[dwolfson]

Follows #625 (merged).

Rename

• The page title, header, breadcrumb, Portal tile and messages now say Resource Locator.
• The page now also answers at /resource-locator, and the Portal tile points there. /resource-browser still works, so existing links and saved favourites keep working. Links inside the page stay on whichever path it was opened from. Apache <Location> rules added for quickstart (proxy-locations.conf) and freshstart (fastapi-ssl.conf).
• The /api/resource-browser/... paths are unchanged.

Resource Explorer account (quickstart secrets)

• New resourceexplorernpa digital account in coco-user-directory.omsecrets (omagServer, governanceEngine and serverOperator groups), plus a Resource Explorer token entry in egeria-servers.omsecrets.
• Also adds exchange-quickstart/coco-dags/data/dts_2026-09-29.csv, a public US Treasury Daily Treasury Statement extract used by the coco-dags.

Private notes: on, in a secured zone

• Endpoints: GET/POST /resource/{guid}/private-notes. A private note is an entry in the user's own My Profile journal (journal-my-activity), tied to the resource through additionalProperties.resourceGUID. The Notes card has an "everyone / only me" choice.
• journal-my-activity zones each entry ['<userId>'] only, and ignores initialClassifications. A userId zone only grants access (validateZoneAccess ignores zones that aren't secured), so on its own it hides nothing. The handler therefore re-zones each new entry to ['resource-explorer-private', '<userId>'], borrowing Resource Explorer's secured zone, which is defined in both the quickstart and freshstart user directories.
• Verified on quickstart with direct REST (JournalEntry 8bec72e4): erinoverview reads it; peterprofile and garygeeke get 403 OPEN-METADATA-SECURITY-403-020 by GUID and no hits from feedback-manager search.
• Each entry is then linked to its resource with an Actions relationship (resource = actionCause, end 1; JournalEntry, an Action subtype, end 2), as the Egeria team suggested. journal-my-activity can't take a cause, so the link is a Metadata Expert related-elements call. The user's own journal listing now shows what each entry is about. A resource's private notes are read through Asset Maker's elements/{guid}/sponsored/actions (the user's own JournalEntries only), with no full journal scan. That needs activity_status_list=None: pyegeria's default of IN_PROGRESS silently drops journal entries. Verified live: test entry 8bec72e4 was linked to "categories" (link e853edac). Erin sees it from the resource and in her journal with its cause; Peter and Gary get nothing.
• If the link fails, the API returns 502: the note is saved and private but won't show on the resource.
• The Egeria team has acknowledged a security-zone bug (work starts 2026-10-14). The re-zone step stays until that fix is verified (BACKLOG RL-1).
• If the re-zone fails, the API returns 502 and says the note was saved but is not private. Each private note now reports zones and protected. Older entries with only the userId zone are shown as "other people can read it".
• Delete is off: DELETE /private-notes/{note} returns 501. Egeria can't delete a journal entry: the asset delete and the Metadata Expert delete both give 400-008 (egeria-python ISSUE-146).
• BACKLOG RL-1: when Egeria's journal fix lands, review the borrowed zone, re-enable delete, and clean up the test entries 8bec72e4 and fef83ed5.

Fix: Egeria Explorer's REST APIs view failed intermittently

• /api/rest-apis fetched the platform's OpenAPI spec with the browser's X-Egeria-Token. When that token had expired and the spec cache was cold (after its one-hour TTL or an app restart), Egeria answered 401 on every path and the endpoint returned 502. egeriaFetch renews only on a 401, so the view stayed broken.
• The spec is the same for every user, so the fetch now retries once with the server's own login on a 401. Failures are logged as warnings, and the 502 detail lists what each path answered. Reproduced with a cleared cache and an invalid token: 502 before, 200 after. Mirrored to freshstart.

Dr.Egeria templates

• templates/basic and templates/advanced synced from egeria-python (c338bbb0, PR chore(deps): Bump dagster-postgres from 0.29.19 to 0.29.22 in /runtime-volumes/dagster/user_code #451, plus the Reference Data / Valid Metadata split from chore(deps): Bump python from cae66f2 to cad9a2c in /compose-configs/egeria-quickstart #450): 3 Digital Product Manager templates updated, valid-metadata commands moved to a new Valid Metadata/ folder, and new reference-data and valid-value link/detach commands. 49 paths.

Testing

• 78 Resource Browser tests pass (quickstart and freshstart copies).
• Live on quickstart: GET private-notes as erinoverview returns linked entry 8bec72e4 (protected: true); as peterprofile it returns nothing. Older unlinked test entries no longer appear. DELETE returns 501 without calling Egeria. I didn't POST a new private note through the UI, since it couldn't be deleted afterwards. The re-zone call itself was verified by REST (above).
• I checked the renamed page and the Portal tile on quickstart, with no console errors.
• On quickstart through Apache (after httpd -t and a graceful reload): /resource-locator, /resource-locator?guid=… and /resource-browser all return 200, and the Portal tile links to /resource-locator.

🤖 Generated with Claude Code