docs: verify every page, split those over 15 KB
Every page checked against src/, azure/ and live Azure. History,
future state and duplicated facts removed. Search, Architecture,
Extraction and Azure ops pages split by topic. Track feed ask is
ADR-009 Proposed. EPIC.search worksheet reduced to the divergence
table.
Claude-Session: https://claude.ai/code/session_01Lv5nbmWMatCc8PzYmpupNb
docs: search controller decisions, moved out of source comments
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
docs: correct the record after the 2026-08-23 audit
Two new authority pages, because the direction changed and nothing described it:
Identity-Model (Track project ids are the master id; Eagle _id becomes an
attribute; an Eagle project with no Track counterpart is retained and flagged)
and Sync-Architecture (eagle-api pushes to DEMI on write, authenticated — not a
change-stream worker, not a poller — and why DEMI needs far less cascade than
eagle-search).
Dangerous corrections, called out rather than silently swapped:
- The backup window was overstated everywhere. demi-cosmos-test is Periodic,
240-minute interval, 8-hour retention — two restore points, not Continuous7Days.
Every 7-day claim came from demi-cosmos-dev, torn down 2026-08-11. chunks is
the only extracted copy and its restore path has never been tested.
- The project-unpublish cascade fires only on unpublish and overwrites read[]
rather than intersecting it, so an overwrite can widen a document's ACL. Both
recorded as open defects.
- ADR-004 listed three privileged roles; SECURE_ROLES has four since ADR-007
added demi-service-read.
Cost reconciled against Cost Management ActualCost: ~451 CAD/month on
c4b0a8-test-rg (Aug 16-22, 7 full days), not the ~47 ADR-008 carried, which
averaged two days of billing across twelve. budgetAmount is now below the run
rate.
Business-Rules and ADR-003 labelled aspirational — no classifier exists, no
configs/ directory, and orcsClassification is a passthrough of Eagle's field.
BR-04 is the exception: it ships as the read[] ACL.
Dev was torn down 2026-08-11, NRPTI was removed entirely, and the live index
names are projects/documents/chunks. Six pages still said otherwise.
.github/antigravity.md deleted — a stale duplicate of a dead agent's rules.
docs(search): record the semantic ranker result and its limits
docs: correct four claims the #14 merge falsified
The index, indexer and data-source definitions are committed under
azure/search/. The note about them has now been wrong three times — first
claiming they were absent, then naming a branch that merged the same day — so
it states the durable fact and says not to re-qualify it with a branch name.
ADR-006's argument against agentic retrieval leaned on those definitions as
its example of state living only in the live service. Reworded rather than
dropped: knowledge base objects still have no export path, and the index is
now what the same problem looks like after someone does the work.
ADR-004 and the scoped-tier fix point at PR #15 / b7d61ae instead of a branch
that is merged and deletable.
docs(adr): record the AI summarizer decision, and the dead scoped tier
ADR-006: a small chat model summarises the top 8 chunks a normal BM25 search
already returned. Retrieval is untouched — the model never selects documents,
re-ranks, or rewrites the query.
Both built-in AI Search features were evaluated and rejected. Semantic answers
are extractive by definition, only fire on question-shaped queries, and read
from fields in a semantic config — but `content` is retrievable:false, which is
not a mutable property. Agentic retrieval answerSynthesis does generate
summaries, but the LLM is still ours: it changes who places the call, not
whether we provision the model, and it costs the BM25 boundary plus a
preview-only API to do it.
Two limitations recorded rather than hidden: the extra Cosmos round-trip that
retrievable:false forces, and the fact that the summariser inherits BM25's
recall ceiling with no probe able to catch a confident summary of the wrong
chunks.
ADR-004 gains the scoped-tier amendment — same class of failure it already
documents, found while scoping this — plus its stale access-sql path.
Search-and-Retrieval: the pipeline table, and a correction. The note claiming
azure/search/ was committed is true only on chore/finish-todo, not on main, so
TODO.md's entry still stands until that branch merges.
docs: record what the 2026-08-04 TODO sweep measured and changed
Search-and-Retrieval: added the n=78 scorecard row and the reason it is the same
number as n=71 -- same index, seven more tiled labels, no code change. Replaced
the label-debt paragraph with what paying it found: tiled retrieval is binary
(every hit ranks 1st, nothing at 2-10) and one miss is a pure ranking failure on a
document holding the phrase verbatim. Recorded that project and document
highlighting moved server-side, and why the client path survives.
Azure-Environments: main.bicep now describes the environment, verified by what-if
with zero creates and zero deletes. Listed the drift the rewrite surfaced -- a
SystemAssigned identity that was never real, a Y1 plan that was always B1, fifteen
app settings that existed only live, and a hand-made search role assignment.
Environment-Reality: the VNet section said main.bicep builds its own network. It
no longer does; subnet IDs are parameters into the platform spoke.
Architecture: syncState deleted from the live account, empty and unreferenced.
leases stays, with the reason.
docs(search): record the chunk-delete page cap and its fix
docs: rewrite wiki for the system that exists
Every page described an OpenShift + Typesense + MongoDB stack that was
deleted in July. Nothing mentioned Azure AI Search, Cosmos NoSQL, App
Service or BM25.
Deleted the five pitch-era pages plus Technical-Decisions and
Architecture-Overview: written to win funding, costed against a
$500-2000/mo strawman, and describing a plan rather than a build.
Salvaged the business framing into Home and the GIS decision into
Architecture.
Added Architecture, Search-and-Retrieval, Extraction-Pipeline, ADR-005
and Cosmos-Migration-Record, sourced from the repo's MIGRATION.md so the
facts have a home before that file goes. Moved the landing-zone notes in
from docs/.
Superseded ADR-001 and ADR-002 in place. ADR-002's premise never held
here at all: Cosmos Mongo API has no change streams.
Every environment claim re-checked against live Azure first. Three
corrections that came out of that: demi-api-dev is a Function App kind on
a B1 Basic plan, not Y1 Consumption; WEBSITE_RUN_FROM_PACKAGE is 0, not
1; and MinIO is real and current, not Typesense-era residue.