[RyazanovAlexander]

Summary

The first delivery (v0.1.3, merged with #15) went green on its second attempt. The deploy job signed in five seconds after the apply had made its federated binding, and IAM had not put the binding in force yet. This PR records that delivery and makes the pipeline wait for a new identity. Checking the live deployment found two more defects, and both are fixed here.

Merging this PR is the second delivery. Part 2 of the task uses it to check the delivery queue, rollback and return, and comes back as a second PR with the results.

Changes

• ci-identity-ready runs in the deploy and hosting jobs right after sign-in:
  • it asks for the identity's token for up to eight minutes by the clock;
  • it waits out a binding not yet in force and brief outages;
  • it fails at once when the token exchange itself is refused (invalid_grant, invalid_target, unauthorized_client, …).
• service_url is now the address made of the service name, project number and region, taken from urls. Before, it was the address with a random part, from uri. An output precondition stops the apply if Cloud Run does not report it.
• _Default sink: unique_writer_identity = true. Provider 8.3.0 reads a sink with no writer identity as a unique one, so false showed a change in every plan. A sink whose bucket is in its own project never has a writer identity.
• just usage [window] reads Cloud Run's metrics from the Monitoring API and sets them against a month's free tier (180,000 vCPU-s, 360,000 GiB-s, 2M requests). The token is passed in a header, never on the command line.
• Docs:
  • docs/self-hosting.md gets a first-delivery checklist of eight commands; the billing account is masked even in errors;
  • docs/live/01-first-deploy.md reports the first delivery in UTC, with costs and findings;
  • RUN.md gets the T12 record and debt Д14: roles granted by the same apply are not awaited;
  • decision R58, CLAUDE.md and the stack page are updated;
  • README now puts the Design section before The MathTrail core.

How it was verified

• All required checks are green, and tf-check runs 18 tests.
• The checklist, just usage and ci-tf-plan ran against prod, read-only. After the fix the plan changes no resource, only the service_url output.
• Fourteen checks were switched off one at a time and each turned red:
  • the Terraform ones have tests;
  • the recipe ones were run against fake gcloud and curl.

Before merging

• TF_VAR_operator_email is set, so the second delivery creates the load alert.
• The plan job shows only the service_url output change, plus the alert and its channel if the address is set.
• The devcontainer is rebuilt (for firebase), and the narrow live-run permission is in place.

Open

• Part 2, after the merge: the cd queue with the Deploy button, the checklist on v0.1.4, rollback and return, just usage, and the report closed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud