Platform Route Inventory 2026-06-12

Scope: production biof3.com nginx routes for /api/platform/*. Goal: make Dell a compute node and keep the platform control plane on ECS.

Source Of Truth

Production nginx file:

ECS /opt/biof3/app/nginx/biof3.conf

Repo copy:

infra/nginx/biof3.conf

The repo copy was refreshed from production on 2026-06-12.

Current /api/platform/* Routing

Public prefix	Upstream	Classification	Notes
/api/platform/analytics/	ECS :3011/api/analytics/	ECS control plane	POST /heartbeat and POST /page-view verified via public nginx and direct ECS.
/api/platform/public/	ECS :3011/api/public/	ECS control plane	Guest permissions verified via public nginx and direct ECS.
/api/platform/admin/cache/	ECS :3011/api/admin/cache/	ECS proxy to Dell internal ops	Migrated 2026-06-12. ECS authenticates admin users, then calls Dell with BIOF3_INTERNAL_TOKEN.
/api/platform/admin/	ECS :3011/api/admin/	ECS control plane / ECS internal ops proxy	Users, guest permissions, realtime stats, OSS stats, backup list, cache, disk, compute, and assets admin routes verified through ECS platform.
/api/platform/tools/	Narrow ECS cuts; final 404 fallback	Tools split complete for public nginx	Known first-party tools routes go through ECS platform. Dell remains execution/file host behind internal-token routes; unknown tools paths no longer proxy to Dell.
/api/platform/	ECS :3011/api/	ECS catch-all	Auth, AI, data API, admin non-exceptions.

Non-Platform Compute Routes

Public prefix	Upstream	Classification	Notes
/api/r/	Dell :3001/api/	R compute compatibility	Expected to remain Dell; legacy control-plane prefixes are denied before this catch-all.
/api/py/	Dell :3002/api/	Python compute compatibility	Expected to remain Dell. 2026-06-13 audit found no legacy control-plane exposure under this prefix.
`/api/r/(auth	admin	public	analytics

Verification Snapshot

Public probes on 2026-06-12:

Endpoint	Result	Meaning
/api/platform/public/guest-permissions	200	ECS public route works.
/api/platform/admin/users	200 with API token	ECS admin route works.
/api/platform/admin/oss/stats	200	ECS admin route can reach OSS.
/api/platform/admin/backup/list	200, engine:"postgres"	ECS admin route lists PostgreSQL dumps in OSS backups/postgresql/.
/api/platform/admin/cache/stats	200, Dell cache sizes	Public route hits ECS, which proxies to Dell internal ops.
/api/platform/tools/public-demo/deseq2	200, source:"asset"	Public route intentionally hits Dell.

Public probes on 2026-06-13:

Endpoint	Result	Meaning
/api/platform/admin/users	200, count=8	ECS admin users route works.
/api/platform/admin/guest-permissions	200, 8 permission keys	ECS admin guest-permission route works.
/api/platform/public/guest-permissions	200, 8 permission keys	ECS public guest-permission route works.
POST /api/platform/analytics/heartbeat	200, {"ok":true}	ECS analytics heartbeat route works.
POST /api/platform/analytics/page-view	200, {"ok":true}	ECS analytics page-view route works.
/api/platform/ai/admin/users-overview	200, users=8	ECS AI admin overview route works.
/api/platform/ai/admin/usage-stats?days=7	200, numeric usage aggregates	ECS AI usage route works.
/api/platform/feedback/admin?limit=5	200, feedback items	ECS feedback admin route works.
/api/platform/admin/realtime-stats	200	ECS realtime analytics admin route works.
/api/platform/admin/oss/stats	200	ECS OSS admin route works.
/api/platform/admin/backup/list	200, engine:"postgres"	ECS PostgreSQL backup list route works.

Direct upstream probes from ECS:

Direct URL	Result	Conclusion
127.0.0.1:3011/api/admin/cache/stats	200, near-empty dirs	ECS platform sees ECS disk, not Dell compute disk.
127.0.0.1:3001/api/admin/cache/stats	200, real Dell cache	Cache ops must remain Dell-backed until proxied internally.
127.0.0.1:3011/api/tools/public-demo/deseq2	200, source:"none"	ECS platform cannot read Dell demo assets.
127.0.0.1:3001/api/tools/public-demo/deseq2	200, asset files	Tools/demo files currently require Dell.

Direct ECS 127.0.0.1:3011 probes on 2026-06-13 also passed for:

• /api/admin/users
• /api/admin/guest-permissions
• /api/public/guest-permissions
• POST /api/analytics/heartbeat
• POST /api/analytics/page-view
• /api/ai/admin/users-overview
• /api/ai/admin/usage-stats?days=7
• /api/feedback/admin?limit=5
• /api/admin/realtime-stats
• /api/admin/oss/stats
• /api/admin/backup/list

Migration Classes

A. Already On ECS

• analytics
• public guest permissions
• admin users / guest permissions / OSS / backup / AI admin / usage endpoints via /api/platform/admin/
• auth / AI / data catch-all via /api/platform/

No action except keep regression probes.

B. Moved To ECS Platform With Internal Dell Ops

Target shape:

browser -> /api/platform/admin/cache/* -> ECS platform -> internal token -> Dell ops

Completed:

• /api/platform/admin/cache/stats
• /api/platform/admin/cache/cleanup
• /api/platform/admin/disk/stats
• /api/platform/admin/compute/health
• /api/platform/admin/assets/inspect

Requirements:

• BIOF3_INTERNAL_TOKEN is set on ECS and Dell.
• ECS platform authenticates the user/admin before calling Dell.
• Dell cache ops reject public calls without the internal token (BIOF3_REQUIRE_INTERNAL_CACHE_OPS=1).
• Public nginx direct route to Dell was removed for /api/platform/admin/cache/*.

C. Split Tools Into Control Plane And Compute Plane

Current /api/platform/tools/* uses explicit ECS-owned cuts. The broad public Dell gateway has been closed with a final 404 fallback.

Target ownership:

• ECS platform owns tool job creation metadata, history, names, public flags, permissions, and admin decisions.
• Dell owns actual R/Python execution and local result files.
• Public demo assets may remain on Dell disk, but ECS should expose them by internal proxy or by published asset manifest.

Subtasks:

• Inventory each /api/tools/* endpoint and classify as metadata, execution, or file serving. See docs/ops/TOOLS_ROUTE_SPLIT_PLAN_2026-06-12.md.
• Move metadata-only endpoints to ECS platform.
• Keep execution/file endpoints on Dell behind /api/r//api/py or an internal ops proxy.
• Preserve current public demo fallback behavior before changing nginx.

Current narrow cuts, 2026-06-12 / 2026-06-13:

• GET /api/platform/tools/history -> ECS platform.
• GET /api/platform/tools/status/:id -> ECS platform.
• POST /api/platform/tools/run -> ECS platform -> Dell internal.
• PUT /api/platform/tools/job/:id/name -> ECS platform.
• PUT /api/platform/tools/job/:id/public -> ECS platform.
• DELETE /api/platform/tools/job/:id -> ECS platform -> Dell internal.
• GET /api/platform/tools/public-demo/:toolId -> ECS platform -> Dell internal.
• GET /api/platform/tools/public-file/:jobId/:filename -> ECS platform -> Dell internal.
• GET /api/platform/tools/demo-data/:toolId/:filename -> ECS platform -> Dell internal.
• GET /api/platform/tools/demo/:toolId[/filename] -> ECS platform -> Dell internal.
• GET/PUT /api/platform/tools/file/:jobId/:filename -> ECS platform -> Dell internal.
• POST /api/platform/tools/cancel/:id -> ECS platform -> Dell internal.
• Unknown /api/platform/tools/* paths return 404 and do not proxy to Dell.

D. Retire Legacy /api/r/* Control Plane

These routes no longer map platform control-plane traffic to Dell: /api/r/(auth|admin|public|analytics|ai|data|feedback|pageview|error-report). They now return 404; modern clients use /api/platform/*.

Completed:

• Frontend and smoke tests were checked for /api/r/auth.
• 2026-06-13 Phase 5 probes found /api/r/admin/users, /api/r/public/guest-permissions, /api/r/ai/health, and /api/r/data/projects reachable through the R compute catch-all.
• Nginx now has a deny rule before /api/r/ so the R compute catch-all cannot proxy legacy platform control-plane routes to Dell.
• Verification after reload: platform routes and /api/r/health / /api/py/health return 200; legacy /api/r/* control-plane probes return 404.

E. Verify /api/py/* Is Compute-Only

Public probes on 2026-06-13 checked /api/py/auth/me, /api/py/admin/users, /api/py/public/guest-permissions, /api/py/analytics/heartbeat, /api/py/ai/health, /api/py/ai/admin/users-overview, /api/py/data/projects, /api/py/feedback/admin, /api/py/pageview, and /api/py/error-report. All returned 404.

Registered py-server public routes are compute/tool oriented: health, queue-status, upload, run, task, and tools/*. Tool probes matched expected auth behavior: history/status require login, public demo assets are available, and unknown tool paths return 404.

F. Final Phase 5 Acceptance

Non-destructive acceptance on 2026-06-13 passed:

• ECS platform, nginx, and biof3-pg were online.
• Dell biof3-r-server, biof3-r-worker, biof3-py-server, and biof3-py-worker were online as compute services.
• Public platform probes passed for health, auth, guest permissions, admin users, AI admin overview/usage, feedback admin, realtime stats, OSS stats, PostgreSQL backup list, compute/cache/disk/assets admin views, and tools history.
• /api/r/health and /api/py/health returned 200; legacy control-plane probes under /api/r/* and /api/py/* returned 404.
• biof3-pg used bind mount /opt/biof3-platform/pgdata, pg_isready passed, and table counts were users=8, projects=3, tasks=0, tool_jobs=2.
• Latest PostgreSQL dump pointed to daily backup biof3-pg.20260613_031001.sql.gz.

Next Recommended Work

1. Keep regression probes for each explicit platform route. Use npm run ops:smoke-platform after nginx, platform, route, auth, backup, or compute-boundary changes.
2. Continue demoting Dell runtime toward compute/worker-only operation.