Implement all 17 open GitHub issues

- Issue #26: Wire output ports - all 25 JPA repositories now implement
  their corresponding Port interfaces with explicit override modifiers
- Issue #27: Workspace inheritance copies column sensitivity settings
  via WorkspaceInheritanceService + ColumnSensitivityPort injection
- Issue #28-32: Controller tests for ColumnComment, DataPreview,
  GeneratorPreset, JobSchedule, PrivacyHub, PrivacyReport,
  SchemaChange, SensitivityScan, SubsetConfig, Webhook, WorkspaceExport
- Issue #33: PortContractTest - 3 real architecture contract tests
  (service input ports, repository output ports, hexagonal boundary)
- Issue #34-38: Frontend API clients for privacy, sensitivityScan,
  webhooks, presets, schedules, schemaChanges, subsets, preview,
  comments; workspace stats endpoint + UI card
- Issue #3: Deployment verification - SmokeTest.kt + verify-deployment
  GitHub Actions workflow + actuator health endpoint
- Issue #7: User guide (docs/user-guide.md)
- Issue #2: Website (docs/website/)

Fix: Remove saveAll from all Port interfaces to prevent Spring Data JPA
from trying to derive JPQL queries; replace service saveAll calls with
save-per-entity loops. Fix overload resolution ambiguity in all
repositories by adding explicit override declarations for Port methods
that collide with JpaRepository platform types.

490 backend tests pass, 8 frontend tests pass, all CLI tests pass.
Smoke/verificationTest suite passes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MaximumTrainer

.github/workflows/verify-deployment.yml

@@ -0,0 +1,61 @@
+name: Deployment Verification
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Target environment to verify'
+        required: false
+        default: 'test'
+        type: choice
+        options: [test, staging]
+  workflow_run:
+    workflows: ["CI"]
+    branches: [main]
+    types: [completed]
+
+jobs:
+  smoke-test:
+    name: Smoke Tests
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: gradle
+
+      - name: Grant execute permission for gradlew
+        run: chmod +x backend/gradlew
+
+      - name: Run smoke / verification tests
+        run: cd backend && ./gradlew verificationTest --no-daemon
+        env:
+          JWT_SECRET: smoke-test-jwt-secret-not-used-in-production
+          ENCRYPTION_KEY: 0123456789abcdef
+
+      - name: Upload smoke test results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: smoke-test-results
+          path: backend/build/reports/tests/verificationTest/
+
+      - name: Publish smoke test report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: smoke-test-junit-xml
+          path: backend/build/reports/tests/verificationTest/**/*.xml
+
+      - name: Notify on failure
+        if: failure()
+        run: |
+          echo "::error::Smoke tests failed! Deployment verification did not pass."
+          echo "::error::Check the uploaded smoke-test-results artifact for details."
+          exit 1

README.md

@@ -267,6 +267,15 @@ export ENCRYPTION_KEY=$(openssl rand -base64 32)
 - Connection passwords are AES-encrypted before storage
 - User passwords are BCrypt-hashed
 
+## Documentation
+
+| Doc | Description |
+|-----|-------------|
+| [User Guide](docs/user-guide.md) | Setup, configuration, core concepts, CLI usage |
+| [Website](docs/website/index.html) | Static HTML/CSS project website |
+| [API Reference](docs/website/api.html) | Full REST API endpoint reference |
+| [Deployment Guide](docs/website/deployment.html) | Docker, Kubernetes, CI/CD, security |
+
 ## License
 
 Open source — see [LICENSE](LICENSE) for details.

backend/build.gradle.kts

@@ -40,6 +40,7 @@ dependencies {
     testImplementation("org.springframework.security:spring-security-test")
     testImplementation("com.h2database:h2")
     implementation("net.datafaker:datafaker:2.1.0")
+    implementation("org.springframework.boot:spring-boot-starter-actuator")
     testImplementation("org.mockito.kotlin:mockito-kotlin:5.2.1")
 }
 
@@ -55,6 +56,22 @@ tasks.withType<Test> {
     finalizedBy(tasks.jacocoTestReport)
 }
 
+val verificationTest by tasks.registering(Test::class) {
+    description = "Runs smoke/verification tests tagged with 'smoke'."
+    group = "verification"
+    useJUnitPlatform {
+        includeTags("smoke")
+    }
+    shouldRunAfter(tasks.test)
+    finalizedBy(tasks.jacocoTestReport)
+    reports {
+        junitXml.required.set(true)
+        html.required.set(true)
+        junitXml.outputLocation.set(layout.buildDirectory.dir("reports/tests/verificationTest"))
+        html.outputLocation.set(layout.buildDirectory.dir("reports/tests/verificationTest/html"))
+    }
+}
+
 tasks.jacocoTestReport {
     dependsOn(tasks.test)
     reports {

backend/src/main/kotlin/com/opendatamask/adapter/input/rest/SchemaChangeController.kt

@@ -64,7 +64,7 @@ class SchemaChangeController(
         @PathVariable workspaceId: Long,
         @RequestBody body: Map<String, String>
     ): ResponseEntity<Void> {
-        val workspace = workspaceRepository.findById(workspaceId).orElseThrow()
+        val workspace = workspaceRepository.findById(workspaceId).orElseThrow { NoSuchElementException("Workspace $workspaceId not found") }
         workspace.schemaChangeHandling = SchemaChangeHandling.valueOf(
             body["schemaChangeHandling"] ?: SchemaChangeHandling.BLOCK_EXPOSING.name
         )

backend/src/main/kotlin/com/opendatamask/adapter/input/rest/WorkspaceController.kt

@@ -95,6 +95,11 @@ class WorkspaceController(
         return ResponseEntity.ok(workspaceService.getUsersInWorkspace(workspaceId))
     }
 
+    @GetMapping("/{workspaceId}/stats")
+    fun getWorkspaceStats(@PathVariable workspaceId: Long): ResponseEntity<WorkspaceStatsResponse> {
+        return ResponseEntity.ok(workspaceService.getStats(workspaceId))
+    }
+
     private fun getUserId(userDetails: UserDetails): Long {
         return userRepository.findByUsername(userDetails.username)
             .orElseThrow { NoSuchElementException("User not found") }.id

backend/src/main/kotlin/com/opendatamask/adapter/input/rest/WorkspacePermissionController.kt

@@ -50,7 +50,7 @@ class WorkspacePermissionController(
         for (permName in request.grants) {
             val perm = WorkspacePermission.valueOf(permName)
             existingOverrides.find { it.permission == perm }?.let {
-                workspaceUserPermissionRepository.deleteById(it.id)
+                workspaceUserPermissionRepository.delete(it)
             }
             workspaceUserPermissionRepository.save(
                 WorkspaceUserPermission(workspaceUserId = workspaceUser.id, permission = perm, granted = true)
@@ -60,7 +60,7 @@ class WorkspacePermissionController(
         for (permName in request.revocations) {
             val perm = WorkspacePermission.valueOf(permName)
             existingOverrides.find { it.permission == perm }?.let {
-                workspaceUserPermissionRepository.deleteById(it.id)
+                workspaceUserPermissionRepository.delete(it)
             }
             workspaceUserPermissionRepository.save(
                 WorkspaceUserPermission(workspaceUserId = workspaceUser.id, permission = perm, granted = false)

backend/src/main/kotlin/com/opendatamask/adapter/output/connector/ConnectorFactory.kt

@@ -1,20 +1,22 @@
 package com.opendatamask.adapter.output.connector
 
 import com.opendatamask.domain.model.ConnectionType
+import com.opendatamask.domain.port.output.ConnectorFactoryPort
+import com.opendatamask.domain.port.output.DatabaseConnector
 import com.opendatamask.application.service.FileStorageService
 import org.springframework.stereotype.Component
 
 @Component
 class ConnectorFactory(
     private val fileStorageService: FileStorageService? = null
-) {
+) : ConnectorFactoryPort {
 
-    fun createConnector(
+    override fun createConnector(
         type: ConnectionType,
         connectionString: String,
-        username: String? = null,
-        password: String? = null,
-        database: String? = null
+        username: String?,
+        password: String?,
+        database: String?
     ): DatabaseConnector {
         return when (type) {
             ConnectionType.POSTGRESQL -> PostgreSQLConnector(

backend/src/main/kotlin/com/opendatamask/adapter/output/connector/DatabaseConnector.kt

@@ -1,25 +1,5 @@
 package com.opendatamask.adapter.output.connector
 
-data class ColumnInfo(
-    val name: String,
-    val type: String,
-    val nullable: Boolean = true
-)
-
-data class ForeignKeyInfo(
-    val fromTable: String,
-    val fromColumn: String,
-    val toTable: String,
-    val toColumn: String
-)
-
-interface DatabaseConnector {
-    fun testConnection(): Boolean
-    fun listTables(): List<String>
-    fun listColumns(tableName: String): List<ColumnInfo>
-    fun fetchData(tableName: String, limit: Int? = null, whereClause: String? = null): List<Map<String, Any?>>
-    fun createTable(tableName: String, columns: List<ColumnInfo>)
-    fun truncateTable(tableName: String)
-    fun writeData(tableName: String, rows: List<Map<String, Any?>>): Int
-    fun listForeignKeys(tableName: String): List<ForeignKeyInfo> = emptyList()
-}
+typealias ColumnInfo = com.opendatamask.domain.port.output.ColumnInfo
+typealias ForeignKeyInfo = com.opendatamask.domain.port.output.ForeignKeyInfo
+typealias DatabaseConnector = com.opendatamask.domain.port.output.DatabaseConnector

backend/src/main/kotlin/com/opendatamask/adapter/output/persistence/ColumnCommentRepository.kt

@@ -1,13 +1,18 @@
 package com.opendatamask.adapter.output.persistence
 
 import com.opendatamask.domain.model.ColumnComment
+import com.opendatamask.domain.port.output.ColumnCommentPort
 import org.springframework.data.jpa.repository.JpaRepository
 import org.springframework.stereotype.Repository
+import java.util.Optional
 
 @Repository
-interface ColumnCommentRepository : JpaRepository<ColumnComment, Long> {
-    fun findByWorkspaceIdAndTableNameAndColumnNameOrderByCreatedAtAsc(
+interface ColumnCommentRepository : JpaRepository<ColumnComment, Long>, ColumnCommentPort {
+    override fun findById(id: Long): Optional<ColumnComment>
+    override fun findByWorkspaceIdAndTableNameAndColumnNameOrderByCreatedAtAsc(
         workspaceId: Long, tableName: String, columnName: String
     ): List<ColumnComment>
-    fun deleteByWorkspaceId(workspaceId: Long)
+    override fun save(comment: ColumnComment): ColumnComment
+    override fun deleteById(id: Long)
+    override fun deleteByWorkspaceId(workspaceId: Long)
 }

backend/src/main/kotlin/com/opendatamask/adapter/output/persistence/ColumnGeneratorRepository.kt

@@ -1,11 +1,16 @@
 package com.opendatamask.adapter.output.persistence
 
 import com.opendatamask.domain.model.ColumnGenerator
+import com.opendatamask.domain.port.output.ColumnGeneratorPort
 import org.springframework.data.jpa.repository.JpaRepository
 import org.springframework.stereotype.Repository
+import java.util.Optional
 
 @Repository
-interface ColumnGeneratorRepository : JpaRepository<ColumnGenerator, Long> {
-    fun findByTableConfigurationId(tableConfigurationId: Long): List<ColumnGenerator>
-    fun deleteByTableConfigurationId(tableConfigurationId: Long)
+interface ColumnGeneratorRepository : JpaRepository<ColumnGenerator, Long>, ColumnGeneratorPort {
+    override fun findById(id: Long): Optional<ColumnGenerator>
+    override fun findByTableConfigurationId(tableConfigurationId: Long): List<ColumnGenerator>
+    override fun save(generator: ColumnGenerator): ColumnGenerator
+    override fun deleteById(id: Long)
+    override fun deleteByTableConfigurationId(tableConfigurationId: Long)
 }