docs: add document intake and ADR-015
Describe the upload link, Defender malware scan, scan cap and rollout. Update the Defender state of the storage accounts.
docs: note Defender for Storage override in Bicep
docs: repoint two CI links, fix identity count
docs: split CI and Operating pages under 15 KB
docs: add EDGE_GATE modes and log query
docs: record Defender for Storage off on test
Defender for Storage is off on the 10 test storage accounts by a
per-account override set by hand. It is not in Bicep, so a new
account gets the subscription default.
docs: fix budget sentence wording
docs: test budget is 550 CAD
docs: describe React frontend in place of Angular
Add a build and test section to Frontend.
docs: chunk ingest guards and Cosmos RU alert
Record the 413 chunk cap, the 409 repeated-failure guard, skip of unchanged chunks, the new page-number rule, and the Cosmos RU and ingest-failure alerts added after the 2026-09 test Cosmos cost incident.
docs: describe foundation/app infra deploy split
docs: add Secret-Sync page, point Azure-Environments at it
docs: eagle-demi-admin prod estate is live
Document the Front Door edge secret and caller address derivation
docs: admin audit, analytics and cost reads
Claude-Session: https://claude.ai/code/session_01Ezmn3K1pC5YmxD9GQxUVLJ
docs: fix wiki for Flex-only API, no legacy app
docs: prod devbox live; B2s and run-command traps
Claude-Session: https://claude.ai/code/session_015gWZJYVSktHHjf2EQetpan
docs: test API is Flex, devbox replaces tunnel
demi-api-test and demi-plan-test are deleted; test API is demi-api-fc-test
(Flex) only. Dev access to Cosmos/Search moves to the devbox VM
(demi-devbox-test), replacing the App Service SSH tunnel in test. Prod keeps
its legacy app and tunnel until a prod devbox lands.
Claude-Session: https://claude.ai/code/session_01S8de7pb7tb7SQ2bdToXUto
docs: document per-user data feature
docs: prod API gateway and estate state
docs: record demi-apim-test gateway
docs: fix prod-search route and cost-ceiling facts
Prod search flipped to /demi-search when eagle-search retired; Home,
Sources-and-Status, and Environment-Reality-and-Operational-Gotchas
still pointed at the old /eagle-search route.
Azure-Environments: RG-scoped demi-ceiling-prod was deleted, replaced
by management-group-scoped epic-ceiling; added the prod reconcile
timer, its alert, and the search availability webtest to the
resource table.
Connecting-an-Application-to-DEMI: added the demi-service-write role
and named the credential eagle-api's mirror push actually uses.
docs: verify every page, split those over 15 KB
Every page checked against src/, azure/ and live Azure. History,
future state and duplicated facts removed. Search, Architecture,
Extraction and Azure ops pages split by topic. Track feed ask is
ADR-009 Proposed. EPIC.search worksheet reduced to the divergence
table.
Claude-Session: https://claude.ai/code/session_01Lv5nbmWMatCc8PzYmpupNb
docs: point at Eagle-Search-Archive for the test migration record
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
docs: correct the record after the 2026-08-23 audit
Two new authority pages, because the direction changed and nothing described it:
Identity-Model (Track project ids are the master id; Eagle _id becomes an
attribute; an Eagle project with no Track counterpart is retained and flagged)
and Sync-Architecture (eagle-api pushes to DEMI on write, authenticated — not a
change-stream worker, not a poller — and why DEMI needs far less cascade than
eagle-search).
Dangerous corrections, called out rather than silently swapped:
- The backup window was overstated everywhere. demi-cosmos-test is Periodic,
240-minute interval, 8-hour retention — two restore points, not Continuous7Days.
Every 7-day claim came from demi-cosmos-dev, torn down 2026-08-11. chunks is
the only extracted copy and its restore path has never been tested.
- The project-unpublish cascade fires only on unpublish and overwrites read[]
rather than intersecting it, so an overwrite can widen a document's ACL. Both
recorded as open defects.
- ADR-004 listed three privileged roles; SECURE_ROLES has four since ADR-007
added demi-service-read.
Cost reconciled against Cost Management ActualCost: ~451 CAD/month on
c4b0a8-test-rg (Aug 16-22, 7 full days), not the ~47 ADR-008 carried, which
averaged two days of billing across twelve. budgetAmount is now below the run
rate.
Business-Rules and ADR-003 labelled aspirational — no classifier exists, no
configs/ directory, and orcsClassification is a passthrough of Eagle's field.
BR-04 is the exception: it ships as the read[] ACL.
Dev was torn down 2026-08-11, NRPTI was removed entirely, and the live index
names are projects/documents/chunks. Six pages still said otherwise.
.github/antigravity.md deleted — a stale duplicate of a dead agent's rules.
docs: record the frontend move from App Service to blob + Front Door
The frontend App Service and its dedicated B1 plan were deleted 2026-08-14; the
bundle is now blobs in $web behind a shared Front Door Standard profile that
lives in eagle-search, not here. Covers the deploy path (upload-batch, per-blob
Cache-Control, headers moved to the AFD rule set), the two manual steps no
template can do, and why Static Web Apps was never available on this landing
zone.
docs(env): generic module names in tree
docs(env): staging now c4b0a8-test
Dev estate torn down 2026-08-11; hosts repointed, greenfield traps noted.
docs: record the working deploy path and the three traps around it
Measured 2026-08-05, after a deploy that took forty-five minutes and produced
a stuck lock, a failed OneDeploy and two container recycles.
The CLI's exit code is not the deployment's outcome; the record is the only
authority, and a 504 on upload is normal here rather than failure. Never use
/api/publish — it forces an Oryx remote build against a VNet with no route to
the package registry, and ignores both build-disabling app settings. A stalled
deploy leaves a lock that stop/start does not clear, because the app restart
does not recycle the SCM site.
Also notes that deploys merge and nothing prunes, which is how the frontend
reached 19 hashed bundles against 3 referenced, and why src/scripts must not
be confused with root scripts.
docs: record what the 2026-08-04 TODO sweep measured and changed
Search-and-Retrieval: added the n=78 scorecard row and the reason it is the same
number as n=71 -- same index, seven more tiled labels, no code change. Replaced
the label-debt paragraph with what paying it found: tiled retrieval is binary
(every hit ranks 1st, nothing at 2-10) and one miss is a pure ranking failure on a
document holding the phrase verbatim. Recorded that project and document
highlighting moved server-side, and why the client path survives.
Azure-Environments: main.bicep now describes the environment, verified by what-if
with zero creates and zero deletes. Listed the drift the rewrite surfaced -- a
SystemAssigned identity that was never real, a Y1 plan that was always B1, fifteen
app settings that existed only live, and a hand-made search role assignment.
Environment-Reality: the VNet section said main.bicep builds its own network. It
no longer does; subnet IDs are parameters into the platform spoke.
Architecture: syncState deleted from the live account, empty and unreferenced.
leases stays, with the reason.