docs: describe Track project poll
Track edits reach DEMI by a 5-minute poll with a nightly backstop. Replace the no-live-feed text.
docs: record ENGAGE sync guards for stray deletes
- An Eagle delete for a period DEMI does not hold is ignored.
- Comment fallback by eagleId takes only readable ENGAGE rows.
- Date formats the ingest accepts.
- Superseded last attempts, early failures and repair messages in
sync-out retries; move detection before the first send.
- The reconcile skipped bucket.
docs: update ENGAGE ingest codes, sync-out retries
- 409 is STALE_PUSH only; 422 and 500 codes, zone-less UTC dates,
required metURL.
- syncVersion replaces engagePushedAt as the sync-out version.
- The worker parks the last failure in the poison queue itself.
- Project moves, create guards, 180 s claim lease.
- Drop SYNC_OUT_MAX_ATTEMPTS, EAGLE_KC_ISSUER and
demiMissingInEngage; name the ENGAGE_API_BASE and
DEMI_ENGAGE_PRINCIPALS bicep params.
docs: add ADR-014 and ENGAGE sync-out
ENGAGE flows to DEMI, then to Eagle through eagle-api's HTTP API.
Add ADR-014, the ENGAGE rows reference, the sync-out section, the
ingest contract and the demi-sync-out client. Drop the statements
that nothing writes to Eagle.
docs: split Sync-Architecture, add mirror reference
Sync-Architecture.md was over the 15 KB page cap. It keeps the
explanation. Eagle-Mirror-Reference.md holds the mirrored kinds, the
refusal reasons and codes, the eagle-api parked retry, the drift
classes, the stored reconcile report and the migration re-push rule.
Anchor links on four pages repointed to the moved sections.
docs: split CI and Operating pages under 15 KB
docs: wire Eagle new-kind routes and search
docs: add Eagle new-kind mirrors and CSV reports
docs(sync): legacy Updates with empty read inherit the parent read
docs: cover Act block lookup and config shape check
- Sync-Architecture: the project merge finds legislation blocks by
the legislation_YYYY pattern, how it picks one, when it returns 400.
- ADR-012, Seeding: an allowlisted public config key can be dropped
by a shape check (EXTENDED_PROJECT_PAGES).
docs: state the compliance-only read fallback
docs: strip compliance, heal Eagle-origin seals
docs: Update read follows parent project or notification
docs: parent-admit reasons, fix demiPush route
- Sync-Architecture: document the parent-admit refusal warning and
its reason codes (missing, hidden, visible, unknown, malformed-ref)
- Environment-Reality: demiPush goes through the APIM machine API
with Ocp-Apim-Subscription-Key, not a direct Flex call; correct
DEMI_API_BASE to the /machine gateway path
docs: describe notify window and Eagle mirror gate
- Sync-Architecture: a push emails only updates inside the 7-day
notify window; older ones are mirrored but not emailed
- Connecting-an-Application-to-DEMI: /eagle/* needs
requireEagleMirror and DEMI_EAGLE_MIRROR_PRINCIPALS (default
apim:eagle-api); every other caller gets 403
Refs digitalspace/eagle-demi#448, digitalspace/eagle-demi#449
docs: describe Update fields, email and index rollout
docs: config mirrors on change, not seed-only
docs: add public-read backfill and repair page
Covers db:seed-public-reads stages and resumption, reconcile-eagle.js
misfiledParent vs unresolvedParent, the 429 backoff order, and the
eagle-api demi-repush.js script including the concurrency-4 APIM
throttle measured on test. Links it in from Sync-Architecture, ADR-011
and Connecting-an-Application-to-DEMI in place of the repo-doc pointer.
docs: add ADR-011 and the public read surface
Sync-Architecture gains the four mirrored kinds and the ACL cascade.
Search-Index-Reference lists the Cosmos-served datasets and proponentId.
docs: DEMI push key is DEMI_APIM_KEY
Claude-Session: https://claude.ai/code/session_015FCYoxrqNfUraeMnHdwChf
docs: test API is Flex, devbox replaces tunnel
demi-api-test and demi-plan-test are deleted; test API is demi-api-fc-test
(Flex) only. Dev access to Cosmos/Search moves to the devbox VM
(demi-devbox-test), replacing the App Service SSH tunnel in test. Prod keeps
its legacy app and tunnel until a prod devbox lands.
Claude-Session: https://claude.ai/code/session_01S8de7pb7tb7SQ2bdToXUto
docs: drop TODO.md pointers
docs: verify every page, split those over 15 KB
Every page checked against src/, azure/ and live Azure. History,
future state and duplicated facts removed. Search, Architecture,
Extraction and Azure ops pages split by topic. Track feed ask is
ADR-009 Proposed. EPIC.search worksheet reduced to the divergence
table.
Claude-Session: https://claude.ai/code/session_01Lv5nbmWMatCc8PzYmpupNb
docs: cascade defects closed by #139; seed invariant
Claude-Session: https://claude.ai/code/session_01TDxkDuFwqToL2SGimyuDCa
docs: write up the Track feed as an ask
Track ids are the master ids, and DEMI's Track data is a 382-record file
frozen on 2026-07-29, so the gap is a stale primary key space rather
than a stale side table — and eagle-public's test search already reads
DEMI, so it is user-facing now.
Records what has to come from whoever runs Track, in both directions,
and two things measured while writing it:
- the push contract already exists and has never been called. A DEMI
project id IS the Track project id, so PUT /api/projects/<id> is the
existing route. Track needs a key, not a build.
- the namespace question cannot be settled by DNS. The OpenShift domain
is a wildcard, so every candidate host resolves to the router and
answers 503 whether or not a route exists behind it.
docs: correct the record after the 2026-08-23 audit
Two new authority pages, because the direction changed and nothing described it:
Identity-Model (Track project ids are the master id; Eagle _id becomes an
attribute; an Eagle project with no Track counterpart is retained and flagged)
and Sync-Architecture (eagle-api pushes to DEMI on write, authenticated — not a
change-stream worker, not a poller — and why DEMI needs far less cascade than
eagle-search).
Dangerous corrections, called out rather than silently swapped:
- The backup window was overstated everywhere. demi-cosmos-test is Periodic,
240-minute interval, 8-hour retention — two restore points, not Continuous7Days.
Every 7-day claim came from demi-cosmos-dev, torn down 2026-08-11. chunks is
the only extracted copy and its restore path has never been tested.
- The project-unpublish cascade fires only on unpublish and overwrites read[]
rather than intersecting it, so an overwrite can widen a document's ACL. Both
recorded as open defects.
- ADR-004 listed three privileged roles; SECURE_ROLES has four since ADR-007
added demi-service-read.
Cost reconciled against Cost Management ActualCost: ~451 CAD/month on
c4b0a8-test-rg (Aug 16-22, 7 full days), not the ~47 ADR-008 carried, which
averaged two days of billing across twelve. budgetAmount is now below the run
rate.
Business-Rules and ADR-003 labelled aspirational — no classifier exists, no
configs/ directory, and orcsClassification is a passthrough of Eagle's field.
BR-04 is the exception: it ships as the read[] ACL.
Dev was torn down 2026-08-11, NRPTI was removed entirely, and the live index
names are projects/documents/chunks. Six pages still said otherwise.
.github/antigravity.md deleted — a stale duplicate of a dead agent's rules.