Post-cutover

• GET /api/v1/icpi/prices?page=1&pageSize=1
• GET /api/v1/icpi/suggest?query=cutover&region=GE&limit=5
• authenticated POST /api/v1/icpi/upsert
• GET /api/v1/icpi/latest/:itemCode?region=GE
• GET /api/v1/icpi/estimate?itemCode=:itemCode&quantity=2&region=GE
• unauthenticated POST /api/v1/icpi/upsert

Auth Observations

• existing dev impersonation still produced a valid access token through POST /api/v1/auth/dev/impersonate
• that token continued to work for gateway-protected ICPI writes after the cutover
• gateway write denial for missing bearer token stayed unchanged at 401 with reasonCode=missing_bearer_token
• no auth behavior change was required to complete the cutover

Response / Status Observations

Pre-cutover fallback window

• fallback gateway read route returned 200
• fallback gateway happy-path upsert returned 200
• fallback gateway latest read-back returned 200
• fallback gateway estimate returned 200
• fallback gateway missing-token write denial returned 401

Post-cutover window

• cutover gateway prices returned 200
• cutover gateway suggest returned 200
• cutover gateway happy-path upsert returned 200
• cutover gateway latest read-back returned 200
• cutover gateway estimate returned 200
• cutover gateway missing-token write denial returned 401

Write / Read-Back Observations

Window verification item:

• itemCode: ICPI_S52_MMUXY4ER

Fallback window write

Payload marker:

• sourceVersion=s52-fallback-window-start
• unitPrice=111.11

Observed:

• gateway write succeeded
• latest reflected sourceVersion=s52-fallback-window-start
• estimate reflected unitPrice=111.11 and total=222.22

Cutover window write

Payload marker:

• sourceVersion=s52-live-cutover
• unitPrice=112.22

Observed:

• gateway write succeeded
• direct new-host write response matched gateway write response exactly
• direct new-host latest matched gateway latest on normalized business fields
• gateway estimate reflected unitPrice=112.22 and total=224.44

Anomalies

No ICPI cutover anomaly was observed in the checked window.

The previously known separate auth-service caveat still exists:

• malformed but valid-signature non-UUID sub handling in /auth/me

That issue was not triggered by the cutover path used here and did not distort the ICPI observations.

Rollback Notes

Rollback was not needed during this cutover window.

Rollback remains ready via:

• keeping old ICPI hosting active in svc-tenders
• preserving TENDERS_SERVICE_URL=http://localhost:4020
• preserving explicit fallback startup via package.json dev:api:icpi-fallback

Rollback action remains:

1. stop gateway
2. restart gateway with fallback ICPI target

Current Recommendation

Stay on extracted svc-icpi for the gateway seam in the current environment.

The window checks support keeping the cutover in place while old colocated hosting remains available as a fallback safety net.