First deploy, checked: identity wait, service address, usage, checklist (T12, part 1)

.github/workflows/deploy.yml

@@ -235,6 +235,10 @@ jobs:
           workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ needs.infra.outputs.deploy_service_account }}
       - uses: ./.github/actions/gcloud
+      # The binding that lends this identity may be seconds old: the apply of
+      # this very delivery makes it when the identity is new.
+      - name: The identity can sign in
+        run: just ci-identity-ready
       # Read into a variable first: inside the echo, a push that failed would
       # leave the step green, and the next one would roll out an empty
       # reference.
@@ -292,6 +296,11 @@ jobs:
         with:
           workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ needs.infra.outputs.hosting_service_account }}
+      # gcloud only to ask for a token, as the job above does: the binding that
+      # lends this identity may be seconds old too.
+      - uses: ./.github/actions/gcloud
+      - name: The identity can sign in
+        run: just ci-identity-ready
       - uses: ./.github/actions/firebase
       - name: Publish the SPA
         env:

CLAUDE.md

@@ -310,7 +310,7 @@ Inside the container:
 - **`gh`.** What a change looks like on github.com is otherwise invisible from in here, and two parts of it are asked for by name: the alerts of the code scan, which a task closes before the next one starts, and whether the delivery that carried the change ran. `gh auth login` is answered once: the credentials live in the `canvas-api-gh` volume, as gcloud's live in `canvas-api-gcloud`, where Terraform reads them.
 - **Ports.** 8080 (the API) and 5173 (Vite's dev server for the SPA) are forwarded to the host.
 - **Just recipes.** `just --list` shows all of them.
-  - The everyday ones are `just fmt`, `just test`, `just lint`, `just build` and `just run`, and for the SPA `just web-dev`, which serves it on port 5173, `just web-fmt` and `just web-test`, and for the cloud `just tf-fmt`. `just web-build` builds the SPA into `web/dist`; `just build` and the image leave it out (R10).
+  - The everyday ones are `just fmt`, `just test`, `just lint`, `just build` and `just run`, and for the SPA `just web-dev`, which serves it on port 5173, `just web-fmt` and `just web-test`, and for the cloud `just tf-fmt` and `just usage`, which sets what the deployed service used of Cloud Run against a month's free tier. `just web-build` builds the SPA into `web/dist`; `just build` and the image leave it out (R10).
   - The ones that must be green before a task is done are **`just ci-lint`** (formatting and lint), **`just ci-test`** (the race detector and coverage), **`just ci-mocks-check`**, **`just ci-licenses`**, **`just ci-vuln`**, **`just ci-secrets`** (gitleaks over the whole history and over what is not committed yet), **`just ci-image-smoke`** (the runtime image starts, and its `/health` names this build), **`just ci-image-scan`** (Trivy over that image, HIGH and CRITICAL with a fix out), **`just release-version`** (the version the next release takes, from `RELEASE_LINE` in `release.yml` and the tags), **`just release-artifacts`** (what a release holds: the server for amd64 and arm64, the SPA's archive and `SHA256SUMS`, in `dist/`), **`just tf-check`** (the Terraform files formatted, the configuration valid against the providers its lock file names, and its tests on mock providers, with no credential) and **`just ci-workflows`** (actionlint, with shellcheck over the scripts of the workflows' steps but not of the composite actions': what GitHub would refuse or misread in the workflows, the call from `release.yml` to `deploy.yml` among it), and they are what CI runs (`.github/workflows/ci.yml`). `ci-licenses` holds every Go module and npm package to the license list and `THIRD_PARTY_LICENSES` to the dependency graph — `just licenses` rewrites it. `ci-vuln` runs govulncheck and `npm audit` (R48). A false alarm of the secret scan is waived in `.gitleaks.toml`, by a rule, a path and the shape of a value together, a vulnerability only in `.trivyignore`, and a finding of actionlint only in `.github/actionlint.yaml`; each with its reason.
   - A change to `web/` must also pass **`just ci-web`**: Biome, the types, the tests with their coverage, and a build.
   - gofmt never walks into `reference/`: the copy is the sample's, read-only.

README.md

@@ -22,6 +22,12 @@ MathTrail Canvas is a math tutor for children in grades 1–6. A child solves a
 
 The picture is a concept from the design: it shows where the product is heading, further than the MVP goes.
 
+## Design
+
+Where the design differs from the documents, the documents win.
+
+- [The olympiad coach](https://mathtrail.app/en/coach/) — live on mathtrail.app.
+
 ## The MathTrail core
 
 [mathtrail-standalone](https://github.com/MathTrail/mathtrail-standalone) is the core of MathTrail: a free, open-source app for Claude and ChatGPT that turns an adult's own chat into an olympiad maths trainer for grades 1–6, with checked tasks in any language, a diagnosis of the child's mistake and a memory of how they are progressing. Canvas takes its service skeleton, development environment, CI/CD and Terraform, but runs on its own: it shares neither tasks nor data with the core.
@@ -37,9 +43,3 @@ The documents are in Russian.
 - [docs/self-hosting.md](docs/self-hosting.md) — how it is deployed: the one-time bootstrap, the delivery of every release, rollback and return.
 - [docs/stack.html](docs/stack.html) — the technology stack, layer by layer, with versions and what is still to be chosen. Open the file from a checkout in a browser: GitHub shows only its source.
 - [RUN.md](RUN.md) — the implementation plan, in epics: the current epic broken into small tasks, run and reviewed one at a time, and the later epics.
-
-## Design
-
-It shows where the product is heading; where it differs from the documents, the documents win.
-
-- [The olympiad coach](https://mathtrail.app/en/coach/) — live on mathtrail.app.