docs(v2): add nested EQL v2 reference for existing v2.2 deployments

[coderdan]

Stands up a durable EQL v2 reference for customers still running EQL v2.2, in the new IA. Sourced from the shipped v2.2 docs.

Why

The new /reference/eql section on v2 documents EQL v3 only. v2.2 customers still need accurate v2 index/query/payload docs that survive the eventual deletion of the legacy content/stack tree (CIP-3335).

Note (changed): EQL 2.3 is being withdrawn, so this section documents v2.2, not 2.3. It is therefore sourced from the original v2.2 legacy pages — not the 2.3 rewrites in #21/#22, which would mis-document v2.2 (2.3 removed b3/ocf/ocv from the payload and changed the index/Supabase query model).

What's here — content/docs/reference/eql/v2/

• index.mdx — EQL v2 overview (from reference/eql-guide.mdx)
• indexes.mdx — index recipes, including the self-hosted vs Supabase query forms
• queries.mdx — equality / match / range query patterns
• payload.mdx — the CipherCell v2.2 payload (b3 / ocf / ocv)

Nested under the existing EQL reference and wired into its nav under a "Previous versions" separator.

Fixes carried in (grounded, version-safe)

• The eql-guide's fabricated index-extraction function names (encrypted_get_hmac_256, …) corrected to the real eql_v2.hmac_256 / bloom_filter / ore_block_u64_8_256, verified against the v2.2 index recipes; the config/query lists point to the generated per-release EQL API reference rather than asserting unverified names.
• A stale cs_ste_vec_v2 name aligned to eql_v2.ste_vec, consistent with the rest of the v2.2 docs.

Facets & adaptation

• Every page: type: reference, components: [eql], verifiedAgainst: { eql: "2.2" }, plus a version banner routing new projects to the v3 reference.
• Intra-section links rewritten to /reference/eql/v2/*; links to un-ported pages keep pointing at the still-served legacy /stack tree.

Verify before merge (v2.2 accuracy)

• Config/query function names — I did not assert specific config_add_* / encrypted_eq names (couldn't verify against v2.2); the page points to the generated reference instead. Confirm that's acceptable, or supply the real v2.2 names.
• JSONB containment form — eql_v2.ste_vec(metadata) @> $1 inferred from the schema-qualified naming; confirm the exact v2.2 containment query.

Supersedes #21 and #22 for the v2 branch.

https://claude.ai/code/session_01CqDNqLSEEkCi7xAJFq7HJA

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
public-docs	Ready	Preview, Comment	Jul 5, 2026 6:33am