docs: rewrite wiki to current state
Drop history, diaries, future plans and unverified claims. Delete
Search-Cutover (diary) and API-Deployment (DeploymentConfig era).
Every page verified against repos and live clusters, under 15 KB.
Claude-Session: https://claude.ai/code/session_012J1PYLGauUNovjJ1MMoKy5
9e283da
docs: preview removal is a hand helm uninstall now
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
c8e0884
docs: eagle-search archive record
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
09654c6
docs(azure): document the availability test on the cutover page
The previous commit referenced [[Availability monitoring]] three times and
no such page exists, so all three were dead links. Written as a section
instead: what the test proves and what it does not, that alerting is off
on purpose and how to turn it on, why public ingestion had to be opened
before results could land, the mutation that proved it can go red, and the
what-if Modify on the live origin that is an artifact rather than drift.
Also records why rproxy's own probes are deliberately left alone: a
readiness probe reaching through to Front Door would take /api, /admin/
and /eagle-search/ down during a Front Door outage.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
0036c58
docs(azure): the site is watched now, and Contributor cannot be granted
Two claims on the cutover page went stale within a day. The availability
test is no longer blocked and unshipped: it was deployed by hand on
2026-08-22 and probes the public hostname every 300 seconds from five
locations. It has no action group and no metric alert, deliberately, so
results are recorded and nobody is told — worth stating plainly, because
a watched-but-silent site reads as monitored.
The infra workflow's blocker was described as a missing grant. It is not
grantable: an ABAC condition on the c4b0a8 management group's Owner
assignment denies assigning Contributor, Owner, User Access Administrator,
RBAC Administrator and two custom roles by GUID. Anyone who reads the old
wording will go looking for someone to approve a request that no one in
this subscription can approve.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
3f0383c
docs: record the Azure hosting cutover as done
projects.eao.gov.bc.ca serves its Angular bundle from Azure Front Door as of
2026-08-21 23:43 UTC, eao-nginx v2.7.14, run 32537298295. rproxy still fronts
everything, so /api, /api/config, /admin/ and /eagle-search/ are unchanged and
same-origin.
Azure-Hosting-Cutover.md flips from runbook to record: what was executed (steps
1 and 5 only), what was not (no availability test, no test-side rehearsal, no
fresh bundle republish), and the two things the day taught.
The first Deploy to Prod failed on `dial tcp 142.34.194.119:6443: i/o timeout`
— the Silver API unreachable from GitHub runners, which happens periodically
and says nothing about the change. Rerunning the failed job succeeded. That
failure exposed a hazard worth keeping: Tag Image for Prod runs and succeeds
before the deploy job, and deploy/rproxy has an image trigger on rproxy:prod,
so the image can roll while Helm never applies. Benign this time only because
v2.7.13 and v2.7.14 differ in nothing the image contains.
Also recorded: the flash on first load is not Front Door. src/index.html is
byte-identical between v2.7.28 and the Azure branch, app-root is empty with no
SSR or splash, and ConfigService.init() awaits /api/config before first render.
Shell TTFB through rproxy measured 0.384-0.415s against 0.416-0.424s hitting
the endpoint directly, so the edge adds nothing.
Reverse-Proxy-Configuration.md and API-Architecture.md said `/` proxies to
eagle-public:8080. True in dev and test, no longer true in prod. API-Architecture
also listed /public as its own block; 5971894 deleted it and /lib, both of which
now reach location / and return the same body.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
7b19a29
docs: correct the cutover runbook and the config/search pages against prod
Production moved on 2026-08-20 and these three pages did not. Re-measured
2026-08-21 against the live site.
Azure-Hosting-Cutover.md carried two statements that would cause an outage if
followed. The rollback said "redeploy v2.7.12" — the deploy job's checkout has
no ref, so the chart renders from master while --set image.tag=prod picks the
image; redeploying an older tag rolls the image back and leaves the Front Door
value in place, which is the one broken combination. Correct rollback is
oc set env on NGINX__EPIC__PROXY__ROOT, ~30-60s, then revert values on master.
It also claimed proxy_cache globalcache "becomes dead weight" because Front
Door sends no Cache-Control; both halves are false, AFD delegates to the origin
and the origin sets the headers, so staleness is zero at both layers.
Four of its five blockers are closed and are now recorded as such: $web holds a
CI bundle, the blobs carry correct Cache-Control, /public and /lib are deleted
rather than repointed, and the security headers were reconciled. The open gap
is that no tag contains 5971894. Added the a01-not-z01 hostname trap, and six
findings that appeared in no document: no upstream keepalive, capacity
inverting onto two fixed proxies, assets/* shipping no-cache, dotted Angular
routes returning 404, www.projects.eao.gov.bc.ca following the flip unmentioned,
and the OpenShift pipeline staying runnable and gated by nobody.
Configuration-Management.md said test and prod still serve /api/config from the
rproxy ConfigMap. All three environments now serve it from eagle-api's Mongo
Config document; the ConfigMap is rendered, mounted and read by nobody. Also
four keys are dropped, not three — TYPESENSE_ENABLED was missing from the list.
Eagle-Search.md said SEARCH_API_PATH is still empty in prod so the estate is
indexed and dark. It is /eagle-search and the estate is live. Recorded that the
path also answers anonymously with document full text and each row's read[]
grants, that two of the four preconditions were never met, and that the live
index counts are 358/61,582/1,128,576 against the 368/62,474 recorded at
reindex time — unreconciled, both kept.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
760ec90
docs: eagle-admin stays on OpenShift — correct the migration scope
An earlier draft of this page listed eagle-admin as step 2 of the Azure
migration. It is not in scope at all: nothing in it is being ported and no Azure
estate is being built for it. The error came from reading "eventually the entire
eagle" as covering every frontend, which it does not.
Adds an explicit scope section — what "entire eagle in Azure" means and what it
does not — so the next reader does not re-derive the same wrong conclusion from
the same phrase. eagle-public moves; DEMI eventually becomes the API; eagle-admin
and eagle-api stay on OpenShift, the latter until DEMI replaces it.
Also drops the plural "static frontends", which implied both, and renumbers the
order plus the one step reference that pointed at it.
414362b
docs: add the Azure migration strategy, retire dead pages, fix stale search references
Adds Azure-Migration-Strategy, which sequences eagle-public and eagle-admin
ahead of any API work and records the fact that decides that order: rg-demi-prod
holds a search service and nothing else, while the 20 resources DEMI needs to be
an API exist only in c4b0a8-test. The corollary is that eagle-api should not be
ported to Azure at all, since DEMI is meant to replace it.
Deletes two pages documenting systems that do not exist. Typesense-Search
described operating an estate deleted on 2026-08-21. GitOps-ArgoCD-Deployment
described a deployment model that was never adopted: the argocd/ directory it
points at is absent from eagle-helper-pods, no workflow references it, and there
are no Application resources in the namespace.
Fixes the references those pages left behind, and others that survived the
cutover asserting Typesense was still live — a proxy controller, an Angular
service and an nginx location that have all been deleted, plus two Mermaid
diagrams. The one that would have caused real harm is in Project-Data-Models: it
instructed a lng/lat swap on sync, which was a Typesense requirement. Azure AI
Search takes GeoJSON order unchanged, so following it would corrupt every
centroid.
All wiki links resolve.
8519154
docs: record the Front Door purge role requirement
CDN Endpoint Contributor covers classic CDN endpoints only and fails an AFD
purge at every scope, with an error that reads like a scope problem. Names the
role that works and marks the purge step proven by a real run.
99291f9
docs: correct the cache-header diagnosis, and the unmatchable asset hash
The $nostore batch was never broken. A hand upload-batch at 01:21:35Z with no
--content-cache-control stripped every header; 46 of 48 blobs carry that
timestamp and a null cacheControl, and the two survivors are CI blobs whose
content-hashed names the hand upload did not reuse. The real defect is that
upload-batch exits 0 on a failed precondition and nothing read it back.
Also records that asset hashes cannot match production: the ancestry guard drags
in develop's @angular/core 21.2.20 against the release line's 21.0.8. Source
equality is the verifiable thing, not hash equality.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
a7a6e53
docs: Azure hosting cutover — 21 blockers from a read-only investigation
Moving eagle-public's HTML from OpenShift pods to Front Door is not the one-line
upstream change it looks like. Records the five preconditions (wrong bundle in
$web, missing Cache-Control that breaks rollback, /public left pointing at the
pod, a stale nginx branch, security headers regressing), the TLS directive set
that 502s if shipped partially, the 421 that Host $host guarantees, and the
resolve-once DNS risk that has a runbook rather than a fix.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
207dc03
docs(cutover): CUT OVER — prod search is eagle-search on DEMI's index
2026-08-21 06:10:51Z. Preceded by a 68-second flip-validate-revert rehearsal
that proved both directions. Records the post-flip verification, that count
changes are expected rather than defects, what the flip did not change (no
content search in prod, List stays on eagle-api), and the two clocks that start
now: eagle-search-prod deletable ~2026-09-04, and the Azure preview is redundant.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
b537d4b
docs(cutover): timeboxed flip on prod proved both directions in 68 seconds
Flip, validate, revert. Production's own bundle switched to eagle-search and
back; the revert was verified byte-identical against a pre-flip capture of
/api/config. Corrects the propagation figure to ~40s -- nginx never caches that
path because eagle-api sends cache-control: private and no proxy_cache_valid
exists. Records that eagle-api answers a zero-match search with an empty meta
array, which throws in checks that index meta[0].
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
14b0ccd
docs(cutover): configEndpoint=false drops five config keys, banner included
The preview rendered the "not final and subject to change" banner on real prod
data. env.js defines 10 keys, /api/config supplies 15, and BANNER_COLOUR ?? 'red'
turns an undefined into a visible banner rather than failing loudly. Records the
rule: any build with the runtime fetch off must transcribe the whole payload and
be diffed key-by-key before publishing. Also the ~20 minute Front Door purge lag.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
1cc9ed0
docs(cutover): keep the typesense branch preview — it carries wanted UI work
Source is on origin/feat/typesense-angular21 (3472fd9c), 207 lines over develop
in project-notifications-table-rows. Records that the branch rather than the
running pod is what matters, so a later sweep does not delete the wrong thing.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
88e2b93
docs(cutover): what "eagle-search" means, and which third of it is redundant
The name covers a frozen search service, a query API and a Mongo sync worker.
Only the first is dead weight, and its delete trigger is already set. Records
why the API (the anonymous ACL gate, plus the CSP constraint) and the worker
(the 6-second unpublish cascade) are not, and when the worker will be.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
073157e
docs(cutover): typesense workloads and 60Gi of PVCs removed; secrets remain
Prod release uninstalled and all six PVCs deleted across dev, test and prod --
twice the footprint prod alone suggested, since dev and test were carrying
orphans with no workload attached. Records that the teardown did NOT remove
secret/typesense-api-key or the plaintext key in cm/rproxy-config, and that
dev's copy is load-bearing: eagle-api-dev and eagle-demi-api hold secretKeyRefs
that gate pod start.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
b51d638
docs(helm): prod renders no Route, and a failed prod deploy still rolls the image
The chart examples here documented the exact configuration that broke eagle-api's
v2.10.64 prod deploy: base route.enabled true, and a prod values block setting
host projects.eao.gov.bc.ca. Corrected, and the reasoning written up next to the
Helm adoption section it explains -- the missing tls.certificate against
prod-external's Entrust cert, the ownership error, and the image trigger that
rolls production even when helm upgrade aborts.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
0c068af
docs(cutover): leak suite is 9 of 9 — cases 8 and 9 run by hand
Case 8 on test: unpublishing a one-document project withheld its child in ~6
seconds and republishing restored it, which is the cascade the ACL design rests
on since no projectIsPublished field exists. Case 9 read-only against prod: all
80 documents across all 17 ProjectNotifications are returned, none withheld.
Also records that eagle-admin tokens live 5 minutes, so the round-trip needs a
tiny fixture or a second token.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
aa29f91
docs(cutover): the Azure preview business is testing on, and the cleanup so far
Records how the dark estate was made to work standalone (Front Door passthrough
route with exact AND wildcard paths, a bundle with SEARCH_API_PATH baked in),
that it is pinned and does not follow prod's kill switch, and the teardown
checklist. Plus the route landmine fixed on both mainlines, typesense scaled to
zero in prod, and dev/test restored to the mainline builds.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
0799431
docs(cutover): eagle-public v2.7.28 in prod — v2.7.27 withdrawn over its route
The chart's prod route carries no TLS certificate while prod-external holds the
Entrust cert for the same host, so a second route with path "/" risked the
public site being served the router's default cert. Disabled for prod only;
dev and test keep theirs. All three prod deploys are now done.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
882556f
docs(cutover): eao-nginx v2.7.12 in prod — config moved, /eagle-search/ open
Clean rollout. Records the pre-set env trick that closes the crashloop window
between oc tag and helm upgrade, the config payload comparison, and the chunk
ACL shape — 'public' in read[], not read == ['public'].
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
e6fc6d1
docs(cutover): refresh the status table — gate green against prod, deploy 1 part done
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
22599a6
docs(cutover): eagle-api v2.10.64 in prod — image live, helm blocked on the route
The chart now wants a Route named eagle-api that prod already has under the
rproxy release, so helm upgrade aborts. The Deployment rolled anyway via its
OpenShift image trigger, which means a failed prod deploy here does not mean
prod is unchanged. The pre-upgrade migration hook never ran, so the Config seed
was run by hand; records the payload diff that gates the rproxy deploy.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
43ec3c4
docs(cutover): the leak gate is green — case 7 passed against prod
Case 7 pushes two chunks both claiming read:['public'], one under a public
parent and one under a withheld one, and asserts only the first becomes
queryable. Passed. Cleanup verified independently: zero rows for the marker,
the probe text and the probe id.
Suite now exits 0. Cases 8 and 9 remain manual and unrun.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
e45ecbf
docs(cutover): record the PUBLIC-124/125 hold and the ci-latest trap
Deploy to Test promotes ci-latest rather than building, so tagging a release
branch produces a git tag on the right commit and an image built from develop.
That would have shipped the held features to prod, and the workflow reports
success either way. Records the detection method and the rebuild recipe.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
5a5277a
docs(cutover): record the prod leak-gate run and why v2.7.11 was the wrong tag
The gate passed read-only against prod, and case 7 is what is left. Separately,
eao-nginx v2.7.11 does not carry the prod search upstream — it landed on master
after the tag — so deploying it would have 502'd every search at the flip.
v2.7.12 is cut, deployed to test and verified.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
021de42
docs: phase 2 done, and Eagle-Search was still written as dev-only
The backfill moved 1,128,733 chunks into prod with zero orphans, which was
the gate: a corpus extracted against Eagle test had to find its parents in
prod's document index, and every chunk did. Eagle-Search.md still said dev
only, named eagle-search-dev in c4b0a8-dev, and listed prod as not created.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
36d3887
docs: 1d is done — prod search queries demi-search-prod
Records the measured 70s dead window, the worker-at-0 ordering correction,
and the raw-index vs anonymous count distinction that reads as drift.
Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
369eb26