tc-copilot
AI assistant platform for Travel Counsellors combining LLM chat (OpenAI), MongoDB Atlas vector-search hotel recommendations, several FastEndpoints APIs, a MassTransit/SQS queue worker and scheduled data-import tasks.
Health score
0 to 100 across seven weighted factors; nothing is hidden. Green is 75 and above, amber 50 to 74, red below 50. How scoring works.
Facts
| Languages | csharp |
| Frameworks | ASP.NET Core 8, FastEndpoints, MassTransit 8, SignalR |
| Runtimes | .NET 8 |
| Tests / CI | good / CI in place |
| Last commit | 2026-07-24 |
| Owner | Owner unknown (mapping to be curated) |
| Domain | AI and assistants (system generated; curate in repo-owners.json to override) |
| Product area | TC Co-Pilot |
| Hosted | AWS + on-prem Ships artefacts to both AWS and on-prem machines (see evidence below)
|
| Releases | 1 release pipeline(s): copilot-import-schedule-task |
| Integration | rest, signalr, graphql, masstransit, sqs |
| Source | Open in Azure DevOps |
Dependencies in context
Entanglement
loose No binding mechanisms apply: this system needs no untangling work.
Depends on / used by
Migration playbooks
Generated from this repo's assessment data: what is feasible, what blocks it, and the steps in order. Ratings: green means actionable now, amber means sequence other work first, red means blocked, grey means not applicable.
ZDD adoption
No excuseNothing technical is holding this repo on the three-week release. It either already deploys without downtime (AWS) or is a modern, well-tested service the automated stealth path can carry today. Already deploys as a container to AWS, which releases without downtime today. Some artefacts still deploy on-prem; they follow the on-prem path. Separating it from the three-week release is a process decision, not a technical one.
- Serialized state or messages in flight (Redis or queues): new code must deserialize objects written by the previous version
- Adopt the four-stage discipline from the ZDD engineering standard: pre-deployment compatibility, deployment, feature activation behind a flag, post-release cleanup.
- Make every change dual-version safe: backwards-compatible APIs (new major version for breaking wire changes), expand and contract for any schema change, and consumers tolerant of unknown fields.
- Audit serialized data: anything in Redis, queues or shared caches must deserialize cleanly across adjacent versions.
- Wrap behaviour changes in feature flags so code deploys dark and release becomes a business decision, not a deployment event.
- Route deployments through the Workflow Engine's automated drain, deploy, health-check, return cycle (the path proven by the first automated production run in mid-2026).
- Verify with area-scoped regression rather than the whole-platform cycle, and watch error rates after rollout with automated rollback on alert.
SQL Server exit
Not applicableNo SQL Server dependency is recorded for this repo. Nothing to migrate.
Containerisation
Partially containerisedPart of this repo already builds containers for AWS while other artefacts still deploy to on-prem machines. Finish the job by moving the remaining artefacts (see the hosting evidence on this page) through the same pipeline template.
- Identify the artefacts still deploying through deployment-group release pipelines (listed in the hosting evidence).
- Move each to the shared ci.yml pipeline template with the container parameters, as the already-containerised artefacts in this repo do.
- Disarm the old release pipelines once traffic is confirmed on the new deployment.
Recommended actions
Rotate the credentials committed to tc-copilot
Risk flags indicate credentials or keys in source (hardcoded-secrets). Rotate now and enable secret scanning in CI; this is independent of all other work.
Impact: Closes a live security exposure at near-zero cost
proposedAssessment notes
tc-copilot
Purpose
TC CoPilot is the estate's AI platform: four .NET 8 APIs (main, Chat, Admin, AccomPricing, plus an MCP server exposing tools via ModelContextProtocol), a queue worker, and scheduled data importers. Chat supports multiple modes (recommendations, RAG support with citations, business insights via Snowflake Cortex, B2C customer chat) streamed over SignalR; recommendations use OpenAI embeddings matched with MongoDB Atlas Vector Search.
Tech stack
C# .NET 8 across ~21 src projects. FastEndpoints APIs, Microsoft.Extensions.AI + OpenAI SDK (OllamaSharp as an alternative), MassTransit 8 over Amazon SQS with MongoDB sagas, StrawberryShake GraphQL clients for Planisto products/regions, Dapper + Microsoft.Data.SqlClient in the importer, PuppeteerSharp/PdfPig/RazorLight for document handling, OpenTelemetry, Serilog, TC.ScriptRunner.Mongo migrations. Exceptional documentation: a docs/ tree covering architecture, chat system, recommendation engine, data flow and agent conventions.
Deployment
The included.json trace links only the customer-import scheduled task (build tc-copilot-customer-import-task → release copilot-import-schedule-task, release_count 1), but the repo also carries build.yml (pipeline tc-copilot, shared templates, SDK 8) and a documented release.yml. Notably build-customer-importer.yml deliberately disables tests by passing a garbage testSelection value.
Dependencies
Internal packages: TC.ConnectionBroker.* 1.22 (tc-connectionbroker), TC.Destination.Queries.GraphQL.Client (phenix-destination-management), TC.DocumentationBuilder.Client (backoffice-documentation-booking); TC.Cognito.Auth.Client, Phenix.Auth.JWTBearer, TC.MassTransit.AmazonSQS and TC.AWS.S3 map to no included repo. External: OpenAI (chat, embeddings, vector stores), Planisto GraphQL APIs, TrustYou reviews, Snowflake (business insights), Freshdesk (support content), AWS SQS/S3/SSM.
Data stores
MongoDB Atlas: CoPilot (customers, preferences, accommodations, chat logs, regions, user settings) and ForecastPricing (accommodation pricing). The importer also reads from on-prem SQL Server via a brokered connection.
Integration points
REST APIs, SignalR streaming chat hubs, GraphQL (StrawberryShake to Planisto), MassTransit over Amazon SQS, plus an MCP tool server.
Code health
Eleven test projects including E2E tests, active daily development (last commit 2026-07-24), excellent docs. The critical issue: appsettings.json files contain what appear to be live secrets — OpenAI project API keys (three of them), a TrustYou API key and Planisto API keys — committed in source. The customer-importer CI intentionally skips tests.
Modernisation risks
Low from a stack perspective — it is one of the newest, best-documented codebases in the estate. Risks are security and governance: committed third-party API keys need immediate rotation and a move to a secrets store; customer data flows to OpenAI/Snowflake warrant data-residency review (the repo itself documents this); and the deployed-pipeline trace only covers the importer, so production hosting of the APIs and worker should be confirmed.