┌─────────────────────────────────────────────────────────────────────────────┐
│                           DEPLOYMENT PIPELINE                                │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  LOCAL                DEV                 TEST                PROD           │
│  ┌──────────┐        ┌──────────┐        ┌──────────┐        ┌──────────┐   │
│  │ Docker   │  push  │ Azure    │ manual │ Azure    │ manual │ Azure    │   │
│  │ Postgres │───────►│ Container│───────►│ Container│───────►│ Container│   │
│  │ + local  │  to    │ Apps     │ deploy │ Apps     │ deploy │ Apps     │   │
│  │ servers  │  main  │ (dev)    │        │ (test)   │        │ (prod)   │   │
│  └──────────┘        └──────────┘        └──────────┘        └──────────┘   │
│                                                                              │
│  Purpose:            Purpose:            Purpose:            Purpose:        │
│  - Development       - Auto-deploy       - Pre-prod          - Production   │
│  - Testing locally   - CI verification   - Prod clone        - Live users   │
│  - Offline work      - Feature testing   - Final QA          - Data source  │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘

# 1. Start local PostgreSQL
docker start motium-postgres
# Or: docker run --name motium-postgres -e POSTGRES_PASSWORD=postgres -p 5432:5432 -d postgres:16

# 2. Start backend services
cd motium-backend
uv sync
uv run python -m app.main  # All workers + API

# 3. Start Cortex
cd cortex/backend
uv sync
uv run uvicorn app.main:app --reload --port 8001

cd cortex/frontend
pnpm install
pnpm dev  # Port 3001

# MCP tool
query_local("SELECT COUNT(*) FROM cv")

# Or psql
psql postgresql://postgres:postgres@localhost:5432/motium

curl http://localhost:8000/health          # motium-backend
curl http://localhost:8001/health          # cortex-api
curl http://localhost:3001                 # cortex-web

git add -A
git commit -m "feat: description"
git push origin main
# CI/CD automatically deploys to dev

# Trigger specific workflow
gh workflow run cortex-backend-ci.yml

# Watch deployment progress
gh run watch --exit-status

# Authenticate first
az login

# MCP tool
query_dev("SELECT COUNT(*) FROM cv")

# Connection string for tools
postgresql://user@pg-motium-dev.postgres.database.azure.com:5432/motium

# Health checks
curl https://aca-motium-cortex-api-dev.lemonbay-8d9b5898.westeurope.azurecontainerapps.io/health
curl https://aca-motium-backend-dev.lemonbay-8d9b5898.westeurope.azurecontainerapps.io/health

# Container logs
az containerapp logs show --name aca-motium-cortex-api-dev --resource-group rg-motium-dev --tail 50

cd motium-backend

# 1. Check current state
uv run python -m app.cli.main status

# 2. Sync CVs and jobs from prod
uv run python -m app.cli.main pull-data --from prod --to test

# 3. Sync matches
uv run python -m app.cli.main sync-matches --from prod --to test

# Option 1: Deploy specific image from dev (test is in rg-motium-dev, NOT rg-motium-test!)
az containerapp update \
  --name aca-motium-cortex-api-test \
  --resource-group rg-motium-dev \
  --subscription sub-motium-applications-dev \
  --image acrmotiumprod.azurecr.io/cortex-api:$GIT_SHA

# Option 2: Build and deploy fresh
# (Create workflow with test environment if needed)
gh workflow run cortex-backend-ci.yml -f environment=test

# MCP tool
query_test("SELECT COUNT(*) FROM cv")

# Verify data parity with prod
query_test("SELECT status, COUNT(*) FROM cv GROUP BY status")
query_prod("SELECT status, COUNT(*) FROM cv GROUP BY status")

gh workflow run cortex-frontend-ci.yml -f environment=production

# Frontend - MUST use workflow (builds with prod secrets)
gh workflow run cortex-frontend-ci.yml -f environment=production
gh run watch --exit-status

# Backend API - can use az CLI (no build-time secrets)
# NOTE: CI already pushes images to acrmotiumprod for all envs.
# Use the FULL commit SHA as the image tag (CI uses github.sha).
gh workflow run cortex-backend-ci.yml -f environment=production
# OR manually with tested image (MUST specify --subscription for prod!):
az containerapp update \
  --name aca-motium-cortex-api-prod \
  --resource-group rg-motium-prod \
  --subscription sub-motium-applications-prod \
  --image acrmotiumprod.azurecr.io/cortex-api:$(git rev-parse HEAD)

# This will BREAK production - dev secrets baked in!
az containerapp update \
  --name aca-motium-cortex-web-prod \
  --resource-group rg-motium-prod \
  --image acrmotiumprod.azurecr.io/cortex-web:$DEV_SHA  # ← WRONG!

# This builds fresh image with production secrets
gh workflow run cortex-frontend-ci.yml -f environment=production
gh run watch --exit-status

## Pre-Prod Deployment Checklist

### Code Readiness
- [ ] All tests pass in CI
- [ ] Code reviewed and approved
- [ ] Linters pass with zero errors

### Verification
- [ ] Feature tested in dev environment
- [ ] Feature tested in test environment
- [ ] Performance acceptable under load
- [ ] No regressions in test

### Database
- [ ] Migrations tested in test environment
- [ ] Rollback plan documented (if migration)
- [ ] No destructive operations without backup

### Monitoring
- [ ] Logfire dashboard accessible
- [ ] Alert thresholds set
- [ ] Rollback procedure documented

### Communication
- [ ] Team notified of deployment
- [ ] Support aware of changes

# 1. Health checks (use FQDN - custom domain may have intermittent TLS issues)
curl https://aca-motium-cortex-api-prod.delightfulforest-1c770ae5.westeurope.azurecontainerapps.io/health
# Or try custom domain (may fail with SSL reset):
curl https://api.cortex.motium.ai/health

# 2. Smoke tests (manual or via Chrome MCP on cortex.motium.ai)
# - Login works
# - Dashboard loads
# - Data displays correctly

# 3. Monitor Logfire
# https://logfire.pydantic.dev/?project=cortex-prod

# 4. Check container health (MUST specify subscription)
az containerapp show --name aca-motium-cortex-api-prod \
  --resource-group rg-motium-prod \
  --subscription sub-motium-applications-prod \
  --query "properties.provisioningState"

# 5. Verify correct image is running
az containerapp show --name aca-motium-cortex-api-prod \
  --resource-group rg-motium-prod \
  --subscription sub-motium-applications-prod \
  --query "properties.template.containers[0].image" -o tsv

# 1. Get previous revision (MUST specify subscription for prod)
az containerapp revision list --name aca-motium-cortex-api-prod \
  --resource-group rg-motium-prod --subscription sub-motium-applications-prod \
  --query "[].name" -o tsv

# 2. Activate previous revision
az containerapp revision activate --name aca-motium-cortex-api-prod \
  --resource-group rg-motium-prod --subscription sub-motium-applications-prod \
  --revision <previous-revision>

# 3. Deactivate broken revision
az containerapp revision deactivate --name aca-motium-cortex-api-prod \
  --resource-group rg-motium-prod --subscription sub-motium-applications-prod \
  --revision <broken-revision>

# Full deployment pipeline example

# 1. LOCAL: Develop and test
cd motium-backend && uv run pytest
cd cortex/backend && uv run ruff check .

# 2. DEV: Push to deploy
git add -A && git commit -m "feat: new feature" && git push

# 3. Watch CI
gh run watch --exit-status

# 4. TEST: Sync data and deploy (test apps are in rg-motium-dev!)
uv run python -m app.cli.main pull-data --from prod --to test
az containerapp update --name aca-motium-cortex-api-test -g rg-motium-dev \
  --subscription sub-motium-applications-dev \
  --image acrmotiumprod.azurecr.io/cortex-api:$(git rev-parse HEAD)

# 5. PROD: Deploy after test validation (prod apps in rg-motium-prod, different subscription!)
az containerapp update --name aca-motium-cortex-api-prod -g rg-motium-prod \
  --subscription sub-motium-applications-prod \
  --image acrmotiumprod.azurecr.io/cortex-api:$(git rev-parse HEAD)

# 1. Azure AD Authentication
az login

# 2. Set your Azure email
export AZURE_USER_EMAIL="your.name@motium.ai"

# 3. Verify database access
cd motium-backend
uv run python -m app.cli.main status

uv run python -m app.cli.main status

============================================================
  PROD ENVIRONMENT
============================================================
CVs: 15,432
Jobs: 2,891
Matches: 847,293

============================================================
  DEV ENVIRONMENT
============================================================
CVs: 500
Jobs: 100
Matches: 5,000

# Full sync from prod to dev
uv run python -m app.cli.main pull-data --from prod --to dev

# Full sync from prod to test
uv run python -m app.cli.main pull-data --from prod --to test

# Incremental sync (only records updated since date)
uv run python -m app.cli.main pull-data --from prod --to dev --since 2025-01-01

# Dry run (preview without changes)
uv run python -m app.cli.main pull-data --from prod --to dev --dry-run

# Limit records per table
uv run python -m app.cli.main pull-data --from prod --to dev --limit 1000

# Downstream sync (prod to dev) - most common
uv run python -m app.cli.main sync-matches --from prod --to dev

# Downstream sync (prod to test)
uv run python -m app.cli.main sync-matches --from prod --to test

# Upstream sync (dev to prod) - use with caution!
uv run python -m app.cli.main sync-matches --from dev --to prod --target-label "reviewed-dev"

# Incremental sync
uv run python -m app.cli.main sync-matches --from prod --to dev --since 2025-01-15

# Dry run
uv run python -m app.cli.main sync-matches --from prod --to dev --dry-run

Matches: 150 synced, 20 skipped, 5 missing FK

# Generate matches for specific CVs
uv run python -m app.cli.main generate-matches \
    --cv-ids "abc123,def456" \
    --target-env cortex-dev

# Use custom model
uv run python -m app.cli.main generate-matches \
    --cv-ids "abc123" \
    --target-env cortex-dev \
    --model grok-4-1

cd motium-backend

# 1. Check current state
uv run python -m app.cli.main status

# 2. Preview what would sync
uv run python -m app.cli.main pull-data --from prod --to dev --dry-run

# 3. Sync CVs and jobs
uv run python -m app.cli.main pull-data --from prod --to dev

# 4. Sync matches (requires CVs/jobs to exist first!)
uv run python -m app.cli.main sync-matches --from prod --to dev

# 5. Verify
uv run python -m app.cli.main status

cd motium-backend

# 1. Full sync of CVs and jobs
uv run python -m app.cli.main pull-data --from prod --to test

# 2. Full sync of matches
uv run python -m app.cli.main sync-matches --from prod --to test

# 3. Verify data parity
uv run python -m app.cli.main status

# Sync only records updated in the last 7 days
uv run python -m app.cli.main pull-data --from prod --to dev --since $(date -d '7 days ago' +%Y-%m-%d)
uv run python -m app.cli.main sync-matches --from prod --to dev --since $(date -d '7 days ago' +%Y-%m-%d)

# Label these as coming from dev review
uv run python -m app.cli.main sync-matches \
    --from dev --to prod \
    --target-label "reviewed-dev-2025-01"

export AZURE_USER_EMAIL="your.name@motium.ai"

uv run python -m app.cli.main pull-data --from prod --to dev
uv run python -m app.cli.main sync-matches --from prod --to dev

SELECT source_match_id, source_environment, COUNT(*)
FROM motium.match
WHERE source_match_id IS NOT NULL
GROUP BY source_match_id, source_environment;

# Check workflow run
gh run view --log-failed

# Check container status
az containerapp show --name $APP_NAME --resource-group $RG --query "properties.provisioningState"

# Check container logs
az containerapp logs show --name $APP_NAME --resource-group $RG --tail 100

# Refresh Azure credentials
az login

# Check identity permissions
az role assignment list --assignee $(az identity show -n $IDENTITY_NAME -g $RG --query principalId -o tsv)

# Check database health via MCP
db_health("dev")  # or test, prod

# Verify Azure AD token
az account get-access-token --resource-type oss-rdbms

# Compare environments
query_dev("SELECT COUNT(*) FROM cv")
query_test("SELECT COUNT(*) FROM cv")
query_prod("SELECT COUNT(*) FROM cv")

# Sync if needed
uv run python -m app.cli.main pull-data --from prod --to test