AB#294553 Data egress to LDS

docker-compose.sandbox.yaml

@@ -27,6 +27,10 @@ services:
       - Dev__ToolsEnabled=${DEV_TOOLS_ENABLED:-true}
       - ASPNETCORE_URLS=http://+:8080
       - Notify__UseFake=${NOTIFY_USEFAKE:-true}
+      # This stack has no ZendeskSettings and no EgressStorage account; without opting into the
+      # dev outbox fake the app fails to start at all (AB#294553 review B1 made the real Zendesk
+      # client the default everywhere, including here).
+      - Zendesk__UseFake=true
       # Points at the sandbox db + azurite services on the sandbox network,
       # NOT the main stack's cypd_db / cypd_azurite. Kept literal so the
       # sandbox can never accidentally speak to the main-stack DB.

docker-compose.yaml

@@ -22,8 +22,12 @@ services:
       # Local dev has no GOV.UK Notify secret, so use the console fake (logs emails
       # instead of sending). Set NOTIFY_USEFAKE=false + supply Notify__ApiKey to send real emails.
       - Notify__UseFake=${NOTIFY_USEFAKE:-true}
+      # AB#294553 review B1: the code/appsettings default is now the real Zendesk client (matching
+      # the worker), so the local/E2E stack must opt in to the dev outbox fake explicitly here.
+      - Zendesk__UseFake=${ZENDESK_USE_FAKE:-true}
       - ConnectionStrings__Postgres=${POSTGRES_CONNECTION_STRING:-Host=db;Database=cypd;Username=postgres;Password=postgres}
       - ConnectionStrings__AzureStorage=${AZURE_STORAGE_CONNECTION_STRING:-DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite:10000/devstoreaccount1;QueueEndpoint=http://azurite:10001/devstoreaccount1;}
+      - ConnectionStrings__EgressStorage=${EGRESS_STORAGE_CONNECTION_STRING:-DefaultEndpointsProtocol=http;AccountName=egressaccount;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://azurite:10000/egressaccount;QueueEndpoint=http://azurite:10001/egressaccount;}
       - DfeSignIn__BaseUrl=${DFESIGNIN_BASEURL:-https://test-api.signin.education.gov.uk/}
       - DfeSignIn__ClientId=${DFESIGNIN_CLIENTID}
       - DfeSignIn__ApiClientSecret=${DFESIGNIN_APICLIENTSECRET}
@@ -196,7 +200,7 @@ services:
       - "10000:10000"  # Blob
       - "10001:10001"  # Queue
     environment:
-      - AZURITE_ACCOUNTS=devstoreaccount1:Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;ingressaccount:Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
+      - AZURITE_ACCOUNTS=devstoreaccount1:Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;ingressaccount:Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;egressaccount:Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==
     volumes:
       - azurite_data:/data
     command: azurite --blobHost 0.0.0.0 --queueHost 0.0.0.0 --location /data --debug /data/debug.log --skipApiVersionCheck

docs/add-pupil-journey.md

@@ -105,8 +105,8 @@ defensible to keep either way.
 
 ## LDS bound values
 
-These are a hard contract against the `LDS_CYPMD_Data specification v2.4` the future egress story
-reads from.
+These are a hard contract against the `LDS_CYPMD_Data specification v2.4` the egress story reads
+from. Consumed by `Application/Egress/EgressRecordBuilder.Build` since AB#294553.
 
 **Where the egress story will find them.** Not in a `RequestDocument`: `BuildAnswerRecord` and its
 `RawValue`/`Value` split only exist inside `RequestService.BuildRequestDocument`, which an Add

docs/architecture/c4-container.md

@@ -119,7 +119,8 @@ design for as-built:
 | Gov Notify integration | **Implemented** — `INotifyService` / `NotifyEmailClient`; notifications are dispatched from the Web app via `NotificationBackgroundService`. |
 | **Admin Portal** | **Not a separate app** — admin functionality currently lives **inside the Web Portal** (`Web/Admin/`, `AdminController`, `WindowAdmin`, `QueueAdmin`, `StorageAdmin`, `ShareAdmin`, `AdminRequests`, `PageTreeAdmin`). |
 | **Request Status Updater** | **Planned** — no time-triggered Zendesk-polling worker exists yet (the worker currently runs only `DlqRetentionJob` / `MetricsRetentionJob`). |
-| **Data Ingress / Egress Processing**, **LDS Interface Data Storage**, LDS exchange | **Planned** — the LDS pipeline is not implemented; pupil/school JSON in Data Blob Storage is currently produced by dev seeding (`SeedPupilData`). |
+| **Data Egress Processing** | **Implemented (AB#294553)** as an admin-driven run inside the web app; the worker container in the diagram is not used. Pull → Preprocess → Transfer at `/admin/egress` (`DfE.CheckPerformanceData.Web/Controllers/Egress/EgressController.cs`), see `docs/data-egress.md`. |
+| **Data Ingress Processing**, **LDS Interface Data Storage**, LDS exchange | **Planned** — the LDS ingress pipeline is not implemented; pupil/school JSON in Data Blob Storage is currently produced by dev seeding (`SeedPupilData`). |
 
 > Update this section as the LDS pipeline, a dedicated Admin Portal, and the
 > Request Status Updater are built out, or split the workers into separate