> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Technical library

> Architecture, signed-record behavior, information handling and enterprise setup.

This library describes the implemented system and its operating limits. It is separate from private files uploaded to a workspace vault. These documents are technical references; they are not an audit report, certification, contractual SLA or evidence of a completed security review.

| Document | What it explains |
| - | - |
| [Platform architecture](/enterprise/architecture) | Applications, services, identity and data boundaries |
| [Signed record specification](/enterprise/signed-records) | Payloads, signatures, expiry, issuer risk and proof bundles |
| [Signing algorithms and key custody](/enterprise/signing-algorithms) | Managed generation, verification support, encoding and historical-key limits |
| [Information handling](/enterprise/information-handling) | Workspace vault access, versions, retention and disposal |
| [Enterprise setup](/enterprise/setup) | Identity, environments, SSO, billing and acceptance checks |

Each page carries a revision date. Changes are versioned in the [Truthlocks source repository](https://github.com/truthlocks/truthlock/tree/main/docs-mintlify/enterprise). Keep the revision used for your own review; a later page update is not a change to an existing signed record.

For service availability, consult [System status](https://status.truthlocks.com). For integrations and installation links, use the [integration directory](https://truthlocks.com/resources/integrations).

## Console workflow execution

Revision: 14 October 2026.

The Console workflow library at [console.truthlocks.com/workflows](https://console.truthlocks.com/workflows) uses the shared Temporal execution service. The machine-identity orchestration pages in Console use this same editor. Domain automation services and the public `/v1/orchestrate/workflows` API have separate contracts; do not interchange their definitions.

Start with a **Start** step, connect the actions you need, and end the path with **Finish**. Saving a definition records configuration. A completed run, with its recorded step outcomes, is the evidence that execution succeeded.

| Step | Required configuration | Recorded behavior |
| - | - | - |
| Generate with Gemini | Task instructions; maximum response tokens from 1 to 32768 | Includes run input and earlier results as context; saves response text, model, token count and estimated cost. Requiring structured output rejects responses that are not JSON objects. |
| Request human approval | Existing workspace reviewer user IDs, review instructions and a deadline of 1–168 hours | Persists the review request and decision. Approval continues the path; rejection or expiry fails it. |
| Send an email | Exactly one recipient, a subject of 1–200 characters, and a plain-text message | Records SMTP provider acceptance. This does not prove inbox delivery. The engine does not automatically retry an uncertain delivery. Named templates and variable substitution are not supported. |

Keep credentials out of prompts, run input and step configuration. AI steps send their context to the configured Gemini service. A workflow response is generated content, not an independently verified attestation.

### Data mappings

The `transform` step accepts a `mappings` object in its saved configuration. Values can be JSON literals, nested objects and arrays, or an object containing only `$ref`. References read the current run's `trigger_data` or an earlier step's output in `prior_outputs`.

```json theme={null}
{
  "mappings": {
    "invoiceAmount": { "$ref": "/trigger_data/invoice/amount" },
    "reviewDecision": { "$ref": "/prior_outputs/review/decision" },
    "source": "workflow"
  }
}
```

For this example, the run input must contain `invoice.amount`, and the earlier step with ID `review` must output `decision`. Array references use zero-based indexes, such as `/trigger_data/items/0/amount`. Within a field name, encode `/` as `~1` and `~` as `~0`.

Missing fields, invalid indexes and unsupported `expression` configurations fail the step. An existing field whose value is `null` remains `null`. Mappings do not execute JavaScript, SQL or arbitrary expressions. A step allows 1–100 output mappings, with bounded nesting and traversal.

### Current boundaries

External tool connectors are not operational through the shared engine yet. The step picker does not offer those connectors as executable actions. A saved legacy definition can still contain an unsupported step; saving it is not proof that it can run. Review its recorded execution result before relying on it.

Workflow runs do not automatically produce a signed proof bundle. Use the attestation flow separately when a signed record is required. Environment isolation and continued-run recovery are still part of the remaining enterprise acceptance work.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.