docs: frontend reads go to DEMI native routes
docs: document streaming is on prod
Front Door route demi-documents, legacy link redirects and the widened scraper rule run on test and prod. Prod APIM still buffers responses.
docs: document stream links at the edge
Legacy document rules send inline=1 only. New route demi-documents caches public files. Rule demidocumentinline rewrites links that still carry redirect=1&inline=1. Deploy the edge after DEMI.
docs: list legacy paths instead of a table
docs: describe legacy document link redirects
The edge redirects the four legacy eagle-api document link shapes to
the DEMI download with inline=1, so pdf and images open in the browser
and a #page fragment is kept.
docs: describe the read-only public site on DEMI
The Angular public site reads from DEMI only and takes no comments. Remove the rproxy and pod steps that no longer apply, and point the local proxy and config examples at /demi-search/config.
docs: describe DEMI-only reads for eagle-public
Since eagle-public v2.8.0 the public site reads everything from
DEMI and an empty SEARCH_API_PATH no longer falls back to
eagle-api. Add the release steps for the Angular line.
docs(eagle-search): describe project notification detail page
docs: note /updates/:id route on eagle-public
docs: add unified search routes to react line
docs: eagle-public reads served by DEMI
docs: eagle-search retired; search is DEMI's
Only the plan and the indexer identity remain, reused by DEMI.
docs: prod search served by demi-api
eagle-search stays only as the rollback target.
docs: rewrite wiki to current state
Drop history, diaries, future plans and unverified claims. Delete
Search-Cutover (diary) and API-Deployment (DeploymentConfig era).
Every page verified against repos and live clusters, under 15 KB.
Claude-Session: https://claude.ai/code/session_012J1PYLGauUNovjJ1MMoKy5
docs: correct the cutover runbook and the config/search pages against prod
Production moved on 2026-08-20 and these three pages did not. Re-measured
2026-08-21 against the live site.
Azure-Hosting-Cutover.md carried two statements that would cause an outage if
followed. The rollback said "redeploy v2.7.12" — the deploy job's checkout has
no ref, so the chart renders from master while --set image.tag=prod picks the
image; redeploying an older tag rolls the image back and leaves the Front Door
value in place, which is the one broken combination. Correct rollback is
oc set env on NGINX__EPIC__PROXY__ROOT, ~30-60s, then revert values on master.
It also claimed proxy_cache globalcache "becomes dead weight" because Front
Door sends no Cache-Control; both halves are false, AFD delegates to the origin
and the origin sets the headers, so staleness is zero at both layers.
Four of its five blockers are closed and are now recorded as such: $web holds a
CI bundle, the blobs carry correct Cache-Control, /public and /lib are deleted
rather than repointed, and the security headers were reconciled. The open gap
is that no tag contains 5971894. Added the a01-not-z01 hostname trap, and six
findings that appeared in no document: no upstream keepalive, capacity
inverting onto two fixed proxies, assets/* shipping no-cache, dotted Angular
routes returning 404, www.projects.eao.gov.bc.ca following the flip unmentioned,
and the OpenShift pipeline staying runnable and gated by nobody.
Configuration-Management.md said test and prod still serve /api/config from the
rproxy ConfigMap. All three environments now serve it from eagle-api's Mongo
Config document; the ConfigMap is rendered, mounted and read by nobody. Also
four keys are dropped, not three — TYPESENSE_ENABLED was missing from the list.
Eagle-Search.md said SEARCH_API_PATH is still empty in prod so the estate is
indexed and dark. It is /eagle-search and the estate is live. Recorded that the
path also answers anonymously with document full text and each row's read[]
grants, that two of the four preconditions were never met, and that the live
index counts are 358/61,582/1,128,576 against the 368/62,474 recorded at
reindex time — unreconciled, both kept.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: add the Azure migration strategy, retire dead pages, fix stale search references
Adds Azure-Migration-Strategy, which sequences eagle-public and eagle-admin
ahead of any API work and records the fact that decides that order: rg-demi-prod
holds a search service and nothing else, while the 20 resources DEMI needs to be
an API exist only in c4b0a8-test. The corollary is that eagle-api should not be
ported to Azure at all, since DEMI is meant to replace it.
Deletes two pages documenting systems that do not exist. Typesense-Search
described operating an estate deleted on 2026-08-21. GitOps-ArgoCD-Deployment
described a deployment model that was never adopted: the argocd/ directory it
points at is absent from eagle-helper-pods, no workflow references it, and there
are no Application resources in the namespace.
Fixes the references those pages left behind, and others that survived the
cutover asserting Typesense was still live — a proxy controller, an Angular
service and an nginx location that have all been deleted, plus two Mermaid
diagrams. The one that would have caused real harm is in Project-Data-Models: it
instructed a lng/lat swap on sync, which was a Typesense requirement. Azure AI
Search takes GeoJSON order unchanged, so following it would corrupt every
centroid.
All wiki links resolve.
docs: phase 2 done, and Eagle-Search was still written as dev-only
The backfill moved 1,128,733 chunks into prod with zero orphans, which was
the gate: a corpus extracted against Eagle test had to find its parents in
prod's document index, and every chunk did. Eagle-Search.md still said dev
only, named eagle-search-dev in c4b0a8-dev, and listed prod as not created.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: rewrite the eagle-public preview section for the static estate
The preview is blob storage behind Front Door as of 2026-08-14, not an App
Service with basic auth. Records what replaced each piece (SPA rewrite rule,
per-blob Cache-Control, CI identity now holding Storage Blob Data Contributor),
states plainly that the passphrase gate is obfuscation rather than access
control, and notes that the $web origin stays publicly reachable on this SKU.
Also warns local devs off PREVIEW_GATE, which fails closed with no passphrase.
docs(azure): CI pages, staging now c4b0a8-test
Parallel-session drafts kept, repointed: -test names, env test/azure-test, immutable-ID OIDC subjects, dev teardown note.
docs: correct SEARCH_API_PATH — /eagle-search on OpenShift, absolute on Azure
rproxy rewrites /eagle-search/ to the service's /api/, so only the Azure
preview carries the /api itself. The page claimed the value always ends in
/api, which is true of one of the two deployments.
docs: eagle-search architecture, retire typesense pages
Document-Content-Search described a Typesense collection filled by a nightly
content-extract.js CronJob in eagle-typesense. That script was deleted when
extraction moved to eagle-demi and Typesense has been replaced outright, so
the page documented a pipeline that no longer exists.
New Eagle-Search page carries the architecture, the twice-denormalised ACL
cascade, content grouping, fuzzy matching and the eagle-public preview.
Typesense-Search keeps a superseded banner rather than being deleted — its
dev cronjobs are still running and eagle-api still carries the proxy code.
Also includes the Project-Data-Models page and the Keycloak / Local-Development
additions that were sitting uncommitted.