simpleaudit-studio 0.2.6__tar.gz → 0.3.0__tar.gz

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/.dockerignore

@@ -1,12 +1,18 @@
 .git
+.github
 .env
+.env.local
 .venv
 __pycache__/
 *.pyc
+*.sqlite3
+*.sqlite3-*
+app.pid
 data/
 staticfiles/
-media/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
-# sync 1790239341
+docs/
+e2e/
+copilot-instructions.md

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/.env.example

@@ -8,14 +8,14 @@
 # For a local (non-Docker) development setup, copy `.env.local.example` instead.
 #
 # NOTE: docker-compose.yml overrides a few values per service (POSTGRES_HOST,
-# HATCHET_*, MINIO_ENDPOINT) so the container-internal hostnames are used
+# HATCHET_*) so the container-internal hostnames are used
 # regardless of what is written here.
 # =============================================================================
 
 # --- Django -----------------------------------------------------------------
 DJANGO_SECRET_KEY=change-me
 DJANGO_DEBUG=false
-DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+DJANGO_ALLOWED_HOSTS=*
 LOG_LEVEL=INFO
 
 # --- Bootstrap (idempotent; run automatically by the web container) ----------
@@ -46,14 +46,6 @@ POSTGRES_PASSWORD=change-me
 POSTGRES_HOST=postgres
 POSTGRES_PORT=5432
 
-# --- MinIO / S3-compatible object storage (OFF by default) --------------------
-# Enable with: docker compose --profile storage up -d
-# Then uncomment and set real credentials:
-# MINIO_ENDPOINT=http://minio:9000
-# MINIO_ACCESS_KEY=change-me
-# MINIO_SECRET_KEY=change-me
-# MINIO_BUCKET=simpleaudit-artifacts
-
 # --- Durable workflow system (Hatchet) ----------------------------------------
 # Docker Compose: the compose service name `hatchet-server` resolves inside the
 # compose network. HTTP API on :8888, gRPC on :7077 (see docker-compose.yml).
@@ -76,9 +68,6 @@ HATCHET_TLS_STRATEGY=none
 WORKER_POOL=cpu
 
 # --- Operational limits --------------------------------------------------------
-MAX_CONCURRENT_AUDITS=2
-MAX_SCENARIOS_PER_RUN=500
-SSE_MAX_CONNECTIONS_PER_USER=10
 
 # --- SimpleAudit engine ---------------------------------------------------------
 # No configuration needed here. The engine is a normal pip dependency pinned in
@@ -99,10 +88,6 @@ SSE_MAX_CONNECTIONS_PER_USER=10
 SEED_DEMO_AUDITS=true
 
 # --- Optional observability -----------------------------------------------------
-OTEL_EXPORTER_OTLP_ENDPOINT=
-LANGFUSE_PUBLIC_KEY=
-LANGFUSE_SECRET_KEY=
-LANGFUSE_HOST=
 
 # --- Sentry error tracking & tracing (leave empty to disable) -------------------
 SENTRY_DSN=
@@ -113,5 +98,3 @@ SENTRY_ENVIRONMENT=development
 # WORKOS_CLIENT_ID is public; WORKOS_API_KEY is server-side secret (keep out of git).
 WORKOS_CLIENT_ID=
 WORKOS_API_KEY=
-# Public base URL used to build the OAuth redirect URI, e.g. http://localhost:8000
-APP_BASE_URL=http://localhost:8000

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/.env.local.example

@@ -17,7 +17,7 @@
 # --- Django -----------------------------------------------------------------
 DJANGO_SECRET_KEY=local-dev-key-not-for-prod
 DJANGO_DEBUG=true
-DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+DJANGO_ALLOWED_HOSTS=*
 LOG_LEVEL=DEBUG
 
 # --- Bootstrap ----------------------------------------------------------------
@@ -80,13 +80,5 @@ WORKER_POOL=cpu
 # SIMULACHAT_API_KEY=sk-...
 
 # --- Optional (leave empty to disable) ------------------------------------------
-MINIO_ENDPOINT=
-MINIO_ACCESS_KEY=
-MINIO_SECRET_KEY=
-MINIO_BUCKET=simpleaudit-artifacts
-OTEL_EXPORTER_OTLP_ENDPOINT=
-LANGFUSE_PUBLIC_KEY=
-LANGFUSE_SECRET_KEY=
-LANGFUSE_HOST=
 SENTRY_DSN=
 SENTRY_ENVIRONMENT=development

simpleaudit_studio-0.3.0/.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    paths-ignore: ["docs/**", "**.md", "LICENSE"]
+  pull_request:
+    paths-ignore: ["docs/**", "**.md", "LICENSE"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    env:
+      DJANGO_SETTINGS_MODULE: config.settings
+      DJANGO_SECRET_KEY: ci-secret-key
+      DJANGO_DEBUG: "false"
+      DJANGO_ALLOWED_HOSTS: "*"
+      SIMPLEAUDIT_LOCAL_SQLITE: "1"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # the embedded-Hatchet step diffs against origin/main
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: astral-sh/setup-uv@v7
+      - name: Install dependencies
+        run: uv sync --frozen --extra dev
+      - name: Lint (ruff)
+        run: uv run ruff check .
+      - name: Run tests (parallel)
+        run: uv run python manage.py test infra --parallel auto --exclude-tag embedded_hatchet
+      - name: Check if embedded Hatchet files changed
+        id: hatchet-changed
+        run: |
+          CHANGED=$(git diff --name-only origin/main...HEAD -- infra/minimal_config.py infra/worker.py 2>/dev/null || true)
+          if [ -n "$CHANGED" ]; then echo "changed=true" >> "$GITHUB_OUTPUT"; else echo "changed=false" >> "$GITHUB_OUTPUT"; fi
+      - name: Run tests (embedded Hatchet, serial)
+        if: steps.hatchet-changed.outputs.changed == 'true'
+        run: uv run python manage.py test infra.tests.test_minimal_config.TestEmbeddedHatchetLifecycle

simpleaudit_studio-0.3.0/.github/workflows/docker.yml

@@ -0,0 +1,46 @@
+name: Docker build
+
+# Builds both images (no push) only when something that affects them changes,
+# so Dockerfile / dependency / settings breakage is caught before deploying.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "Dockerfile"
+      - "deploy/**"
+      - "docker-compose.yml"
+      - ".dockerignore"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "config/settings.py"
+      - "infra/minimal_config.py"
+      - "simpleaudit_studio/**"
+      - ".github/workflows/docker.yml"
+  pull_request:
+    paths:
+      - "Dockerfile"
+      - "deploy/**"
+      - "docker-compose.yml"
+      - ".dockerignore"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "config/settings.py"
+      - "infra/minimal_config.py"
+      - "simpleaudit_studio/**"
+      - ".github/workflows/docker.yml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build HF Space / demo image
+        run: docker build -t simpleaudit-studio:ci .
+      - name: Build Compose image
+        run: docker build -f deploy/compose/Dockerfile -t simpleaudit-studio-compose:ci .
+      - name: Validate compose file
+        run: cp .env.example .env && docker compose config --quiet

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/.github/workflows/publish.yml

@@ -20,7 +20,16 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Install dependencies
+      - uses: astral-sh/setup-uv@v7
+      - name: Test before publishing
+        env:
+          DJANGO_SECRET_KEY: ci-secret-key
+          SIMPLEAUDIT_LOCAL_SQLITE: "1"
+        run: |
+          uv sync --frozen --extra dev
+          uv run ruff check .
+          uv run python manage.py test infra --parallel auto --exclude-tag embedded_hatchet
+      - name: Install build tooling
         run: |
           python -m pip install --upgrade pip
           pip install build

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/.gitignore

@@ -8,6 +8,7 @@ venv/
 # Django
 db.sqlite3
 *.sqlite3
+*.sqlite3-*
 media/
 staticfiles/
 
@@ -24,6 +25,7 @@ simpleaudit-dependency.yaml
 .idea/
 *.swp
 .DS_Store
+copilot-instructions.md
 
 # Test/coverage
 .coverage
@@ -37,5 +39,8 @@ docker-data/
 *.log
 logs/
 
+# Runtime artifacts
+app.pid
+
 # Data artifacts (prototype)
 data/

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/Dockerfile

@@ -29,47 +29,47 @@ RUN apt-get update \
 
 # --- Python dependencies -----------------------------------------------------
 # pyproject.toml is the single source of truth; uv.lock pins exact versions.
-# The postgres extra is included because Django imports the psycopg driver at
-# startup even when SIMPLEAUDIT_MINIMAL=1 uses SQLite for the domain DB.
 # uv sync creates /app/.venv; the PATH update keeps the `python` entrypoint.
 COPY pyproject.toml uv.lock README.md ./
 RUN pip install uv \
-    && uv sync --frozen --no-install-project --no-dev --extra postgres
+    && uv sync --frozen --no-install-project --no-dev
 ENV PATH="/app/.venv/bin:$PATH"
 
-# --- Application code --------------------------------------------------------
-COPY . .
-
-# Collect static files so Django can serve them without DEBUG.
-RUN python manage.py collectstatic --noinput
-
-# --- Non-root user ------------------------------------------------------------
-RUN useradd --create-home appuser \
-    && mkdir -p /app/staticfiles /app/media \
-    && chown -R appuser:appuser /app
-USER appuser
-
 # --- Environment defaults for the Space --------------------------------------
 # SIMPLEAUDIT_MINIMAL=1 enables the minimal config path (SQLite + embedded Hatchet).
 # Override via HF Space Secrets for anything sensitive.
+# Must be set BEFORE collectstatic: Django settings select the DB engine from it,
+# and the postgres driver is an optional extra not installed in this image.
 ENV SIMPLEAUDIT_MINIMAL=1 \
     PORT=7860 \
     DJANGO_SECRET_KEY=hf-space-demo-secret-key-change-in-production \
     DJANGO_DEBUG=false \
-    DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,.hf.space,.huggingface.co \
+    DJANGO_ALLOWED_HOSTS=* \
     BOOTSTRAP_USERNAME=studio \
     BOOTSTRAP_EMAIL=studio@example.local \
     BOOTSTRAP_PASSWORD=admin123 \
     BOOTSTRAP_PROJECT_NAME=Default \
     DEMO_MODE=true \
     DEMO_USERNAME=studio \
-    DEMO_PASSWORD=admin123 \
-    MAX_CONCURRENT_AUDITS=1 \
-    MAX_SCENARIOS_PER_RUN=50
+    DEMO_PASSWORD=admin123
+
+# --- Application code --------------------------------------------------------
+COPY . .
+
+# Collect static files so Django can serve them without DEBUG.
+RUN python manage.py collectstatic --noinput
+
+# --- Non-root user ------------------------------------------------------------
+RUN useradd --create-home appuser \
+    && mkdir -p /app/staticfiles \
+    && chown -R appuser:appuser /app
+USER appuser
 
 EXPOSE 7860
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=90s --retries=5 \
     CMD curl -fsS http://localhost:7860/healthz || exit 1
 
+# Model connections point at OpenAI's real base URL (https://api.openai.com/v1).
+# Users add their API key in the UI to run real audits.
 CMD ["python", "-m", "simpleaudit_studio.cli"]

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/PKG-INFO

@@ -1,16 +1,16 @@
 Metadata-Version: 2.5
 Name: simpleaudit-studio
-Version: 0.2.6
+Version: 0.3.0
 Summary: Production AI model audit platform — one-liner demo mode via uvx
 License: MIT
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: boto3==1.40.4
-Requires-Dist: django-cors-headers==4.7.0
+Requires-Dist: cronsim==2.7
 Requires-Dist: django==5.2.4
 Requires-Dist: djangorestframework==3.16.0
 Requires-Dist: drf-spectacular==0.28.0
 Requires-Dist: hatchet-sdk==1.41.0
+Requires-Dist: httpx>=0.27
 Requires-Dist: pydantic<3,>=2.7
 Requires-Dist: python-dotenv==1.1.1
 Requires-Dist: requests==2.32.5
@@ -19,9 +19,9 @@ Requires-Dist: simpleaudit==0.2.1
 Requires-Dist: workos==10.4.0
 Provides-Extra: dev
 Requires-Dist: factory-boy==3.3.2; extra == 'dev'
-Requires-Dist: pytest; extra == 'dev'
-Requires-Dist: pytest-django; extra == 'dev'
 Requires-Dist: ruff; extra == 'dev'
+Provides-Extra: e2e
+Requires-Dist: playwright>=1.45; extra == 'e2e'
 Provides-Extra: postgres
 Requires-Dist: psycopg[binary]==3.2.13; extra == 'postgres'
 Provides-Extra: server
@@ -78,7 +78,40 @@ The pre-seeded connections point at a built-in mock server. To run real audits,
 | Together AI | `https://api.together.xyz/v1` | Many open models |
 | Groq | `https://api.groq.com/openai/v1` | Fast inference |
 
-Set the API key in the connection form (leave blank for local servers that don't require auth), then launch an audit from the Scenario Library.
+Set the API key in the connection form (leave blank for local servers that don't require auth), then start a run from **New Experiment**.
+
+## 🛠️ Local Development
+
+For contributors working on the codebase, use [uv](https://docs.astral.sh/uv/) — no manual venv steps, no Makefile. Two verbs cover everything:
+
+- **`uv sync`** — create/update `.venv` from `pyproject.toml` + `uv.lock`
+- **`uv run <cmd>`** — run any command inside `.venv` (auto-syncs first if the lockfile changed)
+
+### Setup (one time)
+
+```bash
+git clone https://github.com/SushantGautam/SimpleAuditStudio
+cd SimpleAuditStudio
+cp .env.local.example .env          # minimal local config (SQLite + mock models)
+
+uv sync --extra dev --extra postgres   # create .venv + install all deps
+uv run manage.py setup_local           # migrate + create admin (studio / BOOTSTRAP_PASSWORD from .env) + seed data
+```
+
+`setup_local` chains the three idempotent first-run steps (migrate → bootstrap admin → seed scenario packs & model connections) into one command. Re-run it any time — it skips what already exists.
+
+### Daily work
+
+```bash
+uv run manage.py dev_server --embedded   # easiest: web UI + API + audit worker, zero-Docker → http://localhost:8000
+```
+
+Other options:
+```bash
+uv run manage.py runserver               # web UI + API only (no worker)
+uv run manage.py dev_server              # web UI + worker, uses .env (edit POSTGRES_*/HATCHET_* to point at your infra)
+SIMPLEAUDIT_LOCAL_SQLITE=1 uv run manage.py test infra   # tests
+```
 
 ## 🐳 Self-Hosting
 
@@ -92,22 +125,22 @@ cp .env.example .env
 docker compose up -d
 ```
 
-Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profiles: `--profile storage` (MinIO), `--profile mock` (mock model API).
+Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profile: `--profile mock` (mock model API).
 
 See [docs/deployment.md](docs/deployment.md) for production hardening, backups, and upgrades.
 
 ## ✨ What You Can Do
 
-- Browse the scenario library and create new audit scenarios
-- Register model endpoints (OpenAI-compatible APIs)
-- Launch audits and watch live progress
-- Compare results across runs
-- Explore the visualizer for detailed analysis
+- Build versioned scenario sets and register OpenAI-compatible models
+- Run experiments across models, scenario versions and settings, with a review step before launch
+- Watch runs live, including per-repetition results
+- Monitor models for drift on a schedule (interval or cron)
+- Filter, customise and compare runs on an interactive dashboard
 
 ## 🏗️ Architecture
 
 ```
-Browser → Django/Gunicorn (:7860)
+Browser → Django (gunicorn :8000 in Compose; runserver :7860 in the HF Space / uvx demo)
               ↓
          PostgreSQL 16 (domain + queue DBs)
               ↓
@@ -126,11 +159,3 @@ Browser → Django/Gunicorn (:7860)
 ## 🤝 Contributing
 
 Architecture decisions are documented in [docs/architecture.md](docs/architecture.md).
-
-
-
-
-
-
-
-

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/README.md

@@ -48,7 +48,40 @@ The pre-seeded connections point at a built-in mock server. To run real audits,
 | Together AI | `https://api.together.xyz/v1` | Many open models |
 | Groq | `https://api.groq.com/openai/v1` | Fast inference |
 
-Set the API key in the connection form (leave blank for local servers that don't require auth), then launch an audit from the Scenario Library.
+Set the API key in the connection form (leave blank for local servers that don't require auth), then start a run from **New Experiment**.
+
+## 🛠️ Local Development
+
+For contributors working on the codebase, use [uv](https://docs.astral.sh/uv/) — no manual venv steps, no Makefile. Two verbs cover everything:
+
+- **`uv sync`** — create/update `.venv` from `pyproject.toml` + `uv.lock`
+- **`uv run <cmd>`** — run any command inside `.venv` (auto-syncs first if the lockfile changed)
+
+### Setup (one time)
+
+```bash
+git clone https://github.com/SushantGautam/SimpleAuditStudio
+cd SimpleAuditStudio
+cp .env.local.example .env          # minimal local config (SQLite + mock models)
+
+uv sync --extra dev --extra postgres   # create .venv + install all deps
+uv run manage.py setup_local           # migrate + create admin (studio / BOOTSTRAP_PASSWORD from .env) + seed data
+```
+
+`setup_local` chains the three idempotent first-run steps (migrate → bootstrap admin → seed scenario packs & model connections) into one command. Re-run it any time — it skips what already exists.
+
+### Daily work
+
+```bash
+uv run manage.py dev_server --embedded   # easiest: web UI + API + audit worker, zero-Docker → http://localhost:8000
+```
+
+Other options:
+```bash
+uv run manage.py runserver               # web UI + API only (no worker)
+uv run manage.py dev_server              # web UI + worker, uses .env (edit POSTGRES_*/HATCHET_* to point at your infra)
+SIMPLEAUDIT_LOCAL_SQLITE=1 uv run manage.py test infra   # tests
+```
 
 ## 🐳 Self-Hosting
 
@@ -62,22 +95,22 @@ cp .env.example .env
 docker compose up -d
 ```
 
-Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profiles: `--profile storage` (MinIO), `--profile mock` (mock model API).
+Services: Web UI (:8000), PostgreSQL, Hatchet queue (:8888), Worker. Optional profile: `--profile mock` (mock model API).
 
 See [docs/deployment.md](docs/deployment.md) for production hardening, backups, and upgrades.
 
 ## ✨ What You Can Do
 
-- Browse the scenario library and create new audit scenarios
-- Register model endpoints (OpenAI-compatible APIs)
-- Launch audits and watch live progress
-- Compare results across runs
-- Explore the visualizer for detailed analysis
+- Build versioned scenario sets and register OpenAI-compatible models
+- Run experiments across models, scenario versions and settings, with a review step before launch
+- Watch runs live, including per-repetition results
+- Monitor models for drift on a schedule (interval or cron)
+- Filter, customise and compare runs on an interactive dashboard
 
 ## 🏗️ Architecture
 
 ```
-Browser → Django/Gunicorn (:7860)
+Browser → Django (gunicorn :8000 in Compose; runserver :7860 in the HF Space / uvx demo)
               ↓
          PostgreSQL 16 (domain + queue DBs)
               ↓
@@ -96,11 +129,3 @@ Browser → Django/Gunicorn (:7860)
 ## 🤝 Contributing
 
 Architecture decisions are documented in [docs/architecture.md](docs/architecture.md).
-
-
-
-
-
-
-
-

simpleaudit_studio-0.3.0/accounts/admin_urls.py

@@ -0,0 +1,11 @@
+from django.urls import path
+
+from . import views
+
+urlpatterns = [
+    path("stats/", views.admin_stats, name="admin-stats"),
+    path("workspaces/<int:project_id>/archive/", views.admin_archive_workspace, name="admin-workspace-archive"),
+    path("workspaces/<int:project_id>/unarchive/", views.admin_unarchive_workspace, name="admin-workspace-unarchive"),
+    path("users/", views.admin_create_user_view, name="admin-user-create"),
+    path("users/<int:user_id>/", views.admin_update_user_view, name="admin-user-update"),
+]

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/accounts/auth_urls.py

@@ -6,4 +6,5 @@ urlpatterns = [
     path("register/", views.register, name="auth-register"),
     path("token/", views.obtain_token, name="auth-token"),
     path("me/", views.me, name="auth-me"),
+    path("profile/", views.update_profile, name="auth-profile"),
 ]

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/accounts/migrations/0001_initial.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.2.4 on 2026-09-23 12:05
+# Generated by Django 5.2.4 on 2026-09-27 19:42
 
 import django.contrib.auth.models
 import django.contrib.auth.validators
@@ -31,6 +31,7 @@ class Migration(migrations.Migration):
                 ("name", models.CharField(max_length=200, unique=True)),
                 ("slug", models.SlugField(max_length=200, unique=True)),
                 ("description", models.TextField(blank=True)),
+                ("archived", models.BooleanField(db_index=True, default=False)),
                 ("created_at", models.DateTimeField(auto_now_add=True)),
                 ("updated_at", models.DateTimeField(auto_now=True)),
             ],
@@ -121,6 +122,10 @@ class Migration(migrations.Migration):
                         default=django.utils.timezone.now, verbose_name="date joined"
                     ),
                 ),
+                (
+                    "workos_user_id",
+                    models.CharField(blank=True, max_length=64, null=True, unique=True),
+                ),
                 (
                     "groups",
                     models.ManyToManyField(

simpleaudit_studio-0.2.6/accounts/migrations/0002_user_workos_user_id.py → simpleaudit_studio-0.3.0/accounts/migrations/0002_user_preferences.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.2.4 on 2026-09-24 13:27
+# Generated by Django 5.2.4 on 2026-09-27 20:23
 
 from django.db import migrations, models
 
@@ -11,7 +11,7 @@ class Migration(migrations.Migration):
     operations = [
         migrations.AddField(
             model_name="user",
-            name="workos_user_id",
-            field=models.CharField(blank=True, max_length=64, null=True, unique=True),
+            name="preferences",
+            field=models.JSONField(blank=True, default=dict),
         ),
     ]

{simpleaudit_studio-0.2.6 → simpleaudit_studio-0.3.0}/accounts/models.py

@@ -21,6 +21,9 @@ class User(AbstractUser):
 
     # Stable WorkOS AuthKit user id; null for locally-created accounts.
     workos_user_id = models.CharField(max_length=64, unique=True, null=True, blank=True)
+    # Per-user UI preferences (e.g. dashboard column layout). Keys are
+    # whitelisted by the preference endpoint; values are small JSON.
+    preferences = models.JSONField(default=dict, blank=True)
 
     groups = models.ManyToManyField(
         "auth.Group",
@@ -45,6 +48,9 @@ class Project(models.Model):
     name = models.CharField(max_length=200, unique=True)
     slug = models.SlugField(max_length=200, unique=True)
     description = models.TextField(blank=True)
+    # Soft-hide a workspace that still contains data. Members keep read access;
+    # all mutations are blocked for non-superusers. Never deletes data.
+    archived = models.BooleanField(default=False, db_index=True)
     created_at = models.DateTimeField(auto_now_add=True)
     updated_at = models.DateTimeField(auto_now=True)