A deployment is complete when the receipt says so

Prove what is being deployed

The direct broker issues a short-lived challenge. A client commits its hash with source, pushes the configured branch, and submits the exact revision with the private challenge material. The broker verifies the repository identity and current branch head before retrieving immutable source with its existing server-side access.

Acceptance into the queue is distinct from a completed deployment. A scoped receipt reports the matching revision's outcome, while tests, health checks, and traffic evidence happen on the existing hosts. That makes the handover auditable without giving the workstation infrastructure credentials.

Keep application privileges narrow

The controller owns Google Workspace login and forwards verified identity to loopback services. It strips caller-supplied identity context before adding trusted values. Child applications receive service-specific storage capabilities rather than cloud or Google secrets.

Shared design components give hosted pages consistent navigation, but application authorization remains separate. A platform administrator role does not automatically become a business role inside a protected CGRA application.

Inspect the failure path

A candidate can fail tests, health, or traffic checks while the existing release continues serving. The receipt model makes that outcome part of the deployment record rather than an ambiguous interruption. The same separation applies to access: proving the right source was deployed does not grant a user permission to use its application.