# LumisCare entity scrub (CareSafety/VCC/VCU/vivacare → LumisCare) — MC #103616

# LumisCare entity scrub — CareSafetyInnovations/VCC/VCU/vivacare → LumisCare

**Book:** System Architecture
**Status:** Complete + live-verified — MC #103616 (2026-06-16)
**Scope:** canonical lumiscare repo + 5 variant dirs (alpha–epsilon)

---

## Goal
CEO directive (legal-critical): remove EVERY reference to CareSafetyInnovations / VCC / VCU / vivacare and rename to LumisCare. Tokens VCC→LMC, CSS vcc-→lmc-, headers X-VCU-*→X-LMC-* (Organization-Id/User-Id/Roles), all at once incl live headers + bicep + ADO URLs, grep-to-zero. Guards: "Powered by Snowit" MUST stay; CareSafety boundary respected.

## Canonical (live demo) — done + verified live
- **Scrub** (branch scrub/103616-entity-scrub): commits 3f2b239e + 4af83f47 + f5447c9a (backend/infra/docs) + 79888de9 (frontend header unify + Snowit). Branding grep-to-zero (case-sensitive 0; case-insensitive 0 except the Spring framework word `WebMvcConfigurer`). Also unified a 3rd stray frontend header convention (X-LC-*) into X-LMC-*.
- **Verify** (Proveo static): no scrub-caused build regression (finance/scheduling/web-bff/mobile-bff/incidents failures proven pre-existing on base); 10 Spring config refactors behaviorally equivalent; X-LMC producer/consumer consistent, no orphan X-VCU.
- **Deploy** (manual, CI dead — billing #103695): 13 ACA services → image `scrub103616-f5447c9a`. 12/13 serving @100% (scheduling+finance needed an explicit traffic shift — they were Multiple-revision mode and the new revision sat at 0%). document-service excluded (pre-existing Kotlin build break → #103729). 3 SWA frontends redeployed FRESH after a first attempt shipped stale dist.
- **Live E2E auth regression** (Proveo headless MSAL, org Sunshine Home Care f714cc2f): login OK, real data across multiple services, direct BFF 7/7, ZERO 401/403 header-mismatch. Independent curl: live backoffice bundle `index-3E4TAd12.js` has X-LMC-Organization-Id, zero X-VCU, "Powered by Snowit" present.

## Variants (alpha–epsilon) — done
Non-git, non-deployed scratch copies. Text-only scrub (full rename map incl infra/domain/deep-link text), in place. Final grep: all 5 token-residual 0, brand 0. Binary `.playwright-mcp/*.pdf` test artifacts (containing a vivacareusa.com email) deleted across all 5.

## Key lessons
- **Lockstep traffic gap:** `az containerapp update --image` on a Multiple-revision-mode app creates the revision but does NOT shift traffic — must `az containerapp ingress traffic set`. Verify SERVING image via `[?properties.trafficWeight>\`0\`]`, not `[?active]`.
- **Stale-dist frontend deploy:** SWA deploy must rebuild fresh (rm dist) and the LIVE bundle hash must change + be re-grepped; "deploy 200" is not proof.
- **SWA CLI "StaticSitesClient metadata from remote" failure** = the CLI couldn't fetch its 69MB uploader binary; pre-caching to ~/.swa-cli/binary/ resolves it.
- **Don't over-scrub framework false-positives:** `WebMvcConfigurer` contains "vcc" case-insensitively but is a Spring class — exclude from grep-to-zero, don't refactor.
- **CareSafety boundary:** vcc-named Azure resources in bicep (crvccstagegeneral001 etc.) do NOT exist in our subscription = dead legacy text, safe to text-scrub without touching any client resource.

## Follow-on
#103729 document-service Kotlin build + deploy; #103730 RequestContextInterceptor dedup; #103733 SWA token rotation; #103695 CI billing (CEO).

---

## Addendum 2026-07-13 — Build-time dependency eliminated (MC #105528)

Scrub round 4 (final infrastructure remnant): identity-service je do danas pri **buildu** povlačio
OpenAPI spec s `dev.azure.com/caresafetyinnovations/VCC` (kroz `API-IDENTITY-SPEC-URL` pipeline
secret — nije bio hardkodiran u kodu, pa je promakao rundama 1-3).

**Fix (commit `0304b35d`, azdo/dev):** spec vendorovan u repo kao
`backend/services/identity-service/openapi-specs-identity-spec.yaml` (byte-identičan tracked
kanonskom `openapi-specs/identity-open-api/open-api.yaml`), Dockerfile prebačen na lokalni COPY,
`API_TOKEN_ARG`/`API_IDENTITY_SPEC_URL_ARG` build-argovi uklonjeni. CI fallback u
`deploy-backend.yml`/`azure-pipelines.yml` (koji je ovaj fajl oduvijek očekivao) sada je živ.

**Dokazi:** docker build --no-cache BUILD SUCCESSFUL bez ijednog poziva na dev.azure.com (4536-linijski
log grepovan na nulu); repo-wide `grep caresafetyinnovations` = 0 pogodaka van legal-boundary linije
u RUNBOOK.md. Peer verify PASS: `~/system/evidence/105528/peer-verify.md`.

**Napomena:** `X-VCU-*` header rename (270 fajlova) NIJE dio ovog zahvata — poseban ticket
(precedent #103770); spec je vendorovan as-is radi byte-vjernosti postojećem kanonskom fajlu.