docs: add the document fetch routes to the anonymous list
Claude-Session: https://claude.ai/code/session_01FQH9CVk9jQNN4HsQqGQvUs
b354cd7
docs: record which protected routes allow anonymous reads
Claude-Session: https://claude.ai/code/session_01FQH9CVk9jQNN4HsQqGQvUs
4515597
docs: note where BCGW export freshness is shown
Claude-Session: https://claude.ai/code/session_01FQH9CVk9jQNN4HsQqGQvUs
b4efef6
docs: add BCGW project export page
The export had no page anywhere. It is pulled by DataBC, linked from no
EPIC frontend, and its column names are a contract with them.
Claude-Session: https://claude.ai/code/session_01FQH9CVk9jQNN4HsQqGQvUs
bed2710
docs: document Front Door test+prod edge, rulesbackend, ACCESS_GATE
Broaden Azure-Hosting-Cutover.md from prod-only to both eagle-edge
profiles: origin groups, the rulesbackend rule set (redirects,
rewrites, cache), custom domain/WAF state, and the
RouteConfigurationOverride/propagation gotchas. Add ACCESS_GATE and
CONTENT_SEARCH to the /api/config key table and document the access
gate. Fix the Reverse Proxy page's key count and cross-link.
Claude-Session: https://claude.ai/code/session_01SzJaJsq4NA8t4jS8gZs6hU
64ac08d
docs(helm-charts): add eagle-admin direct route
Claude-Session: https://claude.ai/code/session_01SzJaJsq4NA8t4jS8gZs6hU
069ce10
docs: eagle-api direct Route for Front Door
Second Route in dev/test bypasses rproxy so Front Door can reach eagle-api's own Service.
048648b
docs: correct rate-limit key source in API-Architecture
trust proxy is 'loopback, linklocal, uniquelocal', not the numeric
hop count this page described, and the Front Door path keys on
X-Azure-SocketIP, not the client IP nginx forwards.
Claude-Session: https://claude.ai/code/session_01SzJaJsq4NA8t4jS8gZs6hU
3efcf6d
docs: remove /api/demi/ rows from reverse proxy page
Claude-Session: https://claude.ai/code/session_01SzJaJsq4NA8t4jS8gZs6hU
cde6df3
docs: search served by DEMI in prod; eagle-search retired
Six pages corrected in place; diagrams and upstream tables now show the
sentinel for /eagle-search/.
792eab1
docs: eagle-search retired; search is DEMI's
Only the plan and the indexer identity remain, reused by DEMI.
8fde51c
docs: prod search served by demi-api
eagle-search stays only as the rollback target.
fafbc2d
docs: eagle-edge prod dispatch runs on the tag
Claude-Session: https://claude.ai/code/session_01Lv5nbmWMatCc8PzYmpupNb
f041508
docs: eagle-edge deploys from CI
Claude-Session: https://claude.ai/code/session_01Lv5nbmWMatCc8PzYmpupNb
9c876f6
docs: rewrite wiki to current state
Drop history, diaries, future plans and unverified claims. Delete
Search-Cutover (diary) and API-Deployment (DeploymentConfig era).
Every page verified against repos and live clusters, under 15 KB.
Claude-Session: https://claude.ai/code/session_012J1PYLGauUNovjJ1MMoKy5
9e283da
docs: preview removal is a hand helm uninstall now
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
c8e0884
docs: eagle-search archive record
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
09654c6
docs(azure): document the availability test on the cutover page
The previous commit referenced [[Availability monitoring]] three times and
no such page exists, so all three were dead links. Written as a section
instead: what the test proves and what it does not, that alerting is off
on purpose and how to turn it on, why public ingestion had to be opened
before results could land, the mutation that proved it can go red, and the
what-if Modify on the live origin that is an artifact rather than drift.
Also records why rproxy's own probes are deliberately left alone: a
readiness probe reaching through to Front Door would take /api, /admin/
and /eagle-search/ down during a Front Door outage.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
0036c58
docs(azure): the site is watched now, and Contributor cannot be granted
Two claims on the cutover page went stale within a day. The availability
test is no longer blocked and unshipped: it was deployed by hand on
2026-08-22 and probes the public hostname every 300 seconds from five
locations. It has no action group and no metric alert, deliberately, so
results are recorded and nobody is told — worth stating plainly, because
a watched-but-silent site reads as monitored.
The infra workflow's blocker was described as a missing grant. It is not
grantable: an ABAC condition on the c4b0a8 management group's Owner
assignment denies assigning Contributor, Owner, User Access Administrator,
RBAC Administrator and two custom roles by GUID. Anyone who reads the old
wording will go looking for someone to approve a request that no one in
this subscription can approve.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
3f0383c
docs: record the Azure hosting cutover as done
projects.eao.gov.bc.ca serves its Angular bundle from Azure Front Door as of
2026-08-21 23:43 UTC, eao-nginx v2.7.14, run 32537298295. rproxy still fronts
everything, so /api, /api/config, /admin/ and /eagle-search/ are unchanged and
same-origin.
Azure-Hosting-Cutover.md flips from runbook to record: what was executed (steps
1 and 5 only), what was not (no availability test, no test-side rehearsal, no
fresh bundle republish), and the two things the day taught.
The first Deploy to Prod failed on `dial tcp 142.34.194.119:6443: i/o timeout`
— the Silver API unreachable from GitHub runners, which happens periodically
and says nothing about the change. Rerunning the failed job succeeded. That
failure exposed a hazard worth keeping: Tag Image for Prod runs and succeeds
before the deploy job, and deploy/rproxy has an image trigger on rproxy:prod,
so the image can roll while Helm never applies. Benign this time only because
v2.7.13 and v2.7.14 differ in nothing the image contains.
Also recorded: the flash on first load is not Front Door. src/index.html is
byte-identical between v2.7.28 and the Azure branch, app-root is empty with no
SSR or splash, and ConfigService.init() awaits /api/config before first render.
Shell TTFB through rproxy measured 0.384-0.415s against 0.416-0.424s hitting
the endpoint directly, so the edge adds nothing.
Reverse-Proxy-Configuration.md and API-Architecture.md said `/` proxies to
eagle-public:8080. True in dev and test, no longer true in prod. API-Architecture
also listed /public as its own block; 5971894 deleted it and /lib, both of which
now reach location / and return the same body.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
7b19a29
docs: correct the cutover runbook and the config/search pages against prod
Production moved on 2026-08-20 and these three pages did not. Re-measured
2026-08-21 against the live site.
Azure-Hosting-Cutover.md carried two statements that would cause an outage if
followed. The rollback said "redeploy v2.7.12" — the deploy job's checkout has
no ref, so the chart renders from master while --set image.tag=prod picks the
image; redeploying an older tag rolls the image back and leaves the Front Door
value in place, which is the one broken combination. Correct rollback is
oc set env on NGINX__EPIC__PROXY__ROOT, ~30-60s, then revert values on master.
It also claimed proxy_cache globalcache "becomes dead weight" because Front
Door sends no Cache-Control; both halves are false, AFD delegates to the origin
and the origin sets the headers, so staleness is zero at both layers.
Four of its five blockers are closed and are now recorded as such: $web holds a
CI bundle, the blobs carry correct Cache-Control, /public and /lib are deleted
rather than repointed, and the security headers were reconciled. The open gap
is that no tag contains 5971894. Added the a01-not-z01 hostname trap, and six
findings that appeared in no document: no upstream keepalive, capacity
inverting onto two fixed proxies, assets/* shipping no-cache, dotted Angular
routes returning 404, www.projects.eao.gov.bc.ca following the flip unmentioned,
and the OpenShift pipeline staying runnable and gated by nobody.
Configuration-Management.md said test and prod still serve /api/config from the
rproxy ConfigMap. All three environments now serve it from eagle-api's Mongo
Config document; the ConfigMap is rendered, mounted and read by nobody. Also
four keys are dropped, not three — TYPESENSE_ENABLED was missing from the list.
Eagle-Search.md said SEARCH_API_PATH is still empty in prod so the estate is
indexed and dark. It is /eagle-search and the estate is live. Recorded that the
path also answers anonymously with document full text and each row's read[]
grants, that two of the four preconditions were never met, and that the live
index counts are 358/61,582/1,128,576 against the 368/62,474 recorded at
reindex time — unreconciled, both kept.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
760ec90
docs: eagle-admin stays on OpenShift — correct the migration scope
An earlier draft of this page listed eagle-admin as step 2 of the Azure
migration. It is not in scope at all: nothing in it is being ported and no Azure
estate is being built for it. The error came from reading "eventually the entire
eagle" as covering every frontend, which it does not.
Adds an explicit scope section — what "entire eagle in Azure" means and what it
does not — so the next reader does not re-derive the same wrong conclusion from
the same phrase. eagle-public moves; DEMI eventually becomes the API; eagle-admin
and eagle-api stay on OpenShift, the latter until DEMI replaces it.
Also drops the plural "static frontends", which implied both, and renumbers the
order plus the one step reference that pointed at it.
414362b
docs: add the Azure migration strategy, retire dead pages, fix stale search references
Adds Azure-Migration-Strategy, which sequences eagle-public and eagle-admin
ahead of any API work and records the fact that decides that order: rg-demi-prod
holds a search service and nothing else, while the 20 resources DEMI needs to be
an API exist only in c4b0a8-test. The corollary is that eagle-api should not be
ported to Azure at all, since DEMI is meant to replace it.
Deletes two pages documenting systems that do not exist. Typesense-Search
described operating an estate deleted on 2026-08-21. GitOps-ArgoCD-Deployment
described a deployment model that was never adopted: the argocd/ directory it
points at is absent from eagle-helper-pods, no workflow references it, and there
are no Application resources in the namespace.
Fixes the references those pages left behind, and others that survived the
cutover asserting Typesense was still live — a proxy controller, an Angular
service and an nginx location that have all been deleted, plus two Mermaid
diagrams. The one that would have caused real harm is in Project-Data-Models: it
instructed a lng/lat swap on sync, which was a Typesense requirement. Azure AI
Search takes GeoJSON order unchanged, so following it would corrupt every
centroid.
All wiki links resolve.
8519154
docs: record the Front Door purge role requirement
CDN Endpoint Contributor covers classic CDN endpoints only and fails an AFD
purge at every scope, with an error that reads like a scope problem. Names the
role that works and marks the purge step proven by a real run.
99291f9
docs: correct the cache-header diagnosis, and the unmatchable asset hash
The $nostore batch was never broken. A hand upload-batch at 01:21:35Z with no
--content-cache-control stripped every header; 46 of 48 blobs carry that
timestamp and a null cacheControl, and the two survivors are CI blobs whose
content-hashed names the hand upload did not reuse. The real defect is that
upload-batch exits 0 on a failed precondition and nothing read it back.
Also records that asset hashes cannot match production: the ancestry guard drags
in develop's @angular/core 21.2.20 against the release line's 21.0.8. Source
equality is the verifiable thing, not hash equality.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
a7a6e53
docs: Azure hosting cutover — 21 blockers from a read-only investigation
Moving eagle-public's HTML from OpenShift pods to Front Door is not the one-line
upstream change it looks like. Records the five preconditions (wrong bundle in
$web, missing Cache-Control that breaks rollback, /public left pointing at the
pod, a stale nginx branch, security headers regressing), the TLS directive set
that 502s if shipped partially, the 421 that Host $host guarantees, and the
resolve-once DNS risk that has a runbook rather than a fix.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
207dc03
docs(cutover): CUT OVER — prod search is eagle-search on DEMI's index
2026-08-21 06:10:51Z. Preceded by a 68-second flip-validate-revert rehearsal
that proved both directions. Records the post-flip verification, that count
changes are expected rather than defects, what the flip did not change (no
content search in prod, List stays on eagle-api), and the two clocks that start
now: eagle-search-prod deletable ~2026-09-04, and the Azure preview is redundant.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
b537d4b
docs(cutover): timeboxed flip on prod proved both directions in 68 seconds
Flip, validate, revert. Production's own bundle switched to eagle-search and
back; the revert was verified byte-identical against a pre-flip capture of
/api/config. Corrects the propagation figure to ~40s -- nginx never caches that
path because eagle-api sends cache-control: private and no proxy_cache_valid
exists. Records that eagle-api answers a zero-match search with an empty meta
array, which throws in checks that index meta[0].
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
14b0ccd
docs(cutover): configEndpoint=false drops five config keys, banner included
The preview rendered the "not final and subject to change" banner on real prod
data. env.js defines 10 keys, /api/config supplies 15, and BANNER_COLOUR ?? 'red'
turns an undefined into a visible banner rather than failing loudly. Records the
rule: any build with the runtime fetch off must transcribe the whole payload and
be diffed key-by-key before publishing. Also the ~20 minute Front Door purge lag.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
1cc9ed0
docs(cutover): keep the typesense branch preview — it carries wanted UI work
Source is on origin/feat/typesense-angular21 (3472fd9c), 207 lines over develop
in project-notifications-table-rows. Records that the branch rather than the
running pod is what matters, so a later sweep does not delete the wrong thing.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
88e2b93