
 | CANDIDATE-012 | **In-Process Reactor Event Bus**    | Implemented   | High              | Yes                      | C4 referenced RabbitMQ/Kafka          | Documented      |
-| CANDIDATE-013 | **17 Backend Bounded Contexts**     | Implemented   | High              | Yes                      | C4 missing 11 contexts                | Documented      |
+| CANDIDATE-013 | **18 Bounded Contexts + Config Module** | Implemented   | High              | Yes                      | C4 previously listed 17 or missing 11 | Documented      |
+| CANDIDATE-014 | **In-Monolith Task Scheduling**     | Implemented   | High              | Yes                      | C4 referenced separate Scheduler Svc  | Documented      |
+| CANDIDATE-015 | **Stateless Auth / Optional Redis** | Implemented   | High              | Yes                      | C4 referenced Redis session cache     | Documented      |
 
 ## Decision Groups
 

docs/architecture/adr-discovery/documentation-drift.md

@@ -9,4 +9,6 @@
 | `server/smp/src/test/.../ModularityVerificationTest.kt` | Modulith enforces boundaries                       | Test is disabled due to violation: `authorization -> audit :: application` | CANDIDATE-001     | Resolve violation or update ADR to acknowledge permitted exceptions.           |
 | `docs/architecture/c4/02-container.md`                  | Container deployment via Kubernetes / Cloud Run    | Production deployment via Docker Swarm                                     | CANDIDATE-011     | ✅ Resolved (2026-08-14) — Updated deployment details to Docker Swarm.         |
 | `docs/architecture/c4/02-container.md`                  | Async messaging via RabbitMQ / Kafka               | Internal event publishing via Reactor Channels (`ReactorChannelEventPublisher`)| CANDIDATE-012 | ✅ Resolved (2026-08-14) — Updated messaging model to in-process channels.     |
-| `docs/architecture/c4/03-component.md`                  | Context list missing 11 bounded contexts           | 17 contexts in `server/smp` (Hashtags, Ideas, Privacy, Media, MCP, etc.)    | CANDIDATE-013     | ✅ Resolved (2026-08-14) — Documented all 17 bounded contexts.                 |
+| `docs/architecture/c4/03-component.md`                  | Context list missing bounded contexts              | 18 bounded contexts plus the Config module in `server/smp` (19 modules total) | CANDIDATE-013   | ✅ Resolved (2026-09-14) — Documented all 18 bounded contexts plus Config.     |
+| `docs/architecture/c4/02-container.md`                  | Scheduler Service / Analytics Service as separate  | In-monolith scheduling (`PublishingWorker`) and analytics context           | CANDIDATE-014     | ✅ Resolved (2026-09-14) — Clarified in-monolith context execution.            |
+| `docs/architecture/c4/02-container.md`                  | Redis for session data (TTL 15 min)                | Access JWT is sent as a Bearer token; only the refresh token is in the HttpOnly cookie | CANDIDATE-015 | ✅ Resolved (2026-09-14) — Clarified stateless access-token validation and refresh-cookie storage. |

docs/architecture/adr-discovery/documentation-synchronization-plan.md

@@ -12,8 +12,10 @@ the canonical architectural state.
 | `docs/architecture/c4/04-code.md`      | Identifier Strategy     | Update description to mention prefixed-UUIDs (`varchar(64)`).  | ADR-0005           | ✅ Applied (2026-08-14) |
 | `docs/architecture/README.md`          | Architecture Principles | Link to ADR-0001 (Modular Monolith) and ADR-0002 (Hexagonal).  | ADR-0001, ADR-0002 | ✅ Applied (2026-08-14) |
 | `docs/architecture/c4/02-container.md` | Deployment & Messaging  | Remove Kubernetes/Cloud Run & RabbitMQ/Kafka in favor of Swarm & Reactor channels. | CANDIDATE-011, CANDIDATE-012 | ✅ Applied (2026-08-14) |
-| `docs/architecture/c4/03-component.md` | Bounded Contexts        | Document all 19 bounded contexts in `server/smp/`.             | CANDIDATE-013      | ✅ Applied (2026-08-14) |
-| `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 10 registered Gradle modules under `shared/`.     | ADR-0010           | ✅ Applied (2026-08-14) |
+| `docs/architecture/c4/03-component.md` | Bounded Contexts        | Document all 18 bounded contexts plus the Config module in `server/smp/` (19 modules total). | CANDIDATE-013 | ✅ Applied (2026-09-14) |
+| `docs/architecture/c4/02-container.md` | In-Monolith Execution   | Clarify task scheduling and analytics run inside monolith.    | CANDIDATE-014      | ✅ Applied (2026-09-14) |
+| `docs/architecture/c4/02-container.md` | Auth Caching Clarification| Specify Bearer access-token auth, an HttpOnly refresh-token cookie, and optional rate-limit caching. | CANDIDATE-015 | ✅ Applied (2026-09-14) |
+| `docs/architecture/shared/dependencies.md`| Shared Kernel Modules| Document all 11 registered Gradle modules under `shared/`.     | ADR-0010           | ✅ Applied (2026-09-14) |
 | `.agents/AGENTS.md`                    | Backend Architecture    | Explicitly mention the custom `@Service` marker rule.          | ADR-0002           | ✅ Applied (2026-08-14) |
 
 ## Process

docs/architecture/adr-discovery/evidence-ledger.md

@@ -73,13 +73,37 @@ Yes.
 
 ---
 
-## Finding: 19 Backend Bounded Contexts
+## Finding: 18 Backend Bounded Contexts plus Config
 
-- **Claim**: Backend `server:smp` comprises 19 bounded contexts following hexagonal architecture.
+- **Claim**: Backend `server:smp` comprises 18 bounded contexts following hexagonal architecture plus the cross-cutting Config module (19 modules total).
 - **Evidence**:
   - `server/smp/src/main/kotlin/com/profiletailors/smp/`: Directory structure containing `analytics`, `audit`, `authorization`, `config`, `credentials`, `governance`, `hashtags`, `ideas`, `identity`, `leadcapture`, `mcp`, `media`, `notifications`, `observability`, `platform`, `platformadmin`, `privacy`, `publishing`, `tenancy`.
-- **Verification Result**: VERIFIED (count corrected from 17 to 19). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts.
-- **Drift Action**: Updated C4 Component & Code documents to include all 19 contexts and corrected CANDIDATE-013 synchronization records.
+- **Verification Result**: VERIFIED (count corrected from 17 to 18 bounded contexts plus Config). Config is infrastructure/cross-cutting configuration, not a separate bounded context in the DDD sense, but is organized as a module. Observability is retained among the contexts.
+- **Drift Action**: Updated C4 Component & Code documents to include all 18 bounded contexts plus the Config module and corrected CANDIDATE-013 synchronization records.
+
+---
+
+## Finding: Task Scheduling & Analytics Execution Model
+
+- **Claim**: Task scheduling and analytics execute in-process within the `server:smp` modular monolith, rather than via separate external Scheduler or Analytics container services.
+- **Evidence**:
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/publishing/infrastructure/scheduling/PublishingWorker.kt:912`: In-process publishing scheduling via Spring `TaskScheduler`.
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/analytics/`: Analytics context module inside `server:smp`.
+- **Verification Result**: VERIFIED.
+- **Drift Action**: Updated C4 Container model to remove separate container claims for Scheduler Service and Analytics Service.
+
+---
+
+## Finding: Stateless Access-Token Auth & Rate Limit Caching
+
+- **Claim**: The SPA keeps the short-lived JWT access token in memory and sends it in the `Authorization: Bearer` header. The refresh token alone is stored in an HttpOnly cookie. Caffeine/Redis caching is reserved for rate limiting in `shared:shield:ratelimit`, not central session storage.
+- **Evidence**:
+  - `apps/web/app/src/modules/auth/infrastructure/auth.store.ts` and `auth-api.ts`: Keep the access token in memory and add it to the `Authorization: Bearer` header.
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/http/LocalAuthController.kt`: Returns the access token in `AuthTokens` and stores only `result.refreshToken` in the HttpOnly cookie.
+  - `server/smp/src/main/kotlin/com/profiletailors/smp/identity/infrastructure/security/JwtPrincipalAuthenticationConverter.kt`: Stateless access-token validation.
+  - `shared/shield/ratelimit/src/main/kotlin/com/profiletailors/shield/ratelimit/`: Bucket4j rate limiting with Caffeine/Redis store options.
+- **Verification Result**: VERIFIED.
+- **Drift Action**: Corrected the C4 Container caching section to distinguish Bearer access-token authentication, the HttpOnly refresh-token cookie, and optional rate-limit caching.
 
 ### Open questions
 
@@ -403,7 +427,7 @@ Yes.
 
 ---
 
-## Finding: Authentication Flow (JWT + HttpOnly Cookie)
+## Finding: Authentication Flow (Bearer JWT + HttpOnly Refresh Cookie)
 
 ### Observed implementation
 
@@ -412,9 +436,10 @@ cookie. Access token lives only in memory on the frontend.
 
 ### Evidence
 
-- `LocalAuthHandlers.kt`: `issueAuthSession` creates tokens.
-- `auth-api.ts`: `requestRaw` includes `credentials: 'include'`.
-- `auth.ts` (Vue store): "Access token lives ONLY in memory".
+- `LocalAuthHandlers.kt`: `issueAuthSession` creates the access and refresh tokens.
+- `LocalAuthController.kt`: returns `AuthTokens` and stores only `result.refreshToken` in the HttpOnly cookie.
+- `auth-api.ts`: `requestRaw` sends the in-memory access token in the `Authorization: Bearer` header and includes the refresh cookie via `credentials: 'include'`.
+- `auth.store.ts` (Vue store): "Access token lives ONLY in memory".
 
 ### Documented intention
 

docs/architecture/c4/01-system-context.md

@@ -1,6 +1,6 @@
 # Level 1: System Context Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-15
 
 ## Overview
 
@@ -190,4 +190,4 @@ Profile Tailors enables teams to:
 - Team collaboration enhancements
 - Media asset management improvements
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14

docs/architecture/c4/02-container.md

@@ -1,6 +1,6 @@
 # Level 2: Container Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-15
 
 ## Overview
 
@@ -30,7 +30,7 @@ System_Boundary(profile_tailors, "Profile Tailors") {
 
     Container(spa, "Web Application", "Vue 3, TypeScript", "Single-page application for content management, scheduling, and analytics")
 
-    Container(api, "API Application", "Spring Boot 4, Kotlin, WebFlux", "Reactive REST API with 19 bounded contexts including Identity, Tenancy, Publishing, Media, Privacy, etc.")
+    Container(api, "API Application", "Spring Boot 4, Kotlin, WebFlux", "Reactive REST API with 18 bounded contexts plus the Config module (19 modules total), including Identity, Tenancy, Publishing, Media, and Privacy.")
 
     ContainerDb(db, "Database", "PostgreSQL 18", "Stores user data, workspaces, posts, schedules, credentials, and audit logs. R2DBC for reactive access.")
 
@@ -131,10 +131,11 @@ graph TB
 - **Composition**: Shared modules (`shared:common`, `shared:bus`, `shared:spring-boot-common`,
   `shared:security`, `shared:presentation`, `shared:storage`, `shared:shield:ratelimit`,
   `shared:lead-capture:*`) and `server:smp` (application assembly).
-- **Bounded Contexts**: Analytics, Audit, Authorization, Config, Credentials, Governance, Hashtags,
+- **Bounded Contexts**: Analytics, Audit, Authorization, Credentials, Governance, Hashtags,
   Ideas, Identity, Leadcapture, MCP, Media, Notifications, Observability, Platform, Platformadmin, Privacy,
   Publishing, Tenancy.
-- **Key Features**: Reactive programming with Kotlin coroutines, native JWT/cookie authentication,
+- **Cross-Cutting Module**: Config.
+- **Key Features**: Reactive programming with Kotlin coroutines, Bearer JWT access-token authentication with an HttpOnly refresh-token cookie,
   non-blocking R2DBC access, internal in-process event publishing via Reactor (`ChannelEventPublisher`),
   Spring Modulith modular monolith.
 
@@ -153,8 +154,8 @@ graph TB
 
 - **Technology**: Caffeine local in-memory cache, optional Redis via `shared:shield:ratelimit`
 - **Deployment**: Embedded JVM in-memory / optional container
-- **Purpose**: Rate limiting (Bucket4j) and ephemeral caching.
-- **Use Cases**: Rate limiting for public and waitlist endpoints (defaults to Caffeine). Session management relies on stateless signed JWT cookies rather than central session cache storage.
+- **Purpose**: Rate-limit state storage for Bucket4j.
+- **Use Cases**: Rate limiting for public and waitlist endpoints (defaults to Caffeine). The JWT access token is validated statelessly from the `Authorization: Bearer` header, while only the refresh token is stored in an HttpOnly cookie.
 
 #### Event Bus (In-Process Event Dispatch)
 
@@ -288,9 +289,8 @@ graph TB
 
 ### Horizontal Scaling
 
-- API Application: Stateless, can scale horizontally
-- Scheduler Service: Partitioned by workspace or time slot
-- Analytics Service: Partitioned by platform or metric type
+- API Application: Stateless, can scale horizontally; in-process workers (`PublishingWorker`) handle scheduled tasks within the modular monolith
+- Analytics Context: In-monolith analytics processing and metric aggregation
 
 ### Database Scaling
 
@@ -300,9 +300,8 @@ graph TB
 
 ### Caching Strategy
 
-- Redis for session data (TTL: 15 min)
-- API response cache (TTL: 1-5 min)
-- OAuth token cache (TTL: token expiry - 5 min)
+- Local Caffeine or optional Redis store for Bucket4j rate limiting (`shared:shield:ratelimit`)
+- The SPA keeps the short-lived JWT access token in memory and sends it in the `Authorization: Bearer` header; only the refresh token is stored in an HttpOnly cookie
 
 ---
 
@@ -326,4 +325,4 @@ graph TB
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14

docs/architecture/c4/03-component.md

@@ -1,6 +1,6 @@
 # Level 3: Component Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-15
 
 ## Overview
 
@@ -867,12 +867,12 @@ framework features, it belongs in `shared/spring-boot-common` instead.
 
 ## Current Implementation Status
 
-**Implemented Contexts** (19 total):
+**Implemented Modules** (18 bounded contexts plus Config; 19 total):
 
 - ✅ Analytics Context (engagement metrics & reporting)
 - ✅ Audit Context (request outcomes, authorization decisions, mutations)
 - ✅ Authorization Context (RBAC, direct grants, workspace permissions)
-- ✅ Config Context (system & application configuration)
+- ✅ Config Module (system & application configuration)
 - ✅ Credentials Context (API keys, token validation, secret management)
 - ✅ Governance Context (audit logging, mutation tracking, compliance)
 - ✅ Hashtags Context (hashtag group management & tracking)
@@ -891,4 +891,4 @@ framework features, it belongs in `shared/spring-boot-common` instead.
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14

docs/architecture/c4/04-code.md

@@ -1,6 +1,6 @@
 # Level 4: Code Diagram
 
-****Last Updated:** 2026-09-12
+**Last Updated:** 2026-09-15
 
 ## Overview
 
@@ -130,12 +130,12 @@ com.profiletailors.smp
 
 ## Current Implementation Status
 
-**Implemented Bounded Contexts** (19 total):
+**Implemented Modules** (18 bounded contexts plus Config; 19 total):
 
 - ✅ Analytics Context (engagement metrics & reporting)
 - ✅ Audit Context (request outcomes, authorization decisions, mutations)
 - ✅ Authorization Context (permission checking, RBAC, direct grants)
-- ✅ Config Context (application & system configuration)
+- ✅ Config Module (application & system configuration)
 - ✅ Credentials Context (API key validation, secret management)
 - ✅ Governance Context (audit logging, compliance)
 - ✅ Hashtags Context (hashtag group management & tracking)
@@ -164,4 +164,4 @@ com.profiletailors.smp
 
 ---
 
-Last updated: 2026-09-12
+Last updated: 2026-09-14