docs: 1d is done — prod search queries demi-search-prod Records the measured 70s dead window, the worker-at-0 ordering correction, and the raw-index vs anonymous count distinction that reads as drift. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: 1c is done — v0.2.0 on both halves of prod Worker promoted by digest with the previous one recorded for rollback, and resumed from its stored token rather than re-syncing. Service deployed by hand from main. Counts unchanged, prod /api/config still has no SEARCH_API_PATH. /health now names the search service, which is what makes 1d verifiable: prod reports eagle-search-prod today and must report demi-search-prod after the repoint. Records two operational facts: the workflow's OpenShift login failed once on a network timeout from the runner and a retry fixed it, and az does not hold a subscription across calls here. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: add the four guards the repoint pre-flight turned up Ran adversarially against the code and live Azure state. The repoint itself is safe — same subnet, same VNet, matching service capabilities — but four guards were missing from the runbook. The one that matters: full-sync freezes its project lookup before the schema loop, so an unpublish landing mid-refill writes the pre-unpublish ACL to every document under that project for the rest of the run. Scaling the worker to zero for the window is the fix, and it also covers the pushes that fail while the new service has no indexes yet. Also records why apply-indexes is self-verifying when the grant is scoped to the service, and that index-stats must read 0/0/0 afterwards. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: record the merges, v0.2.0 and the test leak-suite run Five PRs merged and v0.2.0 tagged at 729c93a, verified on test as digest sha256:67459d98. Records what 1c actually ships and why prod wants it — the resume-token freeze in particular, since an App Service restart is what 1d does and the deployed worker loses events on ingest failure. Also corrects the phase-0 counts. Test's index refilled on the 02:00 nightly reindex, so 3/809/28,607 was a partial state around the 1a rehearsal and is not a baseline; test now holds 346 / 55,822 / 1,128,253. The leak suite was run against that corpus: 6 pass, 0 fail, 3 skip. The private DNS zone group arrived by policy ~8 minutes after the deployment returned, which is worth knowing before the next endpoint is created. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: record phase 1b — demi-search-prod stood up Deployed into a new rg-demi-prod: the search service, its private endpoint and the Search Index Data Contributor grant for eagle-search-identity-prod. Nothing points at it and it holds no data. Notes the one part the template does not do: the landing zone attaches the private DNS zone group by policy, asynchronously, and until it lands the endpoint's name does not resolve inside the VNet — which would surface in phase 1d as a name-resolution failure rather than an auth one. Also replaces the unpushed-branches table with the open PRs. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: add a running record of the search cutover There are now three merged PRs, three unpushed branches, live changes in test and several findings that changed the plan — spread across five repos and two clouds. "Where did we get to" had no answer that did not involve reading a chat log. This page is that answer, and it is meant to be edited as steps land rather than written once: what is done with the evidence, what is next, what is deliberately out of scope, and how to roll back at each point. Two findings in it are the reason it exists at all. An app-setting change does not reach the running worker until the app is restarted, and for about a minute after a restart the app serves the OLD configuration and then nothing, while /health returns 200 the whole time. Anyone verifying a repoint inside that window sees the previous counts and reads it as success. Sidebar: promotes the record under Operations, drops the retired Typesense page from navigation, and points the repository list at eagle-search rather than the archived eagle-typesense. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: replace the Typesense local-dev instructions with what actually works The page told developers to `docker compose` a Typesense container, run `cd typesense-sync && node src/full-sync.js`, and `oc port-forward svc/typesense-typesense 8108:8108 -n 6cdc9e-dev`. Typesense was retired in August 2026: the Service, the sync job and the typesense-sync directory are all gone, so every one of those steps fails. There was no retirement banner. Replaced with the truth. There is no local eagle-search — the service is an Azure App Service and its index is behind a private endpoint — so pointing at a deployed environment is the only option, and it is enough now that proxy.conf.js forwards /eagle-search. Records why that rule matters, since without it search 404s while everything else works, and says plainly not to reach for the CORS allowlist instead. Also adds the kill switch to the troubleshooting path: SEARCH_API_PATH empty is deliberate, not a bug. Claude-Session: https://claude.ai/code/session_01AAAbob8wxD4iH1RRthhEvN
docs: rewrite the eagle-public preview section for the static estate The preview is blob storage behind Front Door as of 2026-08-14, not an App Service with basic auth. Records what replaced each piece (SPA rewrite rule, per-blob Cache-Control, CI identity now holding Storage Blob Data Contributor), states plainly that the passphrase gate is obfuscation rather than access control, and notes that the $web origin stays publicly reachable on this SKU. Also warns local devs off PREVIEW_GATE, which fails closed with no passphrase.
docs: bulk download design, async job not stream Public Download All builds the archive on the existing Agenda queue and serves it as a stored object. Sync streaming rejected: /api is proxy-cached, a stored object gets Range/resume, and a stream pins an API pod per client. Corpus measured against prod 2026-08-18: 61,605 docs, ~624 GB, worst project ~10 GB / 2,500 files.
docs: dev serves /api/config from the database Dev is cut over: eagle-api answers from a Config document, so a change there is a document edit. Test and prod still answer from the rproxy ConfigMap, where oc edit configmap remains the instant lever — the page now says which environment it is talking about in each place, having previously described one arrangement as if it were universal. Three corrections worth naming. Propagation in dev is up to ~2 minutes, not instant and not the ~60s implied by max-age alone: rproxy caches the response and the browser caches it again, and eao-nginx sets no proxy_cache_valid to shorten the first hop. The rollback is re-tagging the previous rproxy image, because the nginx template is baked in at build time. And the way to tell which source answered is Vary plus X-Content-Type-Options, which eagle-api sets and the alias does not — not the absence of an ETag, since Express sends a weak one on every JSON 200. Keycloak-Configuration's client-id section described the test/prod payload as universal. In dev, KEYCLOAK_CLIENT_ID is not in the served allowlist at all, so there is nothing to override; the preservation pattern is what makes both cases come out right.
docs: config failure is no longer survivable in admin Three passages said a failed /api/config always falls back to env.js. That is now true only for eagle-public — eagle-admin fails the boot instead, because its fallback would point staff at the dev identity provider. The env.js caching section also presented `location = /env.js` as the fix for the one-year cache. That match never fired in admin, whose requests arrive as /admin/env.js; the rule had to become a regex, which unlike an exact match is order-dependent.
docs: config endpoints merged, cutover pending
docs: config moves from rproxy ConfigMap to a database read Records the eagle-api and DEMI changes now in review, and the cutover order they depend on — chiefly that nginx's `location = /api/config` is an exact match that beats the /api proxy, so a Mongo edit does nothing, silently, until that block is deleted. Also corrects a claim this page has carried for a while: the /api/config fetch was described as non-blocking background work. It is awaited by the app initializer, so it blocks bootstrap for up to its 5s timeout. That matters more now the source is a database read rather than a static file. Adds a check for whether config actually arrived. The fetch fails silently and falls back to env.js, so a rendered page is not evidence, and ENVIRONMENT is useless as a probe because several pipelines bake it in.
docs(azure): CI pages, staging now c4b0a8-test Parallel-session drafts kept, repointed: -test names, env test/azure-test, immutable-ID OIDC subjects, dev teardown note.
docs: typesense is fully retired, not merely superseded The banner claimed the page was kept because the dev cronjobs were still running and eagle-api still carried the proxy. Neither is true: no Typesense workloads remain in 6cdc9e-dev, the repo is archived, and both integrations were removed in bbcc8d6 and 81843b3.
docs: correct SEARCH_API_PATH — /eagle-search on OpenShift, absolute on Azure rproxy rewrites /eagle-search/ to the service's /api/, so only the Azure preview carries the /api itself. The page claimed the value always ends in /api, which is true of one of the two deployments.
docs: eagle-search architecture, retire typesense pages Document-Content-Search described a Typesense collection filled by a nightly content-extract.js CronJob in eagle-typesense. That script was deleted when extraction moved to eagle-demi and Typesense has been replaced outright, so the page documented a pipeline that no longer exists. New Eagle-Search page carries the architecture, the twice-denormalised ACL cascade, content grouping, fuzzy matching and the eagle-public preview. Typesense-Search keeps a superseded banner rather than being deleted — its dev cronjobs are still running and eagle-api still carries the proxy code. Also includes the Project-Data-Models page and the Keycloak / Local-Development additions that were sitting uncommitted.
docs(list): add List collection architecture and PUBLIC-125 metadata documentation
chore: rename copilot to antigravity
docs: revert GHCR references in deployment documentation to reflect direct OpenShift registry usage
docs: document synchronous imagestreamtag import health checks
docs: add comprehensive GHCR scheduled import and push workflow integration documentation
docs(gitops): update GitOps deployment guide with AVV and AppProject requirements
docs(gitops): add argocd deployment guide and sidebar link
docs: add Swagger UI interactive endpoint to API Architecture
docs: update demi auth and api directory structure to reflect dual-layered security
docs: update ingestion flow diagram for Phase 1 DFL and DEMI
docs: add troubleshooting section for smoke test connection SSL failure
docs: update prod versions to api v2.10.42, rproxy v2.7.8, admin v2.5.7
docs: update gitignore